Fix NoSQL Injection in Helidon

NoSQL Injection in Helidon microservices occurs when untrusted input is treated as query logic rather than literal data. In a MongoDB context, this allows attackers to use operators like $ne or $gt to bypass authentication or exfiltrate sensitive records. If you are concatenating strings to build queries, your service is pwned by design.

The Vulnerable Pattern

public void getUser(String userId) {
    // DANGEROUS: Concatenating input into a raw JSON string
    // An attacker can pass: '" } , { "$gt": "" ' to dump all users
    String rawQuery = "{ \"userId\": \"" + userId + "\" }";
dbClient.execute(exec -> exec
    .find("users")
    .filter(BsonDocument.parse(rawQuery))
    .findFirst());
}

The Secure Implementation

The vulnerability exists because BsonDocument.parse() treats the entire concatenated string as a command structure. By using the Filters API (Filters.eq), the Helidon MongoDB integration ensures that the userId is handled strictly as a data parameter. This prevents 'operator injection' where an attacker could otherwise inject MongoDB query operators to alter the query's logic.

import com.mongodb.client.model.Filters;
public void getUser(String userId) {
// SECURE: Use the Filter API to ensure input is treated as a literal value
dbClient.execute(exec -> exec
.find(“users”)
.filter(Filters.eq(“userId”, userId))
.findFirst());
}