User-provided data such as URL parameters and POST body-content should always
be considered untrusted and tainted.
Applications that perform NoSQL operations based on tainted data can be
exploited similarly to regular SQL injection bugs. Depending on the code, the
same risks exist as with SQL injections: The attacker aims to access sensitive
information or compromise data integrity. Attacks may involve the injection of
query operators, JavaScript code, or string operations.
This problem can be mitigated by using an Object Document Mapper (ODM) library
or by validating user-supplied data based on its size or allowed characters.
