Fix NoSQL Injection in Tide

NoSQL Injection in the Tide framework typically manifests when raw BSON documents are constructed directly from untrusted JSON input. In Rust, while the type system provides some protection, mapping a `serde_json::Value` or a raw `mongodb::bson::Document` directly from a request body allows attackers to inject MongoDB operators like `$gt`, `$ne`, or `$regex`. This can lead to authentication bypass or full data exfiltration. The fix is mandatory schema enforcement via strongly-typed structs.

The Vulnerable Pattern

use tide::Request;
use mongodb::bson::{doc, Document};
async fn get_user(mut req: Request) -> tide::Result {
// DANGER: Directly deserializing request body into a BSON Document
// An attacker can send {“username”: {“$ne”: null}} to bypass logic
let filter: Document = req.body_json().await?;
let collection = req.state().db.collection::(“users”);
let user = collection.find_one(filter, None).await?;
Ok(format!("{:?}", user).into())
}

The Secure Implementation

The vulnerability exists because MongoDB's Rust driver allows `Document` types to contain nested key-value pairs that the database interprets as commands. In the vulnerable snippet, the entire JSON payload is treated as the query filter. If an attacker passes a JSON object instead of a string for a field, they can inject operators. The secure implementation uses a 'Type-Safe' approach: by deserializing the input into a `UserQuery` struct, `serde` validates that the `username` field is a primitive string. If an attacker tries to pass an object like `{"$ne": ""}`, the deserialization will fail, preventing the malicious query from ever reaching the database layer.

use tide::Request;
use serde::Deserialize;
use mongodb::bson::doc;
#[derive(Deserialize)]
struct UserQuery {
username: String,
}
async fn get_user(mut req: Request) -> tide::Result {
// SECURE: Deserialize into a strictly defined struct
// This forces the input to be a String, neutralizing operator injection
let query: UserQuery = req.body_json().await?;
let collection = req.state().db.collection::mongodb::bson::Document(“users”);
let filter = doc! { "username": &query.username };
let user = collection.find_one(filter, None).await?;

match user {
    Some(u) => Ok(format!("{:?}", u).into()),
    None => Ok(tide::Response::new(404))
}
}