Find NoSQL injection vulnerabilities

Finds MongoDB queries built from HTTP request input. Marks a query, update, command or server-side JavaScript passed as a string (new BasicQuery(..), new BasicUpdate(..), MongoOperations.executeCommand(..), Filters.where(..), DB.eval(..)), a JSON string parsed with Document.parse(..), BsonDocument.parse(..), BsonArray.parse(..), BasicDBObject.parse(..) or JSON.parse(..) whatever the parsed document is used for, and a Spring Data Criteria field name, where a key such as $where is read as an operator. Values bound with Criteria.is(..) or Filters.eq(..) are not marked, because the driver encodes them as BSON values. Input converted to a number, boolean, UUID or ObjectId, or checked with ObjectId.isValid(..), Matcher.matches() or Pattern.matches(..) in an if or while condition, is treated as safe. The regular expression itself is not inspected. Sources are servlet and Spring WebRequest accessors and Spring MVC handler parameters bound from the request, except parameters typed as a number, boolean or UUID, or as an array, collection or Optional of those. Test sources are not searched.