NoSQL Injection

Description

Detects untrusted user input being used in NoSQL queries without proper validation.

How to fix

Validate and type-check user input before using in queries.

```python
from bson import ObjectId
object_id = ObjectId(user_id)  # Validates format
```

Learn more: https://shoulder.dev/learn/python/cwe-943/nosql-injection

Applies to

Languages

🐍 Python

Frameworks

django flask fastapi pymongo motor

References

Documentation ↗ OWASP ↗ Learn about CWE-943

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=python-nosql-injection .