NoSQL injection

02Type before meaning

The card accepts ada and lane as strings and rejects the object containing kind. An application that merges arbitrary caller objects into a query may let their structure change query behavior. These cards do not use a real database operator; they isolate the type boundary so you can explain why valid JSON alone is insufficient.

Validate types and allowed keys on the server, build the intended query through the database's supported API, and keep caller values from becoming query structure. This schema check addresses the demonstrated type confusion; complete prevention also depends on the chosen database and how its query is constructed.

03Classify the activity values

Read the evidence before comparing your reasoning with the activity rubric. Do not start a database.

{
  "schema": {"username": "string"},
  "worked": {"username": "ada"},
  "activity_string": {"username": "lane"},
  "activity_object": {"username": {"kind": "operator"}},
  "field_note": "The question uses two other requests, A and B."
}

JSON types on this card.

A value in quotes is a string.
A value in braces is an object.
An object can be well-formed JSON and still violate a schema that requires a string.

worked username ada: string. Meets the schema.
activity username lane: string. Meets the schema.
activity username object with kind: object. Does not meet the schema.

This card does not use a database product's operator names.
The server rejects the object because the type is wrong.
A check that runs only in the browser is not this decision.

1. Write the JSON type of username lane and the type of the value that contains kind.
2. Compare each with the schema line.
3. Check: lane meets the string schema. The object does not. ada is the worked string.
4. Stop. Do not send these bodies to a real store.

04Optional challenge

Explain why a check that runs only in the browser cannot enforce this schema. The rubric is: the caller can send the object without that browser check, and the server still has to refuse the type. About ten minutes.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

P: "reed"
Q: {"kind":"filter"}
R: ["reed"]
A quoted value is a string; braces enclose an object; brackets enclose an array.

Server schema: username must be a string. No coercion or query-structure merge is allowed.
M: {"username":"fern"}
N: {"username":{"kind":"filter"}}
O: {"username":["fern"]}
All are syntactically valid JSON; no database is involved.

06Explain your evidence

Optional written self-check: explain one decision using the supplied case. No tool run is required.

Check your explanation: classify the complete value and the username field separately; apply the string schema on the server; distinguish valid JSON, valid application input and authenticated identity; avoid merging caller structure into queries.