Mongo BSON Injection: Ruby Regexps Strike Again

mongo_patch.rb

# http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html

# There’s a subtle bug in BSON-ruby implementation, leading in best case
# scenario to low-severity DoS, but most likely to critical BSON Injection
# (similar to SQL injection) - depends on gem versions you use.

# b = Moped::BSON::ObjectId
# puts "Injection!" if b.legal? "a"*24+"\na"
# puts "DOS" if b.legal? "a"*24+"\n"

module Moped
  module BSON
    class ObjectId
      def self.legal?(s)
        /\A\h{24}\z/ === s.to_s
      end
    end
  end
end