Mongoose:CastError:model的路径“\u id”处的值“”的转换为ObjectId失败

Question

我正在尝试用mongodb和nodejs制作一个应用程序。我做了一个特殊的路由，它有：id参数，并且运行良好。

我还做了另一个get路线，它有product/：category。每次我收到该错误时向该路由发送请求时：

CastError: Cast to ObjectId failed for value "(here is my req.params.category)" at path "_id" for model "Product"

我的路线是：

// product is my model I called it in top of the file
app.get('product/:category', async (req, res)=>{
    const productByCategory = await product.find({category: req.params.category});
    res.json(productByCategory);
});

当我向上面的路由发出get请求时，我得到了该错误：

CastError: Cast to ObjectId failed for value "(here is my req.params.category)" at path "_id" for model "Product"

我的产品模型是：

const ProductSchema = new mongoose.Schema({
    title:{
        type: String,
        required: true
    },
    description:{
        type: String,
        min: 40,
        required: true
    },
    category:{
        type: String,
        required: true
    },
    price:{
        type: Number,
        required: true
    },
    imageUrl:{
        type: String,
        required: true
    },
    quantity:{
        type: Number,
        required: true
    },
    comments: [{
        type: Object
    }],
    seller: {
        sellerId:{
            type: String,
            required: true
        },
        username:{
            type: String,
            required: true
        },
        shopName:{
            type: String,
            required: true
        },
        category:{
            type: String,
            required: true
        }
    },
    location: {
        type: "String",
        required: true
    },
    date:{
        type: Date,
        default: Date.now
    }
});

我怎样才能解决这个问题？

Answer 1

product/：_id和product/：category在路由上下文中是“相同的”。。。所以，即使您发送product/：category请求，服务器也会计算匹配的第一个endpoint。

解决方案一：让每条路线都独一无二。

// _id
app.get('product/_id/:_id', async (req, res)=>{
    const productById = await product.find({_id: req.params._id});
    res.json(productById);
});

// category
app.get('product/category/:category', async (req, res)=>{
    const productByCategory = await product.find({category: req.params.category});
    res.json(productByCategory);
});

...

解决方案二：使用request.body

app.post('product', async (req, res)=>{
    const product = await product.find(req.body});
    res.json(product);
});

注意：注意非关系型数据库注入。

https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL注射