NoSQL injection (ARCH2140)

Key python.security.nosql-injection · Severity error · Category security · CWE CWE-943

Putting a user-supplied object straight into a MongoDB query lets an attacker inject operators like $ne or $gt. This leads to authentication bypass and data disclosure.

Incorrect

def login(request):
    body = request.get_json()
    user = db.users.find_one({"name": body["name"],
                              "password": body["password"]})

Correct

def login(request):
    body = request.get_json()
    name = str(body["name"])
    password = str(body["password"])
    user = db.users.find_one({"name": name, "password": password})

Fix

Coerce query fields to the expected primitive types; never pass raw JSON objects straight into the query.