NoSQL Injection via MongoDB Queries

Description

Detects user input flowing into NoSQL database queries without validation.

What Shoulder detects

Untrusted input from {source} reaches NoSQL query at {sink}.
This allows an attacker to manipulate database queries and potentially bypass authentication or access unauthorized data.

How to fix

Validate input types and use mongo-sanitize to remove operators from user input.

```javascript
const sanitized = mongoSanitize(req.body.query);
const user = await User.findOne(sanitized);
```

Learn more: https://shoulder.dev/learn/javascript/cwe-943/nosql-injection

Applies to

Languages

🟨 JavaScript 🔷 TypeScript

Frameworks

express fastify

References

Documentation ↗ OWASP ↗ Learn about CWE-943

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=javascript-nosql-injection .

NoSQL Injection via MongoDB Queries

Description

What Shoulder detects

How to fix

Applies to

Languages

Frameworks

References

Scan for this issue

Related rules