sdk/golang/Databases/GoMongoCollection
Databases

GoMongoCollection

MongoDB Go driver Collection and Client. Queries built from user input via bson.D or bson.M with string interpolation are NoSQL injection sinks. The filter argument on Find/Update/Delete operations is where tainted input lands.

7 sinks
Taint flow0 sources → 7 sinks
Sinks — dangerous call
.Find()
.FindOne()
.UpdateOne()
.UpdateMany()
.DeleteOne()
.DeleteMany()
.Aggregate()

Sinks

.Find()Sink
#
Signature
Find(ctx context.Context, filter any, opts ...*options.FindOptions) (*Cursor, error)

Queries documents matching filter. NoSQL injection sink if filter is built from user input.

tracks:1
.FindOne()Sink
#
Signature
FindOne(ctx context.Context, filter any, opts ...*options.FindOneOptions) *SingleResult

Returns one document matching filter. Same NoSQL injection risk.

tracks:1
.UpdateOne()Sink
#
Signature
UpdateOne(ctx context.Context, filter, update any, opts ...*options.UpdateOptions) (*UpdateResult, error)

Updates one document matching filter. Both filter and update are injection sinks.

tracks:1
.UpdateMany()Sink
#
Signature
UpdateMany(ctx context.Context, filter, update any, opts ...*options.UpdateOptions) (*UpdateResult, error)

Updates all matching documents. Injection sink on filter and update arguments.

tracks:1
.DeleteOne()Sink
#
Signature
DeleteOne(ctx context.Context, filter any, opts ...*options.DeleteOptions) (*DeleteResult, error)

Deletes first document matching filter. NoSQL injection sink.

tracks:1
.DeleteMany()Sink
#
Signature
DeleteMany(ctx context.Context, filter any, opts ...*options.DeleteOptions) (*DeleteResult, error)

Deletes all matching documents. NoSQL injection sink.

tracks:1
.Aggregate()Sink
#
Signature
Aggregate(ctx context.Context, pipeline any, opts ...*options.AggregateOptions) (*Cursor, error)

Runs an aggregation pipeline. Each stage can be an injection sink if built from user input.

tracks:1

Other Methods

.InsertOne()Neutral
#
Signature
InsertOne(ctx context.Context, document any, opts ...*options.InsertOneOptions) (*InsertOneResult, error)

Inserts a document. Generally safe because fields are typed, but tainted document fields reach storage.

Fully-Qualified Names

FQNField
go.mongodb.org/mongo-driver/mongo.Collectionfqns[0]
go.mongodb.org/mongo-driver/mongo.Clientfqns[1]
*.Collectionpatterns
*.Clientpatterns

Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.

Import

go.mod
require go.mongodb.org/mongo-driver v1.14.0
rule.py
from codepathfinder.go_rule import GoMongoCollection
Next →GoPgxConn