Improper Neutralization of Special Elements in Data Query Logic
The product generates a query intended to access or manipulate data in a data store, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
This covers injection attacks against NoSQL databases, ORM frameworks, and other data query mechanisms that differ from traditional SQL injection.
Como corrigir esta vulnerabilidade
Estratégias de prevenção para NoSQL Injection baseadas em 3 regras de detecção do Shoulder.
Use typed structs or explicit operators, validate all user input
func findUser(w http.ResponseWriter, r *http.Request) { username := r.URL.Query().Get("username") - filter := bson.M{"username": username} + // Use explicit $eq to prevent operator injection + filter := bson.M{"username": bson.M{"$eq": username}} collection.FindOne(ctx, filter) }
Validate input types and sanitize MongoDB operators
- app.post('/login', async (req, res) => { - const { username, password } = req.body; - // Vulnerable: user can send { "$gt": "" } as password + const mongoSanitize = require('mongo-sanitize'); + + app.post('/login', async (req, res) => { + const username = mongoSanitize(req.body.username); + const password = mongoSanitize(req.body.password); const user = await User.findOne({ username, password }); if (user) { res.json({ success: true }); } });
Validate input types and use ObjectId for ID fields
from flask import request from pymongo import MongoClient db = MongoClient().mydb @app.route('/login', methods=['POST']) def login(): data = request.get_json() - # Vulnerable: entire dict from user - user = db.users.find_one(data) + # Safe: only use specific string fields + username = str(data.get('username', '')) + password = str(data.get('password', '')) + user = db.users.find_one({ + 'username': username, + 'password': password + }) return {'success': bool(user)}
Encontre vulnerabilidades no seu código
Use o Shoulder para escanear seu código em busca de padrões Improper Neutralization of Special Elements in Data Query Logic. 3 regras.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=943 # Or scan entire project npx @shoulderdev/cli trust .
Regras de Detecção (3)
O que observar nas revisões de código
Estes padrões indicam vulnerabilidades potenciais de Improper Neutralization of Special Elements in Data Query Logic. Procure-os durante revisões de código e auditorias de segurança.
Escaneie seu código para Improper Neutralization of Special Elements in Data Query Logic
O Shoulder CLI encontra padrões vulneráveis em todo o seu código.