From 7cf9ca050072f58d5f267e0029aa86f7f2ab320c Mon Sep 17 00:00:00 2001 From: Michael Morisi Date: Thu, 9 Jul 2026 11:48:40 -0400 Subject: [PATCH 1/2] DOCSP-61608: Add shared JSON-to-BSON injection warning admonition --- dbx/json-bson-injection-warning.rst | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 dbx/json-bson-injection-warning.rst diff --git a/dbx/json-bson-injection-warning.rst b/dbx/json-bson-injection-warning.rst new file mode 100644 index 0000000..6ad69a9 --- /dev/null +++ b/dbx/json-bson-injection-warning.rst @@ -0,0 +1,14 @@ +.. warning:: Validate Untrusted Input Before Converting JSON to BSON + + If you convert a JSON string to BSON and then use the result in a + query, update, or command, an attacker can inject operators or + unexpected field values that change the meaning of the operation. + This risk is greatest when the JSON originates from a user, an + API request, or another untrusted source. + + To learn more about how to reduce this risk, see + :ref:`client-libraries-security-best-practices`. + +.. TODO: DOCSP-61609 must define a page with the label + client-libraries-security-best-practices before this ref resolves. + Update the label here if DOCSP-61609 ships with a different one. From b7e39b02066db650c831b03b669f1bd28d900a5a Mon Sep 17 00:00:00 2001 From: Michael Morisi Date: Fri, 10 Jul 2026 09:06:28 -0400 Subject: [PATCH 2/2] Address review: clarify resulting BSON and tie learn-more link to validation --- dbx/json-bson-injection-warning.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dbx/json-bson-injection-warning.rst b/dbx/json-bson-injection-warning.rst index 6ad69a9..7152c8f 100644 --- a/dbx/json-bson-injection-warning.rst +++ b/dbx/json-bson-injection-warning.rst @@ -1,12 +1,12 @@ .. warning:: Validate Untrusted Input Before Converting JSON to BSON - If you convert a JSON string to BSON and then use the result in a + If you convert a JSON string to BSON and use the resulting BSON in a query, update, or command, an attacker can inject operators or unexpected field values that change the meaning of the operation. This risk is greatest when the JSON originates from a user, an API request, or another untrusted source. - To learn more about how to reduce this risk, see + To learn more about validating input before conversion, see :ref:`client-libraries-security-best-practices`. .. TODO: DOCSP-61609 must define a page with the label