NoSQL injection
Untrusted input changes the structure of a NoSQL query, for example a JSON object such as {"$ne": null} where the code expected a string, which turns an equality test into an operator (CWE-943). Check types and build queries from fixed operators.
- Fix it in your stack
- NoSQL operator injection fix cards (2 stacks) · CWE-943 page
- Defined in
- MITRE CWE-943
Covered in
Prevent NoSQL, LDAP, XPath and expression-language injection
SQL is not the only query language that receives user input. Stop MongoDB operator injection with type checks and $eq, escape LDAP filter values, pass XPath values as variables, and never evaluate SpEL or OGNL built from request data.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Practice: SQL injection lab: Separate SQL structure from data with sqlite3 · OS command injection lab: Run git without a shell · SSTI lab: Render a welcome banner without template injection · XXE lab: Parse an uploaded invoice without resolving external entities