Fix mongoose normalization preventing detection

[timokoessler]

Summary by Aikido

Security Issues: 0	🔍 Quality Issues: 1	Resolved Issues: 0

🚀 New Features

• Added Mongoose wrapper to capture original, not-normalized query filters

⚡ Enhancements

• Injected notNormalizedNoSqlFilter into Context to preserve original filters
• Added mongoose dependency and registered Mongoose wrapper in protect initialization

🐛 Bugfixes

• Updated MongoDB sink to check original filter when normalization hid payloads
• Provided structuredClone polyfill (clone) to support object cloning on Node.js v16

^{More info}

[aikido-pr-checks]

Using structuredClone on the filter for every cast invocation copies potentially large objects per call. Avoid per-call deep cloning in hot paths or limit cloning to when necessary.

Details

✨ AI Reasoning
​The new Mongoose.#inspectFilter clones the filter via structuredClone(args[1]) and then updateContext(context, 'notNormalizedNoSqlFilter', filter) on each cast invocation. Mongoose's cast logic is executed frequently during query building; cloning potentially large filter objects per call creates significant CPU and memory overhead proportional to number and size of queries. This turns a previously cheap hook into an O(n) per-call copy, which can be expensive under load.

🔧 How do I fix it?
Move constant work outside loops. Use StringBuilder instead of string concatenation in loops. Cache compiled regex patterns. Use hash-based lookups instead of nested loops. Batch database operations instead of N+1 queries.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[aikido-pr-checks]

Variable 'clonneFunction' is misspelled/unclear; rename to 'cloneFunction' (or similar) to make its purpose obvious.

Details

✨ AI Reasoning
​A newly added function variable has a misspelled and unclear name, making its purpose less obvious to readers. The code introduces a variable holding the cloning implementation named with a typo that closely resembles the exported 'clone' function, increasing cognitive load and potential confusion. Renaming this variable to a clear, descriptive name would make intent self-evident.

🔧 How do I fix it?
Use descriptive verb-noun function names, add docstrings explaining the function's purpose, or provide meaningful return type hints.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}