False positive: Go / MongoDB Find method
- Linguagem predominante
- CodeQL
- Estrelas
- 10.1k
- Forks
- 2.1k
- Merge médio
- 2d 15h
- PRs com merge (30d)
- 141
Descrição
**Description of the false positive**
**Code samples or links to source code**
https://github.com/github/codeql/blob/dc440aaee6695deb0d9676b87e06ea984e1b4ae5/go/ql/src/Security/CWE-089/SqlInjection/
The following code has a large number of vulnerability false positives in the case of a MongoDB database.
The current MongoDB parameters have defined specific data types, and there are no injection vulnerabilities.
```
type LogFilter struct {
ID []string
}
filter *LogFilter
filterM["id"] = filter.ID
cur, err := dl.Find(ctx, filterM, opts)
```
-->
Guia de contribuição
Direção de pesquisa
Start by reading the linked Go SQL-injection query and comparing its handling of the MongoDB Find call shown in the sample. Use the typed LogFilter and ID values as the starting case; done means this valid MongoDB usage is no longer reported as an injection false positive.
Escrita pelo modelo de indexação a partir do texto da issue.
Avaliação
- Stack de tecnologia
- go, mongodb
- Domínio
- databases, security
- Tipo de issue
- Bug
- Dificuldade
- 4/5
- Tempo estimado
- 3-5 dias
- Status de atividade
- Estagnada
- Clareza
- Precisa de esclarecimento
- Facilidade para iniciantes
- 30/100