False positive: Go / MongoDB Find method

**Description of the false positive**

**Code samples or links to source code**

https://github.com/github/codeql/blob/dc440aaee6695deb0d9676b87e06ea984e1b4ae5/go/ql/src/Security/CWE-089/SqlInjection/

The following code has a large number of vulnerability false positives in the case of a MongoDB database.
The current MongoDB parameters have defined specific data types, and there are no injection vulnerabilities.
```
type LogFilter struct {
ID []string
}
filter *LogFilter
filterM["id"] = filter.ID
cur, err := dl.Find(ctx, filterM, opts)
```
-->

Start by reading the linked Go SQL-injection query and comparing its handling of the MongoDB Find call shown in the sample. Use the typed LogFilter and ID values as the starting case; done means this valid MongoDB usage is no longer reported as an injection false positive.

Written by the indexing model from the issue text.