From a2f21ecb7d6748db971abc2d60cbeb6f72b3b936 Mon Sep 17 00:00:00 2001
From: Angel98518 <daniel98518@gmail.com>
Date: Tue, 20 Jan 2026 07:09:09 +0100
Subject: [PATCH] fix: Move MongoDB JSON validation to Monitor.validate()

Move databaseQuery JSON validation from mongodb.js check() method
to Monitor.validate() to follow the same pattern as other monitor
types (e.g., ping monitor validations). This ensures validation
happens at the model level before the check is executed.
---
 server/model/monitor.js         | 9 +++++++++
 server/monitor-types/mongodb.js | 7 ++-----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/server/model/monitor.js b/server/model/monitor.js
index 3b8d89dd4..2719b89a0 100644
--- a/server/model/monitor.js
+++ b/server/model/monitor.js
@@ -1857,6 +1857,15 @@ class Monitor extends BeanModel {
                 }
             }
         }
+
+        if (this.type === "mongodb" && this.databaseQuery) {
+            // Validate that databaseQuery is valid JSON
+            try {
+                JSON.parse(this.databaseQuery);
+            } catch (error) {
+                throw new Error(`Invalid JSON in database query: ${error.message}`);
+            }
+        }
     }
 
     /**
diff --git a/server/monitor-types/mongodb.js b/server/monitor-types/mongodb.js
index cf2ca4ca3..7a78edab4 100644
--- a/server/monitor-types/mongodb.js
+++ b/server/monitor-types/mongodb.js
@@ -12,11 +12,8 @@ class MongodbMonitorType extends MonitorType {
     async check(monitor, heartbeat, _server) {
         let command = { ping: 1 };
         if (monitor.databaseQuery) {
-            try {
-                command = JSON.parse(monitor.databaseQuery);
-            } catch (error) {
-                throw new Error(`Invalid JSON in database query: ${error.message}`);
-            }
+            // databaseQuery is validated in Monitor.validate(), so we can safely parse it here
+            command = JSON.parse(monitor.databaseQuery);
         }
 
         let result = await this.runMongodbCommand(monitor.databaseConnectionString, command);