javajsonmongodbjongo

Creating a dynamic query with MongoDB, Java and Jongo

I'm using a combination of Java, the Play Framework using Java and not Scala, MongoDB and Jongo as my go between for a basic web CRUD app. I keep receiving a JSON parse exception even though my string doesn't contain any illegal characters. It's actually failing on closing curly bracket at the end of the statement. Below is my error and code. The query string is just a string builder, searching if an object is empty or has a value, if it has a value it's appended to a string.

Jongo method:

public static Iterable<OneDomain> findWithQueryString(String queryString){
    return domains().find("{#}", queryString).as(OneDomain.class);
}

Controller Methods: String builder example:

        if(queryStringBuilder.toString().equalsIgnoreCase("")){
            queryStringBuilder.append("date: {$gte : " + searchObj.dateFrom + ", $lt: " + searchObj.dateTo + "}");
        }else{
            queryStringBuilder.append(" , ");
            queryStringBuilder.append("date: {$gte : " + searchObj.dateFrom + ", $lt: " + searchObj.dateTo + "}");
        }

        String queryString = queryStringBuilder.toString();

        Iterable<OneDomain> filteredIterable = OneDomain.findWithQueryString(queryString);

Gives me this error:

   Caused by: com.mongodb.util.JSONParseException:
   {"source : Online Lists , blacklist : true , vetted : true , is : false , isNot : true"}
                                                                                          ^

with the error on the "}" ending it.

In addition to that, if I try to escape the characters by putting in a \" so it becomes \"date\" it will parse and error out like so:

   Caused by: com.mongodb.util.JSONParseException:
   {"\"source\" : \"Online Lists\" , \"blacklist\" : true , \"vetted\" : true , \"is\" : false , \"isNot\" : true"}

Can I actually do this or because it's Java being inserted into it, the quotes will be around the whole string and thus it's trying to read it as a single JSON field vs it being the whole query?

Solution

  • First, make sure not to make your self vulnerable to injection attacks. Read up on injection attacks in general, and more specifically on MongoDB, eg OWASP page on Testing for NoSQL injection.

    While you can indeed pass a generated query string into the find method I would not advise it. I did the same and had big problem when we generated a query containing the jongo substitution parameter #, ie

    // This will throw an exception:
// java.lang.IllegalArgumentException: Not enough parameters passed to query: {"value":"#"}
...find("{" + "\"value\":\"#\"" + "}")

    My solution is to pass a DBObject:

    import com.mongodb.BasicDBObject
...find("#", new BasicDBObject().append("value", "#"))

    It can also be built with the QueryBuilder:

    import com.mongodb.QueryBuilder
...find("#", QueryBuilder.start("value").is("#").get())

    It would be nice though to have query builder support directly in the Jongo API: https://github.com/bguerout/jongo/issues/173