Fix NoSQL Injection in Spring WebFlux

NoSQL Injection in Spring WebFlux is a silent killer. When you're running a reactive stack with MongoDB, developers often fall into the trap of building queries using raw JSON strings or concatenating user input into BasicQuery objects. This allows attackers to inject MongoDB operators like $ne, $gt, or $where, effectively bypassing authentication or exfiltrating the entire database. To secure your reactive pipeline, you must ditch string manipulation and embrace Spring Data's parameterized Criteria API.

The Vulnerable Pattern

public Flux findByUsernameInsecure(String username) {
    // CRITICAL VULNERABILITY: Raw string concatenation in BasicQuery
    // Attacker input: {"$ne": null}
    String queryStr = "{ 'username': '" + username + "' }";
    return mongoTemplate.find(new BasicQuery(queryStr), User.class);
}

The Secure Implementation

The vulnerable code uses BasicQuery, which parses a raw JSON string. If an attacker provides an object instead of a string (e.g., via a JSON body), they can inject operators that change the query logic. The secure implementation uses the Criteria API. Behind the scenes, Spring Data MongoDB handles the mapping and ensures that the input 'username' is treated strictly as a data value. This prevents the MongoDB engine from interpreting any nested operators within the input, effectively neutralizing the injection vector.

public Flux findByUsernameSecure(String username) {
    // SECURE: Criteria API treats input as a literal value, not a command
    Query query = new Query(Criteria.where("username").is(username));
    return mongoTemplate.find(query, User.class);
}