Request Object Passed Straight Into a MongoDB Query

Why it matters

A MongoDB filter is a JSON object, and request bodies are JSON objects too. A value that arrives as an object such as {"$ne": ""} is not a string, and the query treats it as an operator rather than data. Building the filter from named, type-checked fields removes the ambiguity.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

const user = await User.findOne(req.body);

The smallest fix

// Build the filter from specific, type-checked fields:
const email = String(req.body.email ?? '');
const user = await User.findOne({ email });

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

// Validate the shape once with a schema, then query with the result:
const Login = z.object({ email: z.string().email() }).strict();
const { email } = Login.parse(req.body);
const user = await User.findOne({ email });
// And add express-mongo-sanitize as a global middleware as a backstop.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

How to check the fix worked

1. Send the field as an object ({"email": {"$ne": ""}}) and confirm the
   request is rejected or matches nothing.
2. Send a normal string and confirm the lookup works.

Further reading

• https://cwe.mitre.org/data/definitions/943.html