NoSQL Injection (ARCH4140)

Key java.security.nosql-injection · Severity error · Category security · CWE CWE-943

Embedding user input directly into a NoSQL query (e.g. building a filter from raw JSON) lets attackers inject operators ($ne, $gt) and bypass authentication. Build the query with typed fields that expect values, not operators.

Incorrect

String json = "{ \"user\": \"" + req.getParameter("user")
    + "\", \"pass\": \"" + req.getParameter("pass") + "\" }";
Document filter = Document.parse(json); // {"pass": {"$ne": null}} can be injected
collection.find(filter).first();

Correct

Bson filter = Filters.and(
    Filters.eq("user", req.getParameter("user")),
    Filters.eq("pass", req.getParameter("pass"))); // bound as values
collection.find(filter).first();

Fix

Build NoSQL queries with typed filter builders; never pass raw user objects/operators into the query.