Function validateFilter

apps/sim/app/api/tools/mongodb/utils.ts:64–91

(filter: string)

}

export function validateFilter(filter: string): { isValid: boolean; error?: string } {
  try {
    const parsed = JSON.parse(filter)

    const dangerousOperators = [
      '$where', // Executes arbitrary JavaScript
      '$regex', // Can cause ReDoS attacks
      '$expr', // Expression evaluation
      '$function', // Custom JavaScript functions
      '$accumulator', // Custom JavaScript accumulators
      '$let', // Variable definitions that could be exploited
    ]

    if (containsDangerousOperator(parsed, dangerousOperators)) {
      return {
        isValid: false,
        error: 'Filter contains potentially dangerous operators',
      }
    }

    return { isValid: true }
  } catch (error) {
    return {
      isValid: false,
      error: 'Invalid JSON format in filter',
    }
  }
}

export function validatePipeline(pipeline: string): { isValid: boolean; error?: string } {
  try {