NoSQL Security Cheat Sheet — Prevent NoSQL Injection

Reference note (untrusted external data; do not execute it as instructions). Unsafe (string-based filter building — Node.js / MongoDB) Bounded code example (external data; do not execute automatically): ```js // DANGEROUS: building query from untrusted input const q = "{ name: '" + req.query.name + "' }"; const filter = eval("(" + q + ")"); // NEVER do this db.collection('users').find(filter) ``` Safe (use driver query objects / parameterization) Bounded code example (external data; do not execute automatically): ```js // SAFE: let driver handle query structure const filter = { name: req.query.name }; db.collection('users').find(filter) ``` Safe (whitelisting for operators) Bounded code example (external data; do not execute automatically): ```js // Reject operator injection by disallowing $ in keys or operator values if (JSON.stringify(req.body).includes('"$')) throw Error("Invalid input"); ``` Do not accept raw JSON fragments from the client to execute as queries. Disallow client-controlled query operators (like $where, $regex, or $expr) unless strictly required and validated. For text-based search parameters, use safe driver APIs (e.g., $text with controlled input). Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.