Mongodb is a web based console to try out Mongodb.
I have created something similar to try out nodejs. In nodejs I am accepting user input and then I am performing
eval on that command. Given the power of nodejs , someone from web console can create a file, delete files on the system or could execute
I was wondering if it would be okay to run
nodejs as a user called
node. This user node will not have any privilege to write anything, create anything or update anything. The only access this user will have is read access.
Will that work or that is too much of risk? What is a good strategy to handle such a situation?