Fix NoSQL Injection in Qwik

NoSQL Injection in Qwik applications occurs when untrusted data from 'routeLoader$' or 'routeAction$' is passed directly into database filters without sanitization. Attackers exploit this by injecting MongoDB operators like '$gt', '$ne', or '$regex' to bypass authentication, dump user tables, or perform unauthorized data modification. If you are piping your 'data' object straight into a Mongoose or MongoDB findOne() call, your app is vulnerable to operator injection.

The Vulnerable Pattern

import { routeAction$ } from '@builder.io/qwik-city';
import { UserModel } from './db';
export const useLoginAction = routeAction$(async (data) => {
// VULNERABLE: If data.username is { “$ne”: null }, auth is bypassed
const user = await UserModel.findOne({
username: data.username,
password: data.password
});
return user;
});

The Secure Implementation

The exploit works because MongoDB drivers interpret nested objects as query operators. By sending a JSON payload where a field is an object (e.g., { "username": { "$gt": "" } }), the attacker changes the query logic. To fix this in Qwik: 1. Use the 'zod$' validator in your 'routeAction$' to strictly enforce that inputs are primitives (strings) and not objects. 2. Always sanitize or explicitly cast inputs using 'String()' before passing them to the database driver to ensure that even if validation is bypassed, the input is treated as a literal value rather than a command.

import { routeAction$, zod$, z } from '@builder.io/qwik-city';
import { UserModel } from './db';
// SECURE: Use Zod to enforce type constraints and schema validation
export const useLoginAction = routeAction$(
async (data) => {
// Even with validation, explicitly casting to string adds a layer of safety
const user = await UserModel.findOne({
username: String(data.username),
password: String(data.password)
});
return user;
},
zod$({
username: z.string().min(1),
password: z.string().min(1),
})
);