
Security News
Meet Socket at Black Hat Europe and BSides London 2025
Socket is heading to London! Stop by our booth or schedule a meeting to see what we've been working on.
MSON.stringify is an alternative for JSON.stringify. It serializes queries (and data to be inserted or updated) in such a way that they can be pasted into the Mongo shell, with no loss of fidelity.
The primary use case is to help with MongoDB debugging queries that are generated by your app.
At this moment, it encodes ObjectId, DBRef and Date objects. All else should be equivalent to regular JSON.
npm install mongoson
MSON = require 'mongoson'
MSON.stringify mongoQuery
This returns a serialized query, a query "object literal" of some sort. The result can be pasted into the mongo console.
For the brave-at-heart, there's also MSON.parseUnsafe serializedQuery. It's called parseUnsafe for a reason, because it actually uses eval to instantiate the correct ObjectId, DBRef and Date objects, without doing any sanitation beforehand. You do NOT want to use this unattended. Before running it on any serialized query, I recommend scrutinizing it for any fishy stuff inside. It could absolutely execute any kind of code in node.js.
The advantage of MSON.parseUnsafe over doing eval yourself is that the code gets evaluated in a context where ObjectId, DBRef, and ISODate functions are defined. This is quicker than importing them from MongoDB's BSON module yourself.
I'd appreciate any hints on how to adjust (for example) the JSON2 parse function to let the specific calls to ObjectId, DBRef and ISODate pass through, while denying any other kinds of expression (beyond valid JSON expressions, obviously). Then we could have a safe MSON.parse.
Suppose you have build a query using some "native" Mongo object types (DBRef and ObjectId), like so:
bson = require 'bson'
ObjectID = bson.BSONPure.ObjectID
DBRef = bson.BSONPure.DBRef
someQuery =
_id: ObjectID("507f1f77bcf86cd799439011")
title: "Super"
related: [
ObjectID("507f1f77bcf86cd799439011"),
ObjectID("507f1f77bcf86cd799439012"),
ObjectID("507f1f77bcf86cd799439013")
]
owner: DBRef("groups",ObjectID("507f191e810c19729de860ea"))
updatedAt:
$gte: new Date "2012-02-07T18:32:42.692Z"
$lte: new Date "2013-02-07T18:32:42.692Z"
You can then do
MSON = require 'mongoson'
console.log MSON.stringify someQuery
Which gives
{"_id":ObjectId("507f1f77bcf86cd799439011"),"title":"Super","related":[ObjectId("507f1f77bcf86cd799439011"),ObjectId("507f1f77bcf86cd799439012"),ObjectId("507f1f77bcf86cd799439013")],"owner":{"$ref":"groups","$id":"507f191e810c19729de860ea"},"updatedAt":{"$gte":ISODate("2012-02-07T18:32:42.692Z"),"$lte":ISODate("2013-02-07T18:32:42.692Z")}}
This is ready to be pasted into the MongoDB shell as part of a command.
The example input and output is taken straight from the (sole) test for this module, so the above should absolutely work.
mongoson is released under the MIT License.
Copyright (c) 2013 Meryn Stol
FAQs
Stringifies query objects for pasting into the Mongo shell.
The npm package mongoson receives a total of 25 weekly downloads. As such, mongoson popularity was classified as not popular.
We found that mongoson demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket is heading to London! Stop by our booth or schedule a meeting to see what we've been working on.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.