diff --git a/library/src/integrations/MongoDB.test.ts b/library/src/integrations/MongoDB.test.ts index 326263308..3d1f040ff 100644 --- a/library/src/integrations/MongoDB.test.ts +++ b/library/src/integrations/MongoDB.test.ts @@ -34,7 +34,7 @@ t.test("we can highjack the MongoDB library", async () => { { title: "Title" } ); - await t.rejects(async () => { + const error = await t.rejects(async () => { await runWithContext( { aikido: new Aikido(new LoggerNoop(), new APIForTesting(), undefined), @@ -57,6 +57,12 @@ t.test("we can highjack the MongoDB library", async () => { } ); }); + if (error instanceof Error) { + t.equal( + error.message, + "Blocked NoSQL injection for MongoDB.Collection.find(...), please check body (.title)!" + ); + } await runWithContext( { diff --git a/library/src/integrations/MongoDB.ts b/library/src/integrations/MongoDB.ts index cdc65a32a..d1127c8f9 100644 --- a/library/src/integrations/MongoDB.ts +++ b/library/src/integrations/MongoDB.ts @@ -46,7 +46,7 @@ export class MongoDB implements Integration { const result = detectNoSQLInjection(context.request, filter); if (result.injection) { - const message = `Blocked NoSQL injection for MongoDB.Collection.${operation}(...), please check ${friendlyName(result.source)}!`; + const message = `Blocked NoSQL injection for MongoDB.Collection.${operation}(...), please check ${friendlyName(result.source)} (${result.path})!`; context.aikido.report({ source: result.source, kind: "nosql-injection",