Keep query operators out of document database input

How to do it

A JSON body or a query string such as password[$ne]=x turns into an object, and a document database reads it as an operator. Check the type of every field with a schema at the boundary, so a string field refuses an object. Turn on the driver's filter cleaning where it exists, such as Mongoose's sanitizeFilter. Never build $where, $function or mapReduce code from input. Give the app's database user only the rights it needs, as Use parameterised queries says for SQL.

Examples

JavaScript example

import mongoose from 'mongoose';
import { z } from 'zod';

mongoose.set('sanitizeFilter', true);
const SignIn = z.object({ email: z.string().email(), password: z.string().min(1) });

const { email } = SignIn.parse(req.body);
const user = await User.findOne({ email });

Python example

from pydantic import BaseModel, EmailStr

class SignIn(BaseModel):
    email: EmailStr
    password: str

form = SignIn.model_validate(request.json)
user = db.users.find_one({"email": form.email})

How to check

Send {"$ne": null}, {"$gt": ""} and {"$regex": ".*"} as the email and password of the sign-in form, and as filter values in a search. Each request answers 400 and signs no one in. A search of the code finds no $where, $function or mapReduce that holds request data.

Sources

• OWASP WSTG on testing for NoSQL injection

Related rules

• APS-2 Use parameterised queries in Application security