security_rust/injection/
nosql_injection.rs

1// Copyright (c) 2026 erik <erik@erik.xyz> — https://erik.xyz
2
3use crate::{AttackCategory, DetectionResult, Detector, Severity};
4use regex::Regex;
5use std::sync::LazyLock;
6
7static PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
8    vec![
9        Regex::new(r#""(?i)\$ne"\s*:"#).unwrap(),
10        Regex::new(r#"'(?i)\$ne'\s*:"#).unwrap(),
11        Regex::new(r#""(?i)\$gt"\s*:"#).unwrap(),
12        Regex::new(r#""(?i)\$gte"\s*:"#).unwrap(),
13        Regex::new(r#""(?i)\$lt"\s*:"#).unwrap(),
14        Regex::new(r#""(?i)\$lte"\s*:"#).unwrap(),
15        Regex::new(r#""(?i)\$regex"\s*:"#).unwrap(),
16        Regex::new(r#""(?i)\$where"\s*:"#).unwrap(),
17        Regex::new(r#""(?i)\$or"\s*:"#).unwrap(),
18        Regex::new(r"(?i)\$eq").unwrap(),
19        Regex::new(r"(?i)\$nin").unwrap(),
20        Regex::new(r#"\{\s*"\$gt"\s*:\s*""\s*\}"#).unwrap(),
21    ]
22});
23
24pub struct NoSqlInjectionDetector;
25
26impl Detector for NoSqlInjectionDetector {
27    fn name(&self) -> &'static str {
28        "nosql_injection"
29    }
30
31    fn detect(&self, input: &str) -> Option<DetectionResult> {
32        for re in PATTERNS.iter() {
33            if let Some(m) = re.find(input) {
34                return Some(DetectionResult {
35                    attack_type: "nosql_injection".into(),
36                    category: AttackCategory::Injection,
37                    severity: Severity::Critical,
38                    matched_pattern: m.as_str().to_string(),
39                    offset: m.start(),
40                    message: "NoSQL injection detected".into(),
41                });
42            }
43        }
44        None
45    }
46}
security_rust/injection/nosql_injection.rs

security_rust/injection/
nosql_injection.rs
