Merge pull request #78 from TykTechnologies/TT-9116

[TT-9116] Safe checking if string is a valid ObjectID
TykTechnologies · Jun 15, 2023 · b102550 · b102550
2 parents 8451a35 + ce0cf04
commit b102550
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/persistent/internal/driver/mgo/query.go b/persistent/internal/driver/mgo/query.go
@@ -42,7 +42,9 @@ func handleQueryValue(key string, value interface{}, search bson.M) {
 		if isStr && key == "_id" {
 			ObjectIDs := []model.ObjectID{}
 			for _, str := range strSlice {
-				ObjectIDs = append(ObjectIDs, model.ObjectIDHex(str))
+				if bson.IsObjectIdHex(str) {
+					ObjectIDs = append(ObjectIDs, model.ObjectIDHex(str))
+				}
 			}
 
 			search[key] = bson.M{"$in": ObjectIDs}

diff --git a/persistent/internal/driver/mongo/query.go b/persistent/internal/driver/mongo/query.go
@@ -59,7 +59,9 @@ func handleQueryValue(key string, value interface{}, search bson.M) {
 		if isStrSlice && key == "_id" {
 			ObjectIDs := []model.ObjectID{}
 			for _, str := range strSlice {
-				ObjectIDs = append(ObjectIDs, model.ObjectIDHex(str))
+				if primitive.IsValidObjectID(str) {
+					ObjectIDs = append(ObjectIDs, model.ObjectIDHex(str))
+				}
 			}
 
 			search[key] = bson.M{"$in": ObjectIDs}