Fix NoSQL Injection in Cuba

NoSQL injection in CUBA/Jmix applications typically targets MongoDB integrations where unsanitized user input reaches the query engine. Attackers exploit loose typing to inject operators like $gt, $ne, or $where, allowing them to bypass authentication or dump data. Hardening the data layer requires moving away from manual JSON construction to type-safe, parameterized query builders.

The Vulnerable Pattern

// VULNERABLE: Direct string concatenation allows operator injection
String userInput = request.getParameter("username");
// Attack payload: admin' , 'password': { '$ne': '1' }
String query = "{ 'username': '" + userInput + "' }";
Document result = mongoCollection.find(Document.parse(query)).first();

The Secure Implementation

The vulnerable code is susceptible to operator injection because it uses Document.parse() on a manually concatenated string. An attacker can break out of the string literal and inject MongoDB operators. The secure implementation uses the Filters API (or the framework's DataManager with parameters), which ensures that input is correctly escaped and treated as a data value rather than an executable part of the query logic.

// SECURE: Use the MongoDB Filters API for parameterization
import com.mongodb.client.model.Filters;
String userInput = request.getParameter(“username”);
// The Filters API treats userInput as a literal string value
Document result = mongoCollection.find(Filters.eq(“username”, userInput)).first();