no-unbounded-find

Requires limit() on find queries to prevent resource exhaustion from unbounded result sets.

⚠️ This rule warns by default in the recommended config.

Quick Summary

Error Message Format

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

🔒 CWE-400 OWASP:A06 CVSS:7.5 | Uncontrolled Resource Consumption (ReDoS) detected | HIGH
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A06_2021/

Message Components

Rule Details

Unbounded queries can:

• Exhaust server memory
• Cause denial of service
• Impact database performance
• Expose excessive data

❌ Incorrect

// No limit - could return millions of documents
const users = await User.find({ active: true });

// Cursor without limit
const cursor = db.collection('logs').find({});

✅ Correct

const x = 1;

Receiver Requirement

find() is are not MongoDB-exclusive. This rule only fires when the receiver is plausibly a Mongo model, collection or database handle — a PascalCase model identifier (User.find(...)), a name ending in Model/Collection/Schema (this.userModel, the idiomatic @InjectModel() injection), a bare db/model/collection, a db.collection('users') chain, or a value bound to a mongodb/mongoose import. PascalCase counts only for a module-level identifier, not for a property reached through this — this.UserRepository is an injected service, not a model.

It stays silent on:

• Array.prototype.find — an array-literal receiver ([a, b].find(Boolean)) or any call whose first argument is a predicate (list.find((x) => x.id)). A Mongo find() takes a filter object; an array find takes a function.
• Generic repository wrappers and other ORMs (this.repository.find(...) on a TypeORM Repository<T>).

Known False Negatives

Limit in Options Object

// ❌ NOT DETECTED
User.find({}, null, { limit: 100 });

Dynamic Limit

// ❌ NOT DETECTED
User.find().limit(config.maxResults);

When Not To Use It

• For batch processing jobs that intentionally process all documents
• When using streaming cursors for pagination
• Admin dashboards with controlled access

References

• MongoDB cursor.limit()
• CWE-400

⚙️ Options