Description

This detector identifies NoSQL injection vulnerabilities in Elixir applications that use DynamoDB. NoSQL injection occurs when user input is directly embedded into DynamoDB query expressions without proper sanitization, allowing attackers to manipulate database queries and potentially access or modify unauthorized data.

Detection Strategy

• Scans Elixir source code files for DynamoDB query operations and database interactions

• Identifies locations where user-controlled data flows into DynamoDB expression parameters

• Checks if input data is properly sanitized or parameterized before being used in DynamoDB queries

• Reports vulnerabilities when unsanitized user input is directly concatenated or interpolated into DynamoDB query expressions

• Focuses on DynamoDB-specific query methods and expression builders that could be exploited for injection attacks

Vulnerable code example

defmodule VulnerableDynamo do
  def query_injection(conn) do
    field = conn.params["field"]
    
    # VULNERABLE: Direct string interpolation allows NoSQL injection
    ExAws.Dynamo.query(
      "Users",
      key_condition_expression: "#{field} = :value"...

✅ Secure code example

defmodule SecureDynamo do
  def query_injection(conn) do
    field = conn.params["field"]
    value = conn.params["value"]
    
    # SAFE: Use attribute name placeholders instead of string interpolation
    ExAws.Dynamo.query(
      "Users",...