
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

MSON.stringify is an alternative for JSON.stringify. It serializes queries (and data to be inserted or updated) in such a way that they can be pasted into the Mongo shell, with no loss of information. ObjectIds, DBRefs and Dates are not converted to strings, so they'll keep working.
The primary use case is to help with debugging MongoDB queries that are generated by your app.
npm install mongoson
MSON = require 'mongoson'
MSON.stringify mongoQuery
This returns a serialized query, a "query object literal" if you will. The result can be pasted into the mongo console.
MSON.stringify encodes ObjectId, DBRef and Date objects. All else should be equivalent to regular JSON.For the brave-at-heart, there's also MSON.parseUnsafe serializedQuery. It's called parseUnsafe for a reason, because it actually uses eval to instantiate the correct ObjectId, DBRef and Date objects, without doing any sanitation beforehand. You do NOT want to use this unattended. Before running it on any serialized query, I recommend scrutinizing it for any fishy stuff inside. It could absolutely execute any kind of code in node.js.
The advantage of MSON.parseUnsafe over doing eval yourself is that the code gets evaluated in a context where ObjectId, DBRef, and ISODate functions are defined. This is quicker than importing them from MongoDB's BSON module yourself.
I'd appreciate any hints on how to adjust (for example) the JSON2 parse function to let the specific calls to ObjectId, DBRef and ISODate pass through, while disallowing any other kinds of expressions (beyond valid JSON expressions, obviously). Then we could have a safe MSON.parse.
Suppose you have build a query using some "native" Mongo object types (DBRef and ObjectId), like so:
bson = require 'bson'
ObjectID = bson.BSONPure.ObjectID
DBRef = bson.BSONPure.DBRef
someQuery =
_id: ObjectID("507f1f77bcf86cd799439011")
title: "Super"
related: [
ObjectID("507f1f77bcf86cd799439011"),
ObjectID("507f1f77bcf86cd799439012"),
ObjectID("507f1f77bcf86cd799439013")
]
owner: DBRef("groups",ObjectID("507f191e810c19729de860ea"))
updatedAt:
$gte: new Date "2012-02-07T18:32:42.692Z"
$lte: new Date "2013-02-07T18:32:42.692Z"
You can then do
MSON = require 'mongoson'
console.log MSON.stringify someQuery
Which gives
{"_id":ObjectId("507f1f77bcf86cd799439011"),"title":"Super","related":[ObjectId("507f1f77bcf86cd799439011"),ObjectId("507f1f77bcf86cd799439012"),ObjectId("507f1f77bcf86cd799439013")],"owner":{"$ref":"groups","$id":"507f191e810c19729de860ea"},"updatedAt":{"$gte":ISODate("2012-02-07T18:32:42.692Z"),"$lte":ISODate("2013-02-07T18:32:42.692Z")}}
This is ready to be pasted into the MongoDB shell as part of a command.
The example input and output is taken straight from the (sole) test for this module, so the above should absolutely work.
mongoson is released under the MIT License.
Copyright (c) 2013 Meryn Stol
FAQs
Stringifies query objects for pasting into the Mongo shell.
The npm package mongoson receives a total of 32 weekly downloads. As such, mongoson popularity was classified as not popular.
We found that mongoson demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.