react-doctor/nosql-injection-risk

Building a NoSQL query from raw client input lets an attacker inject operator-shaped keys or `$where` code and read or alter data they should not.

• Category: Security
• Severity: warn
• Source: oxlint-plugin-react-doctor
• Framework: global
• Enabled when: production .js/.ts/.jsx/.tsx/.py files; test/build/doc/generated paths skipped
• Tags: security-scan
• Default: Enabled

Validation prompt

Use this to decide whether a fired diagnostic is real or a false positive.

Fires on operator-shaped query construction: a $where value built from a template-literal ${…}, a function, or a Python f-string; .find(JSON.parse(req|request.…)); an .aggregate([{ … $where … }]) pipeline; new RegExp(req|request.…); or a $regex: req|request.… operator. Comments are stripped for JS/TS. FALSE POSITIVE: the $where/$regex/RegExp value is a hard-coded server-side constant rather than client input, or the JSON.parse(req…) result is validated/coerced (operator keys stripped, fields cast to scalars) before it reaches the query — the static check cannot see that sanitization and may over-report.

Fix prompt

Use this once validation confirms the diagnostic is real.

Coerce each query field to its expected scalar type (for example String(req.query.id)) and reject objects or $-prefixed operator keys from client input before building the filter. Avoid $where (server-side JavaScript) entirely, replace request-derived new RegExp/$regex with anchored, escaped patterns or exact matches, and never pass JSON.parse(req.body) straight into .find/.aggregate.

Related rules

More Security rules from the rules reference:

• react-doctor/package-metadata-secret: A secret or public-prefixed secret name in `package.json` leaks easily, because package metadata is routinely published to registries, logs, and browser bundles.
• react-doctor/path-traversal-risk: Building a filesystem path from request input lets an attacker use `..` or absolute paths to read or write files outside the intended directory.
• react-doctor/plugin-update-trust-risk: Downloading and running an update or plugin without verifying its integrity lets an attacker ship malicious code to your users.
• react-doctor/postmessage-origin-risk: Reading `event.data` in a `message` handler without checking `event.origin` lets any other window send data your code trusts, which can lead to cross-site scripting or data theft.
• react-doctor/public-debug-artifact: A browser-reachable debug, log, dump, or report file in your build output can expose source paths, internal routes, env data, or secrets.