[BUG] NoSQL Injection 1 only answers once per Tomcat run: the servlet closes the shared MongoClient
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 82/100
Research direction
Read NoSqlInjection1.doPost and MongoDatabase.getMongoDbConnection to confirm that the client is shared while the cursor is request scoped. Remove the client close and add an integration test that submits twice and expects results both times; the cursor should still be closed. Check the existing integration test conventions first.
Written by the indexing model from the issue text.
Description
Discovered during #958.
NoSqlInjection1.doPost gets its client from MongoDatabase.getMongoDbConnection(applicationRoot, credential) and calls mongoClient.close() in its finally. Since the pooling work in #816, MongoDatabase caches one client per credential in credentialClients, so the servlet closes the shared client. Every later request fails with IllegalStateException: state should be: open and the player sees "An Error Occurred! You must be getting funky!" until Tomcat restarts.
Reproduced on dev (driver 3.12, MongoDB 4.1.13) and with driver 5.13 / MongoDB 8.0.
Fix: remove the close() on the shared client (the cursor close stays). The injection itself ($where built from user input) is untouched. Add an IT that submits twice and expects results both times.
🤖 Generated with Claude Code
- Dominant language
- Java
- Stars
- 1.5k
- Forks
- 519
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 61
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from OWASP/SecurityShepherd
-
Setup fails with "No suitable driver found" when Tomcat started without database.propertiesPossibly taken @HusainMain claimed this 5 days ago. OpenBug Platform
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
OWASP/SecurityShepherd#1082 · 1 comment ·
Maintainers usually reply within 1 day
-
DirectObjectBankLogin holds a challenge-pool connection while bankForm() borrows a second onePossibly taken @utafrali claimed this 5 days ago. OpenBug Levels
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OWASP/SecurityShepherd#1063 · 1 comment ·
Maintainers usually reply within 1 day
-
Bug WebApp
Difficulty 1/5 Under an hour Newbie friendliness 78/100
OWASP/SecurityShepherd#996 ·
Maintainers usually reply within 1 day
-
index.jsp: CTF countdown never clears, malformed deletePlayers error HTML, debug alert on success messagesPossibly taken @Sagar07Kr claimed this 5 days ago. OpenBug WebApp
Difficulty 1/5 1-3 hours Newbie friendliness 84/100
OWASP/SecurityShepherd#995 · 1 comment ·
Maintainers usually reply within 1 day
-
Bug Levels
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
OWASP/SecurityShepherd#990 · 1 comment ·
Maintainers usually reply within 1 day
All issues in OWASP/SecurityShepherd
Similar issues
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
objectionary/lints#1640 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 Half a day Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
openhab/openhab-addons#22168 ·
Maintainers usually reply within 1 day