fixes:
  - id: 1
    explanation: 'Removing the option to update multiple documents at once combined with avoiding a "not-equal"-based injection is insufficient against any attacker with at least moderate MongoDB query knowledge.'
  - id: 2
    explanation: 'Removing the option to update multiple documents at once is definitely necessary. But it is unfortunately not a sufficient fix, as an attacker might still be able to "add back" the multi-update behavior.'
  - id: 3
    explanation: 'Removing the option to update multiple documents at once combined with only allowing plain strings in the ID parameter is the right call. This will prevent any attacker from injecting their own JSON payload to manipulate the query in their favor.'
hints:
  - "To find the culprit lines, you need to understand how MongoDB handles updating records."
  - "Does this query really need to allow updating more than one review at once?"
  - "Consider the query parameters under control of the attacker and try to find the one where they might inject some query-altering command."

