Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add support for running raw commands on a collection #939

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,7 @@ You can use the following [environment variables](https://docs.docker.com/refere
`ME_CONFIG_OPTIONS_FULLWIDTH_LAYOUT` | `false` | if set to true an alternative page layout is used utilizing full window width.
`ME_CONFIG_OPTIONS_PERSIST_EDIT_MODE` | `false` | if set to true, remain on same page after clicked on Save button
`ME_CONFIG_OPTIONS_NO_DELETE` | `false` | if noDelete is true, components of deleting are not visible.
`ME_CONFIG_OPTIONS_NO_RAW_COMMAND`| `false` | if noRawCommand is true, the Raw tab in collection view is not visible.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe this should be called something else to highlight how risky this is. ME_CONFIG_OPTIONS_ALLOW_CODE_INJECTION? Default must be not to allow it.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree

`ME_CONFIG_SITE_SSL_ENABLED` | `false` | Enable SSL.
`ME_CONFIG_MONGODB_SSLVALIDATE` | `true` | Validate mongod server certificate against CA
`ME_CONFIG_SITE_SSL_CRT_PATH` | ` ` | SSL certificate file.
Expand Down
2 changes: 2 additions & 0 deletions config.default.js
Original file line number Diff line number Diff line change
Expand Up @@ -195,6 +195,8 @@ export default {

// noDelete: if noDelete is set to true, we won't show delete buttons
noDelete: getBoolean(process.env.ME_CONFIG_OPTIONS_NO_DELETE, false),

noRawCommand: getBoolean(process.env.ME_CONFIG_OPTIONS_NO_RAW_COMMAND, false),
},

// Specify the default keyname that should be picked from a document to display in collections list.
Expand Down
1 change: 1 addition & 0 deletions lib/middleware.js
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ const middleware = async function (config) {
app.set('me_no_export', config.options.noExport || false);
app.set('gridFSEnabled', config.options.gridFSEnabled || false);
app.set('no_delete', config.options.noDelete || false);
app.set('no_raw_command', config.options.noRawCommand || false);

return app;
};
Expand Down
37 changes: 37 additions & 0 deletions lib/routes/collection.js
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,43 @@ const routes = function (config) {

// view all entries in a collection
exp.viewCollection = async function (req, res) {
if (req.query.command) {
try {
const match = /^(.*?)\s*\((.*)\)\s*$/.exec(req.query.command);

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data

This [regular expression](1) that depends on [a user-provided value](2) may run slow on strings with many repetitions of ' '. This [regular expression](3) that depends on [a user-provided value](2) may run slow on strings starting with '(' and with many repetitions of '(a'.
if (!match || !match.length >= 3) {
req.session.error = 'Invalid command. Example: updateOne({myproperty:"someValue"}, {$set:{myproperty:"someOtherValue"}})';
return res.redirect('back');
}

const fun = match[1];
if (typeof req.collection[fun] === 'function') {
const args = match[2].split(',').map((s) => eval(`(${s})`));

Check failure

Code scanning / CodeQL

Code injection

[User-provided value](1) flows to here and is interpreted as code.
return req.collection[fun](...args, async function (err, result) {
if (err) {
req.session.error = err.message;
return res.redirect('back');
}
try {
if (result.toArray) {
result = await result.toArray();
}
req.session.success = JSON.stringify(result, null, 2);
} catch (e) {
console.error(e);
req.session.success = 'Command succeeded, but unable to parse the result';
}
return res.redirect('back');
});
}
req.session.error = `Invalid function: ${fun}`;
return res.redirect('back');
} catch (err) {
console.error(err);
req.session.error = 'Invalid command\nExample command: updateOne({myproperty:"someValue"}, {$set:{myproperty:"someOtherValue"}})';
return res.redirect('back');
}
}

let query;
let queryOptions;
try {
Expand Down
21 changes: 21 additions & 0 deletions lib/views/collection.html
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,9 @@
<ul id="tabs" class="nav nav-pills nav-justified" data-tabs="tabs">
<li class="active"><a href="#simple" data-toggle="tab"><span class="glyphicon glyphicon-tag"></span> Simple</a></li>
<li><a href="#advanced" data-toggle="tab"><span class="glyphicon glyphicon-tags"></span> Advanced</a></li>
{% if !settings.read_only && !settings.no_raw_command %}
<li><a href="#raw" data-toggle="tab"><span class="glyphicon glyphicon-play"></span> Raw</a></li>
{% endif %}
</ul>
<div id="my-tab-content" class="tab-content">
<div class="tab-pane active" id="simple">
Expand Down Expand Up @@ -140,6 +143,24 @@
</div>
</form>
</div>
<div class="tab-pane" id="raw">
<form class="well" method="get" action="{{ collectionUrl }}">
{% for column in columns %}
<input type="checkbox" name="sort[{{column}}]" class="hide sort-{{column}}" {% if sort[column] %}value="{{sort[column]}}" checked="checked"{% endif %}/>
{% endfor %}
<div class="row">
<div class="form-group col-sm-12 col-md-10">
<textarea class="input-medium form-control" style="width: 100%; height: 150px" id="command" name="command" placeholder="Command" title="Command">{{ command }}</textarea>
</div>
<div class="form-group col-md-2">
<button style="height:150px;" type="submit" class="btn btn-primary btn-block">
<span class="glyphicon glyphicon-play"></span>
Run
</button>
</div>
</div>
</form>
</div>
</div>
{% if !settings.read_only && !settings.no_delete && count > 0 %}
<p>
Expand Down
1 change: 1 addition & 0 deletions lib/views/layout.html
Original file line number Diff line number Diff line change
Expand Up @@ -104,6 +104,7 @@ <h1 id="pageTitle">{{ title }}</h1>
window.ME_SETTINGS = {
readOnly: '{{ !!settings.read_only }}' === 'true',
noDelete: '{{ !!settings.no_delete }}' === 'true',
noRawCommand: '{{ !!settings.no_raw_command }}' === 'true',
codeMirrorEditorTheme: '{{ editorTheme }}',
baseHref: '{{ baseHref }}',
collapsibleJSON: '{{ !!settings.me_collapsible_json }}' === 'true',
Expand Down