English 中文(简体)
Is DynamoDB susceptible to NoSQL or SQL injection attacks? [closed]
原标题:
Closed. This question needs to be more focused. It is not currently accepting answers.

Want to improve this question? Update the question so it focuses on one problem only by editing this post.

Closed 4 months ago.

Do I have to sanitize user supplied input before I query DynamoDB or does DynamoDB handle sanitization itself ? (or through it s respective SDKs like through boto3)

As an example, this is possible in MongoDB (also a NoSQL database)

function() { return obj.credits—obj.debits < 0;var date=new Date(); do{curDate = new Date();}while(curDate-date<10000); }

I already found some techniques used here:

最佳回答

It s not clear what are you trying to guard against? Strings are limited to 400kb limit, from a DDB perspective that s all to worry about.

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.NamingRulesDataTypes.html

DynamoDB does not execute code with user defined functions or anything so there s no risk of injection threats to execute server side code.

问题回答

暂无回答




相关问题
How do I escape a string for a shell command in node?

In nodejs, the only way to execute external commands is via sys.exec(cmd). I d like to call an external command and give it data via stdin. In nodejs there does yet not appear to be a way to open a ...

Do I need to escape this?

It might be a bit unusual, but I need to echo <?php. However, I think that PHP treats it as an actual <?php and starts executing code instead of treating it as a string. How can I escape <?...

热门标签