Express NoSQL Injection to Safe Queries
A security-focused codemod that transforms unsafe MongoDB query construction with user input to safe parameterized queries in Express applications using Mongoose and MongoDB drivers.
Overview
This codemod addresses CWE-943: Improper Neutralization of Special Elements in Data Query Logic by identifying and transforming potentially vulnerable NoSQL injection patterns in Express applications.
Security Context
CWE-943 occurs when user input is directly passed to database operations without proper sanitization, allowing attackers to inject malicious query operators like $where, $regex, or arbitrary JavaScript code.
Installation
What it transforms
Direct User Input
Before:
After:
Spread Operators with User Input
Before:
After:
Update Operations
Before:
After:
Dangerous Operators
Before:
After:
What it doesn't transform
- Hardcoded query values
- Already validated input
- Queries using sanitized variables
- Non-user input variables
- Static regex patterns
Supported Operations
find,findOne,findOneAndUpdate,findOneAndDeleteupdateOne,updateManydeleteOne,deleteManyreplaceOneaggregate,count,countDocuments
Limitations
- Manual Review Required: The codemod uses common field patterns. You must review and adjust the generated safe fields to match your actual data schema.
- Conservative Approach: It may generate overly restrictive queries that need adjustment.
- Schema Awareness: The codemod doesn't know your actual database schema, so field selection is based on common patterns.
Security References
- CWE-943: Improper Neutralization of Special Elements in Data Query Logic
- OWASP A03:2021 – Injection
- MongoDB Security Documentation
- Mongoose Validation Documentation
Development
Contributing
- Fork the repository
- Create a feature branch
- Add tests for your changes
- Ensure all tests pass
- Submit a pull request
License
MIT