Avoid request-driven model queries
Express handlers should not pass raw request objects into NoSQL filters, query helpers, or aggregation pipelines.
#Metadata
#Why it matters
Request-shaped filters, operators, or pipelines can expand query scope and inject unintended behavior.
#Remediation
Build the NoSQL query or aggregation pipeline from fixed fields or validated filter builders instead of passing request data directly.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.express-nosql-injection.rule.yaml.