Registry / database / express-mongodb-filters

express-mongodb-filters

JSON →
library1.1.2jsnpmunverified

ExpressJS middleware that allows handling custom MongoDB queries sent from the client via HTTP query parameters. Current stable version is 1.1.2, last updated in 2020. The middleware parses a JSON string from a query parameter (default: 'filter') and attaches it to req.query, enabling direct MongoDB query syntax in HTTP requests. No built-in security filtering – explicit documentation warns that input must be sanitized manually, a critical footgun. Supports common MongoDB operators ($or, $and, $ne, $regex, etc.) and allows custom configuration for parameter name, error class, and operator whitelist/blacklist. Lightweight, no dependencies. Differentiator: minimalistic approach vs. more opinionated query-parsing alternatives like 'express-query-filter'.

databasedevops
npm install express-mongodb-filters
github ↗package ↗homepage ↗
INSTALL
IMPORT
SIG · EXPRESS-MONGODB-FI
E
express-mongodb-filters
databasejavascriptv1.1.2
harness data pending
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

default (filterMiddleware)
✓ const filterMiddleware = require('express-mongodb-filters')
✗ import filterMiddleware from 'express-mongodb-filters'
Package does not ship ESM; only CommonJS is supported. Using ES import will fail unless the project uses a bundler or Node ESM with createRequire.
default (filterMiddleware)
✓ import filterMiddleware from 'express-mongodb-filters'
If using TypeScript with 'esModuleInterop' or bundler that handles CJS, this import may work. However, the package has no type definitions.
default (filterMiddleware)
✓ const filterMiddleware = require('express-mongodb-filters').default
✗ const filterMiddleware = require('express-mongodb-filters')
Some mis-published CJS packages export default as a property; but here the module.exports is the function directly, so .default is wrong and will be undefined.

Shows basic Express server using the middleware to parse a MongoDB filter from query parameter 'filter' and use it in a Mongoose query. Includes explicit security warning.

const express = require('express'); const filterMiddleware = require('express-mongodb-filters'); const app = express(); app.use(filterMiddleware()); app.get('/users', (req, res) => { const query = req.query; // { filter: '...' } parsed from querystring // Now query.filter is the MongoDB query object (if valid JSON) // WARNING: No sanitization applied! User.find(query.filter, (err, users) => { if (err) return res.status(400).send(err); res.json(users); }); }); app.listen(3000);
Debug
Known issues
breakingNo input sanitization – directly exposes MongoDB query injection vulnerability. Attackers can send arbitrary MongoDB operators ($where, $regex, etc.) to manipulate queries.
fix
Always validate and sanitize the parsed filter object before passing to MongoDB queries. Use library like 'mongo-sanitize' or manually whitelist allowed fields and operators.
affects: all
gotchaThe middleware overwrites req.query.filter (or custom parameterName) with the parsed JSON object, not the original string. Subsequent access to req.query may behave unexpectedly if multiple parameters exist.
fix
Either use a different parameterName to avoid collision, or store the original string before the middleware runs.
affects: all
gotchaMalformed JSON in the filter parameter causes the middleware to throw an error (unless customErrorClass is provided). Without error-handling middleware, the app will crash.
fix
Either provide a customErrorClass that inherits from Error, or add an Express error-handling middleware to catch and respond gracefully.
affects: all
deprecatedPackage last published in 2020 with no updates since. Potential security issues in underlying MongoDB operators may go unpatched.
fix
Consider migrating to actively maintained alternative or fork the package to apply patches.
affects: >=1.1.2
Errors
Common errors & fixes
TypeError: filterMiddleware is not a function
Using ES import syntax on a CommonJS-only package without compatibility setup.
fix
Use require('express-mongodb-filters') instead of import.
SyntaxError: Unexpected token o in JSON at position 1
The 'filter' query parameter string is not valid JSON (e.g., an object literal like {hello: 1} is invalid; needs double quotes).
fix
Ensure filter parameter is a JSON string, e.g., ?filter={"hello":1}
Cannot find module 'express-mongodb-filters'
Package was not installed or is missing from node_modules.
fix
Run `npm install express-mongodb-filters` in your project directory.
Upgrade
Version history
1.1.2latest on npm
Audit
Dependencies

No dependency data recorded yet.

Agent activity
8 hits · last 30 days
node
8
Resources
githubhttps://github.com/fatmatto/express-mongodb-filter ↗
packageexpress-mongodb-filters ↗
homepagehttps://github.com/fatmatto/express-mongodb-filter#readme ↗
express-mongodb-filters — npm install express-mongodb-filters · libregistry