False positive: MongoDB no sql injection

CodeQL (go/sql-injection) flags it when user input flows into any MongoDB query methods, which is great. However, there doesn't seem to be a way to fix the alert at all. There's no specific recommendations for MongoDB.

I spent some time digging into how CodeQL does the detections and I tried to figure out if there's any barrier I could use to fix the alert, but no luck.

Encapsulating user input in `bson` and input sanitisation also do not help.

Note that we use GHAS, which uses CodeQL default suites. As far as I understand, there is no easy way to just override the rule and we don't want to manually close them.

Start with the go/sql-injection query and its MongoDB query-method modeling; reproduce the reported flow using user input, bson wrapping, and sanitization. Done means the valid MongoDB case is no longer flagged, or the issue has a documented CodeQL/GHAS remediation path.

Written by the indexing model from the issue text.