title: Sanitizing inputs to MongoDB
body: <p>I'm writing a REST interface to a MongoDB database program, and I'm trying to implement search functionality. I'd like to expose the entire MongoDB interface. I have two questions, really, but they're related so I'm putting them in one post:</p>
  
  <ol>
  <li>Is it safe to decode untrusted JSON with the Python json module, or is it like the pickle module in that it could allow arbitrary code execution?</li>
  <li>Is it safe to pass that decoded JSON to the PyMongo find() function?</li>
  </ol>