Express NoSQL Injection to Safe Queries

A security-focused codemod that transforms unsafe MongoDB query construction with user input to safe parameterized queries in Express applications using Mongoose and MongoDB drivers.

Overview

This codemod addresses CWE-943: Improper Neutralization of Special Elements in Data Query Logic by identifying and transforming potentially vulnerable NoSQL injection patterns in Express applications.

Security Context

CWE-943 occurs when user input is directly passed to database operations without proper sanitization, allowing attackers to inject malicious query operators like $where, $regex, or arbitrary JavaScript code.

Installation

bash
Copy
# Run from registry
npx codemod@latest run @codemod/express-nosql-injection-to-safe-queries

# Or run locally
npx codemod@latest run -w workflow.yaml

What it transforms

Direct User Input

Before:

javascript
Copy
User.findOne(req.body)
User.find(req.query)
User.deleteOne(req.params)

After:

javascript
Copy
User.findOne({ email: req.body.email, username: req.body.username })
User.find({ email: req.query.email, status: req.query.status })
User.deleteOne({ _id: req.params.id })

Spread Operators with User Input

Before:

javascript
Copy
User.find({ ...req.body, active: true })

After:

javascript
Copy
User.find({ email: req.body.email, username: req.body.username, active: true })

Update Operations

Before:

javascript
Copy
User.updateOne({ _id: req.params.id }, req.body)

After:

javascript
Copy
User.updateOne({ _id: req.params.id }, { $set: { email: req.body.email, username: req.body.username } })

Dangerous Operators

Before:

javascript
Copy
User.find({ email: req.body.email, $where: req.body.condition })

After:

javascript
Copy
User.find({ email: req.body.email })

What it doesn't transform

• Hardcoded query values
• Already validated input
• Queries using sanitized variables
• Non-user input variables
• Static regex patterns

Supported Operations

• find, findOne, findOneAndUpdate, findOneAndDelete
• updateOne, updateMany
• deleteOne, deleteMany
• replaceOne
• aggregate, count, countDocuments

Limitations

• Manual Review Required: The codemod uses common field patterns. You must review and adjust the generated safe fields to match your actual data schema.
• Conservative Approach: It may generate overly restrictive queries that need adjustment.
• Schema Awareness: The codemod doesn't know your actual database schema, so field selection is based on common patterns.

Security References

• CWE-943: Improper Neutralization of Special Elements in Data Query Logic
• OWASP A03:2021 – Injection
• MongoDB Security Documentation
• Mongoose Validation Documentation

Development

bash
Copy
# Install dependencies
pnpm install

# Run tests
pnpm test

# Update test snapshots
pnpm test -u

# Validate the codemod
npx codemod@latest validate

# Publish to registry
npx codemod@latest login
npx codemod@latest publish

Contributing

1. Fork the repository
2. Create a feature branch
3. Add tests for your changes
4. Ensure all tests pass
5. Submit a pull request

License

MIT