Description

This vulnerability detector identifies NoSQL injection vulnerabilities in Rust MongoDB applications. It specifically targets scenarios where user-controlled input can be injected into MongoDB query filters, potentially allowing attackers to manipulate database queries and bypass authentication or access unauthorized data.

Detection Strategy

• Code must import both the 'mongodb' library (for MongoDB database operations) and the 'actix_web' library (for web framework functionality)

• The detector examines MongoDB filter operations and query construction patterns in the codebase

• A vulnerability is reported when user input flows into MongoDB filter parameters without proper sanitization or validation, creating potential for query manipulation

Vulnerable code example

use actix_web::{post, web, HttpResponse};
use mongodb::bson::Document;
use mongodb::Collection;

#[post("/login")]
async fn login_vulnerable(
    coll: web::Data<Collection<Document>>,
    credentials: web::Json<Document>,...

✅ Secure code example

use actix_web::{post, web, HttpResponse};
use mongodb::bson::{doc, Document};
use mongodb::Collection;

#[post("/login")]
async fn login_safe(
    coll: web::Data<Collection<Document>>,
    credentials: web::Json<Document>,...