{"record":{"id":"1ca2c7127157ef83","repo":"OtterMind/Chat2DB","slug":"invalid-mongodb-database-name-name","errorCode":null,"errorMessage":"Invalid MongoDB database name: {name}","messagePattern":"Invalid MongoDB database name: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"chat2db-community-server/chat2db-community-plugins/chat2db-community-mongodb/src/main/java/ai/chat2db/plugin/mongodb/MongodbSqlGuards.java","lineNumber":20,"sourceCode":"\nimport java.util.regex.Pattern;\n\n/**\n * Context-specific validation and JSON escaping for Mongo shell command text.\n */\npublic final class MongodbSqlGuards {\n\n    private static final Pattern DATABASE_NAME_PATTERN = Pattern.compile(\"^[A-Za-z0-9_$-]+$\");\n\n    private MongodbSqlGuards() {\n    }\n\n    /**\n     * Validates the unquoted token used by the Mongo {@code use <database>} command.\n     */\n    public static String requireDatabaseName(String name) {\n        if (name == null || !DATABASE_NAME_PATTERN.matcher(name).matches()) {\n            throw new IllegalArgumentException(\"Invalid MongoDB database name: \" + name);\n        }\n        return name;\n    }\n\n    /**\n     * Returns a property-safe collection accessor. MongoDB collection names are\n     * not JavaScript identifiers, so dot-property interpolation is not valid for\n     * names containing dots, hyphens, or a leading digit.\n     */\n    public static String collectionAccessor(String name) {\n        requireNonEmptyName(name, \"collection name\");\n        return \"getCollection(\" + quoteJsonString(name) + \")\";\n    }\n\n    /**\n     * Returns a quoted object key for a MongoDB field name.\n     */\n    public static String quoteFieldName(String name) {","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/OtterMind/Chat2DB/blob/5ee1e990e73fbcae1969dc554be254fedb3ab888/chat2db-community-server/chat2db-community-plugins/chat2db-community-mongodb/src/main/java/ai/chat2db/plugin/mongodb/MongodbSqlGuards.java#L2-L38","documentation":"Thrown by MongodbSqlGuards.requireDatabaseName when the token interpolated into a Mongo 'use <database>' command fails the pattern ^[A-Za-z0-9_$-]+$. The guard exists because the 'use' command is a non-escapable position: the name is pasted raw into shell text, so an invalid character would either break the command or enable command injection. A null name is also rejected.","triggerScenarios":"Calling requireDatabaseName(name) (directly or via a Mongo DDL builder that issues 'use <db>') with a name containing a dot, slash, space, leading digit-only, quote, or any char outside [A-Za-z0-9_$-], or passing null.","commonSituations":"A user supplies a database name copied from an external source that contains a '.' (common since MongoDB databases sometimes appear dotted in tooling), a space, or a unicode character; or the caller passes an untrimmed/empty string; or a name is read from a config file that includes surrounding quotes.","solutions":["Trim the input and strip surrounding quotes/whitespace before calling requireDatabaseName.","Ensure the database name matches ^[A-Za-z0-9_$-]+$; reject dots, spaces, and slashes upstream in the UI/API layer.","If the name is genuinely invalid for Mongo, surface a validation error to the user instead of reaching the builder.","Confirm the caller is not accidentally passing the connection string path or a fully-qualified collection name as the database name."],"exampleFix":"// before\nString db = request.getDatabase();\nMongodbSqlGuards.requireDatabaseName(db);\n\n// after\nString db = StringUtils.trimToNull(request.getDatabase());\nif (db == null || !db.matches(\"^[A-Za-z0-9_$-]+$\")) {\n    throw new IllegalArgumentException(\"Invalid MongoDB database name: \" + db);\n}\nMongodbSqlGuards.requireDatabaseName(db);","handlingStrategy":"validation","validationCode":"String name = StringUtils.trimToNull(rawName);\nif (name == null || !name.matches(\"^[A-Za-z0-9_$-]+$\")) {\n    return; // or throw a user-facing validation error\n}\nMongodbSqlGuards.requireDatabaseName(name);","typeGuard":"static boolean isValidMongoDatabaseName(String name) {\n    return name != null && name.matches(\"^[A-Za-z0-9_$-]+$\");\n}","tryCatchPattern":"try {\n    MongodbSqlGuards.requireDatabaseName(db);\n} catch (IllegalArgumentException e) {\n    // surface a field-validation error; do not log the raw name if it may contain secrets\n    throw new BusinessException(\"mongodb.database.nameInvalid\");\n}","preventionTips":["Validate database names at the request boundary before they reach the builder.","Never paste connection-string paths into the database-name field.","Strip whitespace and surrounding quotes from user-supplied names.","Treat a failed guard as a validation error, not a retryable failure."],"tags":["mongodb","validation","injection-guard","ddl"],"backgroundTag":null,"analyzedSha":"5ee1e990e73fbcae1969dc554be254fedb3ab888","analyzedAt":"2026-08-14T07:05:03.077Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}