NoSQL Injection (ARCH6140)

Key ruby.security.nosql-injection · Severity error · Category security · CWE CWE-943

Passing a raw request hash into a query lets attackers inject query operators such as $gt to bypass authentication. Always coerce input to scalars.

Incorrect

def authenticate
  User.where(username: params[:username], password: params[:password]).first
end

Correct

def authenticate
  user = User.where(username: params[:username].to_s).first
  user if user&.authenticate(params[:password].to_s)
end

Fix

Coerce query values to scalars with to_s and never pass client-supplied operator hashes.