{"record":{"id":"c250fcb82c4f8ead","repo":"mem0ai/mem0","slug":"filter-list-for-key-contains-an-object-which","errorCode":null,"errorMessage":"Filter list for '${key}' contains an object, which may contain MongoDB query operators.","messagePattern":"Filter list for '(.+?)' contains an object, which may contain MongoDB query operators\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"mem0-ts/src/oss/src/vector_stores/mongodb.ts","lineNumber":194,"sourceCode":"            `Atlas Search may not be available. keywordSearch() will not work.`,\n        );\n      }\n    } catch (error) {\n      console.error(\"Error initializing MongoDB:\", error);\n      throw error;\n    }\n  }\n\n  private validateFilterValue(key: string, value: any): void {\n    if (typeof value === \"object\" && value !== null) {\n      if (Array.isArray(value)) {\n        for (const item of value) {\n          if (\n            typeof item === \"object\" &&\n            item !== null &&\n            !Array.isArray(item)\n          ) {\n            throw new Error(\n              `Filter list for '${key}' contains an object, which may contain MongoDB query operators.`,\n            );\n          }\n        }\n      } else {\n        throw new Error(\n          `Filter value for '${key}' must be a scalar (string, number, boolean), not an object. Objects may contain MongoDB query operators.`,\n        );\n      }\n    }\n  }\n\n  async insert(\n    vectors: number[][],\n    ids: string[],\n    payloads: Record<string, any>[],\n  ): Promise<void> {\n    await this.initialize();","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/mem0ai/mem0/blob/001c235229be8795e3834520467bd0d661ed8f34/mem0-ts/src/oss/src/vector_stores/mongodb.ts#L176-L212","documentation":"The MongoDB vector store whitelists filter values to scalars (and arrays of scalars) because object values in a MongoDB query filter are interpreted as query operators ($gt, $regex, $where...), which is an injection vector. If an array filter value contains an object element, the store refuses it before the query reaches MongoDB. This guards user-supplied filter input flowing into .find().","triggerScenarios":"Calling search() with { tags: ['a', { $ne: 'b' }] } or any array value containing an object; passing unvalidated user input (query params, JSON body fields) directly as SearchFilters; test fixtures that embed operator objects in list values.","commonSituations":"Public APIs exposing filter parameters to end users; converting Mongo queries wholesale into SearchFilters; LLM tool-calls that generate filter JSON with operator objects inside lists.","solutions":["Keep list values scalar-only: { tags: ['ai', 'memory'] }.","Express exclusion via top-level filter design, not $ne objects inside lists.","Validate/sanitize incoming filters with a schema (zod) that rejects object elements before they reach the store."],"exampleFix":"// before\nstore.search(q, 5, { tags: ['ai', { $ne: 'beta' }] }); // throws\n\n// after\nstore.search(q, 5, { tags: ['ai'] });","handlingStrategy":"validation","validationCode":"for (const [k, v] of Object.entries(filters || {})) {\n  if (Array.isArray(v) && v.some((it) => it !== null && typeof it === 'object')) {\n    throw new Error(`Filter list '${k}' must contain scalars only`);\n  }\n}","typeGuard":"const isScalar = (v: unknown): boolean => ['string', 'number', 'boolean'].includes(typeof v);\nconst isSafeMongoValue = (v: unknown): boolean => isScalar(v) || (Array.isArray(v) && v.every(isScalar));","tryCatchPattern":"try { await store.search(q, 5, filters); }\ncatch (e) {\n  if (e instanceof Error && e.message.includes('MongoDB query operators')) {\n    // strip object elements from lists / reject the request as bad input\n  } else throw e;\n}","preventionTips":["Never pass unvalidated user input as SearchFilters to the MongoDB provider.","Keep list values scalar-only; express richer queries at a different layer.","Use a zod schema (z.record(z.union([z.string(), z.number(), z.boolean(), z.array(...)]))) on filter inputs."],"tags":["mongodb","filters","injection-guard","security","validation"],"backgroundTag":null,"analyzedSha":"001c235229be8795e3834520467bd0d661ed8f34","analyzedAt":"2026-08-15T01:55:42.685Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}