False positive: MongoDB no sql injection

CodeQL (go/sql-injection) flags it when user input flows into any MongoDB query methods, which is great. However, there doesn't seem to be a way to fix the alert at all. There's no specific recommendations for MongoDB.

I spent some time digging into how CodeQL does the detections and I tried to figure out if there's any barrier I could use to fix the alert, but no luck.

Encapsulating user input in `bson` and input sanitisation also do not help.

Note that we use GHAS, which uses CodeQL default suites. As far as I understand, there is no easy way to just override the rule and we don't want to manually close them.

Comienza con la consulta go/sql-injection y su modelado de métodos de consulta de MongoDB; reproduce el flujo informado usando entrada del usuario, envoltura de bson y sanitización. Se considera terminado cuando el caso válido de MongoDB ya no se marca, o cuando el problema tiene una ruta de remediación de CodeQL/GHAS documentada.

Escrito por el modelo de indexación a partir del texto del issue.