DocumentDB Sql Injection?

Question

I'm trying to offload some client specific query building to the client. I don't think I'm in danger of sql injection for documentdb since it doesn't have UPDATE or DELETE statements but i'm not positive. Additionally, I don't know if these will be added in the future.

Here is an example of my problem.

IceCreamApp wants to find all flavors where the name is like "choco". A flavor document looks like this-

{
  "name": "Chocolate",
  "price": 1.50
}

The API knows about the DocumentDB and knows how to request data from it, but it doesn't know the entity structure of any of the clients entities. So to do this on the API-

_documentClient.CreateDocumentQuery("...")
   .Where((d) => d.name.Contains(query));

Would throw an error (d is dynamic and name isn't necessarily a common property).

I could build this on the client and send it.

Client search request-

{
  "page": 1,
  "pageSize": 10,
  "query": "CONTAINS(name, 'choco')"
}

Without sanitzation this would be a big no-no for sql. But does it / will it ever matter for documentdb? How safe am I to run un-sanitized client queries?

Bruce Chen Bruce Chen · Accepted Answer · 2017-04-20T06:53:36

As this official document Announcing SQL Parameterization in DocumentDB:

Using this feature, you can now write parameterized SQL queries. Parameterized SQL provides robust handling and escaping of user input, preventing accidental exposure of data through “SQL injection” *. Let's take a look at a sample using the .NET SDK; In addition to plain SQL strings and LINQ expressions, we've added a new SqlQuerySpec class that can be used to build parameterized queries.

DocumentDB is not susceptible to the most common kinds of injection attacks that lead to “elevation of privileges” because queries are strictly read-only operations. However, it might be possible for a user to gain access to data they shouldn’t be accessing within the same collection by crafting malicious SQL queries. SQL parameterization support helps prevent these sort of attacks.

Here's a official sample that queries a "Books" collection with a single user supplied parameter for author name:

POST https://contosomarketing.documents.azure.com/dbs/XP0mAA==/colls/XP0mAJ3H-AA=/docs
HTTP/1.1 x-ms-documentdb-isquery: True 
x-ms-date: Mon, 18 Aug 2014 13:05:49 GMT 
authorization: type%3dmaster%26ver%3d1.0%26sig%3dkOU%2bBn2vkvIlHypfE8AA5fulpn8zKjLwdrxBqyg0YGQ%3d 
x-ms-version: 2014-08-21 
Accept: application/json 
Content-Type: application/query+json 
Host: contosomarketing.documents.azure.com 
Content-Length: 50 
{      
    "query": "SELECT * FROM books b WHERE (b.Author.Name = @name)",     
    "parameters": [          
        {"name": "@name", "value": "Herman Melville"}         
    ] 
}

DocumentDB Sql Injection?

1 Answers