vetkit.js.nosql-injection.request-filter
A MongoDB query filter takes a value straight from the parsed request body or query string. JSON bodies and nested query strings can carry operator objects such as {"$ne": null}, which turns an equality check into an attacker-chosen condition (e.g. login bypass).
Last updated:
Suite: Security
javascript, typescript
A MongoDB query filter takes a value straight from the parsed request body or query string. JSON bodies and nested query strings can carry operator objects such as {"$ne": null}, which turns an equality check into an attacker-chosen condition (e.g. login bypass).
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Coerce or validate the value to the expected scalar type before querying (String(v), a schema validator such as zod/Joi), or enable Mongoose sanitizeFilter / strip keys starting with $.
References
Source: packages/engine/rules/sast/javascript.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.