MongoDB will not prevent NoSQL injections in your Node.js app

&quot;NoSQL means Not-injectable, right?&quot; makes no sense for me. It doesnt matter which type of database technology you are using. As any other database there are security roles. No mongodb query should be executed as an admin. You can restrict that up to document level. You can even create read-only views. You should always validate you payload. Use e.g Joi <a href="https:&#x2F;&#x2F;github.com&#x2F;hapijs&#x2F;joi" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;hapijs&#x2F;joi</a>. Someone who doesn&#x27;t validate his payload and pass it up to the driver should not be surprised.

This isn&#x27;t injection at all. No commands other than the find are being performed. Little Bobby Tables (Little Bobby Collections?) will not have any luck here.<p>In addition to the fact that you can&#x27;t execute arbitrary commands with this example, the example itself is flawed. If the programmer&#x27;s intention was to exclude &quot;secret projects&quot; from all searches, then they should have written the query to do that. They didn&#x27;t, and allowed multiple other ways of accessing those records.<p>Writing some code that does something different to what you intended it to do is not a NoSQL injection, it&#x27;s just bad code.

Every time I read these MongoDB articles, I question why RethinkDB didn&#x27;t rise up.

Noob question. I get that this is a problem and what it could do, but wouldn&#x27;t doing simple checks and validations of any client input solve this problem?

If you&#x27;re letting users query against a collection using a fairly arbitrary filter, then not having something to ensure they are authorized to view (or update, etc.) the results is almost certainly a mistake. Also describing $gte as a &quot;command&quot; seems misleading; if you could use $where in embedded queries it would maybe be a different story, but since I don&#x27;t think you can, this seems hyperbolic.