False positive: MongoDB no sql injection

CodeQL (go/sql-injection) flags it when user input flows into any MongoDB query methods, which is great. However, there doesn't seem to be a way to fix the alert at all. There's no specific recommendations for MongoDB.

I spent some time digging into how CodeQL does the detections and I tried to figure out if there's any barrier I could use to fix the alert, but no luck.

Encapsulating user input in `bson` and input sanitisation also do not help.

Note that we use GHAS, which uses CodeQL default suites. As far as I understand, there is no easy way to just override the rule and we don't want to manually close them.