[Security] Bump loopback-connector-mongodb from 3.5.0 to 3.9.2

[dependabot-preview]

Bumps loopback-connector-mongodb from 3.5.0 to 3.9.2. This update includes security fixes.

Vulnerabilities fixed

Sourced from The npm Advisory Database.

NoSQL Injection
Versions of loopback-connector-mongodb before 3.6.0 are vulnerable to NoSQL injection.

MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous $where property to be passed to the MongoDB Driver. The Driver allows the special $where property in a filter to execute JavaScript (client can pass in a malicious script) on the database Driver. This is an intended feature of MongoDB unless disabled (instructions here).

A proof of concept malicious query:

GET /POST filter={"where": {"$where": "function(){sleep(5000); return this.title.contains('Hello');}"}}

The above makes the database sleep for 5 seconds and then returns all “Posts” with the title containing the word Hello.

Affected versions: <=3.5.0

Changelog

Sourced from loopback-connector-mongodb's changelog.

2018-11-08, Version 3.9.2

• support decimal128 type for nested properties (#483) (Janny)

2018-10-24, Version 3.9.1

• remove the infinite inspect (#480) (#482) (Janny)

2018-10-23, Version 3.9.0

• support decimal128 (#475) (Janny)

• Added "authSource" in doc connection properties (Rémi AUGUSTE)

• Convert embedded binary properties to buffer (ntsekouras)

• Convert projection fields option to object (Dimitris)

2018-09-19, Version 3.8.0

• fix performance issues on count #464 (Clément)

• feat: allow methods to pass strictObjectIDCoercion (virkt25)

2018-09-14, Version 3.7.1

• fix: map new names to old for connector hooks (virkt25)

2018-09-12, Version 3.7.0

• update deprecated mongo driver commands (Hugo Da Roit)

• Remove hard dependency of memwatch-next (Raymond Feng)

• Add support for protocol to be 'monogodb+srv' (Raymond Feng)

2018-08-15, Version 3.6.0

... (truncated)

Commits

• deef8d9 3.9.2
• 5b7e5fd support decimal128 type for nested properties (#483)
• ed83f3f 3.9.1
• 3eeedaf remove the infinite inspect (#480) (#482)
• 1aea8db 3.9.0
• d6e69c2 support decimal128 (#475)
• efbee59 Merge pull request #471 from ntsekouras/fix-issue470
• ab6b3aa Merge pull request #469 from Weaverize/master
• 94245dc Added "authSource" in doc connection properties
• fbf58b3 Convert embedded binary properties to buffer
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jannyhou2016, a new releaser for loopback-connector-mongodb since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.