rules-mongodb

db.drop() / collection.drop() / dropDatabase() permanently destroys all documents in a collection or entire database. MongoDB has no built-in recycle bin. Confirm the collection name, verify a backup or Atlas snapshot is available, and ensure this is not reachable from an unauthenticated code path.

MongoDB $function and $accumulator operators execute arbitrary JavaScript in aggregation pipelines (CWE-943). Like $where, these are disabled when security.javascriptEnabled is false. They create the same injection surface: any user-controlled string embedded in the function body becomes server-side code execution. Rewrite with native aggregation operators ($filter, $reduce, $map) instead.

Hardcoded MongoDB connection string with credentials (CWE-798). The URI format 'mongodb://user:password@host' embeds credentials that will persist in git history after removal. Use environment variables: process.env.MONGODB_URI or os.environ['MONGODB_URI']. Atlas users should use API-key auth or IAM instead of username/password URIs.

User input in mapReduce function strings is server-side JavaScript injection. MongoDB's mapReduce accepts JS function bodies as strings — embedding user input creates RCE at the database tier. mapReduce is deprecated as of MongoDB 5.0; replace with the aggregation pipeline. If mapReduce must be used, ensure function bodies are static constants with no user input.

NoSQL injection (CWE-943): raw HTTP request objects passed directly to MongoDB query methods allow operator injection. An attacker submitting { "username": { "$ne": "" } } will bypass equality checks entirely. Always validate and explicitly construct the query object from known fields: find({ username: req.body.username }) rather than find(req.body).

MongoDB $where executes arbitrary JavaScript in the server's JS engine for every document scanned (CWE-943). An attacker who controls any part of the value can run server-side JavaScript, enumerate data, or cause CPU exhaustion. $where is disabled by default in MongoDB 4.4+ (security.javascriptEnabled: false). Remove $where and rewrite the filter using standard query operators ($eq, $gt, $regex, etc.).

collection.insert() is deprecated since MongoDB 3.2 and removed in the Node.js driver v4+. Use insertOne() for a single document or insertMany() for bulk inserts — these return typed results and are consistent with the modern driver API.