Fix NoSQL Injection in TurboGears

NoSQL injection in TurboGears typically exploits the Ming or MongoEngine ODM. When untrusted input is passed directly into query filters, attackers can inject MongoDB operators like $gt, $ne, or $regex to bypass authentication, leak records, or perform blind exfiltration. If you aren't sanitizing types, you're giving away the keys to the kingdom.

The Vulnerable Pattern

@expose('json')
def get_user(self, uid):
    # VULNERABLE: uid is passed directly to the ODM filter.
    # An attacker can send ?uid[$ne]=1 to retrieve any user.
    user = User.query.find({'uid': uid}).first()
    return dict(user=user)

The Secure Implementation

The vulnerability arises because TurboGears' parameter parsing allows complex types (like dictionaries) to be passed through query strings. If an attacker provides `?uid[$gt]=0`, the ODM interprets this as a MongoDB operator. The fix involves strict schema enforcement. By using the `@validate` decorator with FormEncode validators or explicitly casting the input to a scalar type (int, str), you ensure that the ODM treats the input as a literal value rather than a query command.

from tg import validate
from formencode import validators
@expose(‘json’)
@validate(validators={‘uid’: validators.Int()})
def get_user(self, uid):
# SECURE: @validate ensures uid is an integer.
# Manual casting to str() or int() also neutralizes dict-based operator injection.
user = User.query.find({‘uid’: int(uid)}).first()
return dict(user=user)