NoSQL Injection in Sinatra environments typically targets the Mongoid or Mongo Ruby driver. When developers pass raw Rack parameters directly into query methods like 'where' or 'find_by', they allow attackers to inject MongoDB operators. By submitting a Hash instead of a String (e.g., via 'params[:id][$ne]=1'), an adversary can bypass authentication, exfiltrate data, or cause Denial of Service by manipulating the query logic.

The Vulnerable Pattern

require 'sinatra'
require 'mongoid'
post ‘/login’ do
VULNERABLE: params[:username] and params[:password] can be hashes
user = User.where(username: params[:username], password: params[:password]).first
if user
“Welcome #{user.username}”
else
status 401
“Access Denied”
end
end

The Secure Implementation

The vulnerability occurs because Rack parses nested query parameters like 'password[$gt]=' into a Ruby Hash: {'password' => {'$gt' => ''}}. When Mongoid receives this Hash, it interprets '$gt' as a MongoDB operator, resulting in a query that returns any user with a non-empty password. To remediate this, you must enforce strict type checking. By calling '.to_s' on input parameters, you ensure that any injected Hash is flattened into a harmless string representation, neutralizing the operator injection.

require 'sinatra'
require 'mongoid'
post ‘/login’ do
SECURE: Explicitly cast parameters to strings to prevent Hash injection
username = params[:username].to_s
password = params[:password].to_s
user = User.where(username: username, password: password).first
if user
“Welcome #{user.username}”
else
status 401
“Access Denied”
end
end