mongo-escape

library2.0.6jsnpmunverified

Lightweight npm package (v2.0.6, last updated 2016) for escaping $ and . characters in MongoDB query keys to prevent NoSQL injection attacks. Replaces $ with Unicode fullwidth dollar sign (＄) and . with Unicode fullwidth full stop (．). Only protects against keyword injection, not full JavaScript injection – mapReduce and $where are not safe. Works on strings and objects (keys escaped in-place, no clone). Supports escape and unescape functions, with optional recursion flag. Minimal dependencies, simple API. Suitable for legacy systems needing basic injection prevention; not actively maintained.

security

npm install mongo-escape

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · MONGO-ESCAPE

mongo-escape

securityjavascriptv2.0.6

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

escape

✓ import { escape } from 'mongo-escape'

✗ const mongoEscape = require('mongo-escape'); mongoEscape.escape('$in')

The package exposes both named exports and a default export; named import is preferred for tree-shaking.

unescape

✓ import { unescape } from 'mongo-escape'

✗ const mongoEscape = require('mongo-escape'); mongoEscape('＄in')

unescape reverses the escape; it is a separate named export.

default

✓ import mongoEscape from 'mongo-escape'

✗ const mongoEscape = require('mongo-escape').default

Default export is the escape function itself, for convenience.

Demonstrates basic escape and unescape of strings and objects to prevent NoSQL injection by replacing $ and . with fullwidth equivalents.

import { escape, unescape } from 'mongo-escape'; // Escape a string const escapedKey = escape('$in'); console.log(escapedKey); // '＄in' // Escape an object's keys const query = { username: 'admin', 'role.$ne': 'user' }; const safeQuery = escape(query); console.log(safeQuery); // { username: 'admin', 'role．＄ne': 'user' } // Unescape const originalKey = unescape('＄in'); console.log(originalKey); // '$in' const originalQuery = unescape(safeQuery); console.log(originalQuery); // { username: 'admin', 'role.$ne': 'user' }

Debug

Known issues

gotchaDoes not protect against full JavaScript injection, mapReduce, or $where operator.

fix

Disable server-side JavaScript in MongoDB and avoid using mapReduce and $where with untrusted input.

affects: >=0.0.0

gotchaObject keys are escaped in-place, not cloned. The original object is mutated.

fix

Clone the object before passing to escape if you need to keep the original unescaped.

affects: >=0.0.0

gotchaSymbol or function input throws an error.

fix

Ensure input is a string or plain object before calling escape/unescape.

affects: >=1.0.0

deprecatedPackage unmaintained since 2016; no updates for modern MongoDB or Node.js versions.

fix

Consider using mongo-sanitize or built-in MongoDB parameterized queries.

affects: >=2.0.0

Errors

Common errors & fixes

TypeError: Cannot read properties of undefined (reading 'escape')

Importing default export incorrectly in CommonJS.

fix

Use `const { escape } = require('mongo-escape');` instead of `require('mongo-escape').escape();`

Error: Input cannot be a function or a symbol

Passing a function or symbol to escape/unescape.

fix

Only pass strings or plain objects, not functions or symbols.

Unescaped $in caused injection vulnerability

Relying on this library for mapReduce or $where.

fix

Do not use mapReduce or $where with untrusted input; disable server-side JS.

Upgrade

Version history

2.0.6latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

10 hits · last 30 days

node

Resources

githubgit://github.com/timkuijsten/node-mongo-escape ↗

packagemongo-escape ↗

homepagehttps://github.com/timkuijsten/node-mongo-escape ↗