Rule Definition
The software constructs all or part of No-SQL command via user-controllable inputs. These inputs are not neutralized or are incorrectly neutralized. As a consequence, the No-SQL command may be completely altered.

Remediation
Use authorized sanitization methods. Do not expose sensible methods.

Violation Code Sample

String input; // value given by an API request
            
List<Database> databaseList0 = documentClient
    .queryDatabases(
        "SELECT * FROM root r WHERE r.id='" + input
            + "'", null).getQueryIterable().toList();

Fixed Code Sample

String input; // value given by an API request, but sanitized, or constant value
            
List<Database> databaseList0 = documentClient
    .queryDatabases(
        "SELECT * FROM root r WHERE r.id='" + input
            + "'", null).getQueryIterable().toList();

CWE-943: Improper Neutralization of Special Elements in Data Query Logic https://cwe.mitre.org/data/definitions/943.html Open Web Application Security Project (OWASP) https://www.owasp.org/index.php/Top_10-2017_A1-Injection