Description of the false positive

Code samples or links to source code

https://github.com/github/codeql/blob/dc440aaee6695deb0d9676b87e06ea984e1b4ae5/go/ql/src/Security/CWE-089/SqlInjection/

The following code has a large number of vulnerability false positives in the case of a MongoDB database.
The current MongoDB parameters have defined specific data types, and there are no injection vulnerabilities.

type LogFilter struct {
    ID             []string
}
filter *LogFilter
filterM["id"] = filter.ID
cur, err := dl.Find(ctx, filterM, opts)

-->