rules-cosmosdb

SELECT * in a Cosmos DB query retrieves the entire document including all properties, increasing RU consumption and data surface. Prefer projections (SELECT c.id, c.name FROM c WHERE ...) to reduce throughput cost and limit data exposure in logs and responses.

DocumentClient is the deprecated Cosmos DB SDK v2 client. Migrate to @azure/cosmos v4 (Node.js), the Azure Cosmos DB SDK for Python 4.x, or the v3 .NET SDK. The new SDKs include improved RBAC support, diagnostic capabilities, and performance improvements.

Hardcoded Cosmos DB connection string (AccountEndpoint + AccountKey) detected (CWE-798). Connection strings embedded in source give anyone with repo access full control of the database. Store the connection string in Azure Key Vault or environment variables and retrieve it at runtime via the Azure SDK DefaultAzureCredential.

Hardcoded Cosmos DB master or primary key detected (CWE-798). Master keys grant full read/write access to all containers. Use Managed Identity + RBAC instead of key-based auth where possible, or load the key from Azure Key Vault at startup.

Cosmos DB SQL API query built with string interpolation. User-controlled data injected into the query string enables NoSQL injection — attackers can read or delete data from other partitions. Use parameterized queries with the QueryDefinition(query).WithParameter('@param', value) API instead of string concatenation.

Cosmos DB account has publicNetworkAccess enabled. This exposes the account endpoint to the public internet. For production workloads, set publicNetworkAccess to Disabled and connect only via Private Endpoints to prevent external access.