NDB/DB NoSQL Injection Google Datastore
Standard SQL injection techniques rely on the fact that SQL has various statements to either query or modify data. The datastore has no such feature. The GQL (the query language for the datastore) can only be used to query, not modify. Inserts, updates, and deletes are done using a separate method that does not use a text expression. Thus, the datastore is not vulnerable to such injection techniques. In the worst case, an attacker could only change the query to select data you did not intend, but never change it.
Is there any SQL injection equivalents, or other vulnerabilities I should be aware of when using NoSQL?
I'm using Google App Engine DB in Python2.7, and noticed there is not much documentation from Google about security of Datastore.
Any help would be appreciated!