NoSQL Injection (ARCH5140)

Key go.security.nosql-injection · Severity error · Category security · CWE CWE-943

Passing untrusted input straight into a NoSQL query lets an attacker inject query operators like $gt to bypass authentication or disclose data.

Incorrect

var filter bson.M
json.Unmarshal(r.Body, &filter) // {"password": {"$ne": null}}
coll.FindOne(ctx, filter)

Correct

var req struct{ User, Pass string }
json.NewDecoder(r.Body).Decode(&req)
filter := bson.M{"user": req.User, "pass": req.Pass}
coll.FindOne(ctx, filter)

Fix

Build query filters from typed scalar fields, not from raw user-supplied objects.