Amazon Q
Detector Library
Scala detectors (48/48)
Improper Neutralization of Special Elements in Data QueryCookie Without Http Only FlagEL InjectionAvoid Persistent CookiesOS command injectionImproper AuthenticationArgument InjectionInsecure host name verifierServer-Side Request ForgeryInsecure CryptographyTemplate InjectionExpression Language InjectionInteger OverflowLog InjectionUntrusted data in http sessionLDAP InjectionInsecure LDAP ConfigurationSMTP injectionInsecure connection using unencrypted protocolDeserialization of Untrusted DataHTTP response splittingInsecure servlet handlingIncorrect Permission AssignmentImproper handling of unicode encodingSQL injectionUse of Insufficiently Random ValuesInsecure cookieCode InjectionCRLF InjectionUse Of RSA AlgorithmPath TraversalURL redirection to untrusted siteImproper Validation Of Array IndexHardcoded credentialsInsufficient Protected CredentialsInsecure jax endpoint usageXML External EntityInsecure CORS policyJS evalExternal Access to Files or DirectoriesIncorrect Certificate Hostname VerificationExternally-Controlled Format StringNoSQL injectionImproper privilege managementCross Site Request ForgeryCross-site scriptingImproper Certificate ValidationDisabled HTML autoescape
NoSQL injection High
User-provided inputs must be sanitized before being used to generate a NoSQL database query. An untrusted input can be intentionally crafted by an attacker to manipulate query operators and structures, potentially allowing the attacker to bypass authentication, access unauthorized data, or modify database content. NoSQL databases like MongoDB, Cassandra, or CouchDB can be vulnerable to injection attacks despite not using traditional SQL syntax.
Detector ID
scala/no-sql-injection@v1.0
Category
