
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
:Info: See the mongo site <http://www.mongodb.org>
_ for more information. See github <http://github.com/mongodb/mongo-python-driver/tree>
_ for the latest source.
:Author: Mike Dirolf
:Maintainer: Bernie Hackett bernie@mongodb.com
The PyMongo distribution contains tools for interacting with MongoDB
database from Python. The bson
package is an implementation of
the BSON format <http://bsonspec.org>
_ for Python. The pymongo
package is a native Python driver for MongoDB. The gridfs
package
is a gridfs <http://www.mongodb.org/display/DOCS/GridFS+Specification>
_
implementation on top of pymongo
.
PyMongo supports MongoDB 2.6, 3.0, 3.2, 3.4, and 3.6.
For issues with, questions about, or feedback for PyMongo, please look into
our support channels <http://www.mongodb.org/about/support>
. Please
do not email any of the PyMongo developers directly with issues or
questions - you're more likely to get an answer on the mongodb-user <http://groups.google.com/group/mongodb-user>
list on Google Groups.
Think you’ve found a bug? Want to see a new feature in PyMongo? Please open a case in our issue management tool, JIRA:
Create an account and login <https://jira.mongodb.org>
_.the PYTHON project <https://jira.mongodb.org/browse/PYTHON>
_.Bug reports in JIRA for all driver projects (i.e. PYTHON, CSHARP, JAVA) and the Core Server (i.e. SERVER) project are public.
Please include all of the following information when opening an issue:
Detailed steps to reproduce the problem, including full traceback, if possible.
The exact python version used, with patch level::
$ python -c "import sys; print(sys.version)"
The exact version of PyMongo used, with patch level::
$ python -c "import pymongo; print(pymongo.version); print(pymongo.has_c())"
The operating system and version (e.g. Windows 7, OSX 10.8, ...)
Web framework or asynchronous network library used, if any, with version (e.g. Django 1.7, mod_wsgi 4.3.0, gevent 1.0.1, Tornado 4.0.2, ...)
If you’ve identified a security vulnerability in a driver or any other
MongoDB project, please report it according to the instructions here <http://docs.mongodb.org/manual/tutorial/create-a-vulnerability-report>
_.
PyMongo can be installed with pip <http://pypi.python.org/pypi/pip>
_::
$ python -m pip install pymongo
Or easy_install
from
setuptools <http://pypi.python.org/pypi/setuptools>
_::
$ python -m easy_install pymongo
You can also download the project source and do::
$ python setup.py install
Do not install the "bson" package. PyMongo comes with its own bson package; doing "easy_install bson" installs a third-party package that is incompatible with PyMongo.
PyMongo supports CPython 2.6, 2.7, 3.4+, PyPy, and PyPy3.
Optional dependencies:
GSSAPI authentication requires pykerberos <https://pypi.python.org/pypi/pykerberos>
_ on Unix or WinKerberos <https://pypi.python.org/pypi/winkerberos>
_ on Windows. The correct
dependency can be installed automatically along with PyMongo::
$ python -m pip install pymongo[gssapi]
Support for mongodb+srv:// URIs requires dnspython <https://pypi.python.org/pypi/dnspython>
_::
$ python -m pip install pymongo[srv]
TLS / SSL support may require ipaddress <https://pypi.python.org/pypi/ipaddress>
_ and certifi <https://pypi.python.org/pypi/certifi>
_ or wincertstore <https://pypi.python.org/pypi/wincertstore>
_ depending on the Python
version in use. The necessary dependencies can be installed along with
PyMongo::
$ python -m pip install pymongo[tls]
You can install all dependencies automatically with the following command::
$ python -m pip install pymongo[gssapi,srv,tls]
Other optional packages:
backports.pbkdf2 <https://pypi.python.org/pypi/backports.pbkdf2/>
_,
improves authentication performance with SCRAM-SHA-1, the default
authentication mechanism for MongoDB 3.0+. It especially improves
performance on Python older than 2.7.8, or on Python 3 before Python 3.4.monotonic <https://pypi.python.org/pypi/monotonic>
_ adds support for
a monotonic clock, which improves reliability in environments
where clock adjustments are frequent. Not needed in Python 3.3+.Additional dependencies are:
Here's a basic example (for more see the examples section of the docs):
.. code-block:: python
import pymongo client = pymongo.MongoClient("localhost", 27017) db = client.test db.name u'test' db.my_collection Collection(Database(MongoClient('localhost', 27017), u'test'), u'my_collection') db.my_collection.insert_one({"x": 10}).inserted_id ObjectId('4aba15ebe23f6b53b0000000') db.my_collection.insert_one({"x": 8}).inserted_id ObjectId('4aba160ee23f6b543e000000') db.my_collection.insert_one({"x": 11}).inserted_id ObjectId('4aba160ee23f6b543e000002') db.my_collection.find_one() {u'x': 10, u'_id': ObjectId('4aba15ebe23f6b53b0000000')} for item in db.my_collection.find(): ... print(item["x"]) ... 10 8 11 db.my_collection.create_index("x") u'x_1' for item in db.my_collection.find().sort("x", pymongo.ASCENDING): ... print(item["x"]) ... 8 10 11 [item["x"] for item in db.my_collection.find().limit(2).skip(1)] [8, 11]
You will need sphinx_ installed to generate the documentation. Documentation can be generated by running python setup.py doc. Generated documentation can be found in the doc/build/html/ directory.
The easiest way to run the tests is to run python setup.py test in the root of the distribution. Note that you will need unittest2_ to run the tests under Python 2.6.
To verify that PyMongo works with Gevent's monkey-patching::
$ python green_framework_test.py gevent
Or with Eventlet's::
$ python green_framework_test.py eventlet
.. _sphinx: http://sphinx.pocoo.org/ .. _unittest2: https://pypi.python.org/pypi/unittest2
FAQs
Python driver for MongoDB <http://www.mongodb.org>
We found that pymongo-amplidata demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.