Beast Attack in Hanami with Cockroachdb

A Beast Attack (aka `SQL` injection via type confusion or mis‑encoded identifiers) exploits situations where an application builds SQL by concatenating user input into identifiers, schema names, or table names rather than using placeholders. In Hanami, which encourages explicit SQL via Hanami::Repository and raw SQL fragments, developers may inadvertently interpolate values into object or column names when working with Cockroachdb. Cockroachdb, while PostgreSQL‑wire compatible, has its own nuances for identifiers: unquoted identifiers are folded to lowercase, and quoted identifiers are case‑sensitive. If Hanami code builds a query like "SELECT * FROM #{table_name}" where table_name comes from the request, an attacker can supply a payload such as users; DROP TABLE sessions; --. Because the string is interpolated before sending to Cockroachdb, the resulting statement may execute unintended commands or leak data.

More specifically, a Beast Attack in this context can occur when dynamic database/table names are used with Cockroachdb’s SHOW CREATE TABLE or information schema queries inside Hanami repositories. For example, suppose a Hanami service accepts a schema parameter to switch between tenant schemas in a multi‑tenant setup using Cockroachdb. If the code does "SELECT * FROM #{schema}.users", an attacker can provide pg_catalog.pg_shdescription-- to read system metadata. Because Hanami’s default query layer does not automatically quote identifiers, the concatenated SQL reaches Cockroachdb as intended by the attacker, enabling data exposure or privilege escalation. The unauthenticated attack surface emphasized by middleBrick means such endpoints reachable without credentials are prime targets for this technique.

In practice, this maps to the BOLA/IDOR and Property Authorization checks in middleBrick’s 12 security checks, because the issue is often missing authorization on which schema or table a user may reference. The scanner’s Input Validation and Data Exposure checks would flag unvalidated identifier usage that leads to excessive data exposure. When paired with Cockroachdb’s information schema, a Beast Attack can reveal table structures, indexes, and constraints that should remain hidden, directly violating least‑privilege principles.

Remediation centers on never interpolating identifiers and always using a strict allowlist or quoting via Cockroachdb’s identifier quoting rules. In Hanami, prefer parameterized queries for values and explicitly quote identifiers when dynamic names are unavoidable. Below are concrete, working examples tailored for Cockroachdb.

1. Safe repository method with parameterized values

module Repositories
  class Users
    def self.find_by_email(email)
      # Safe: values are parameterized, identifiers are static
      Hanami::Repository["db"]
        .["SELECT id, name, role FROM users WHERE email = $1", email]
        .to_a
    end
  end
end

2. Dynamic schema/table with strict allowlist and quoting

When you must use dynamic identifiers (e.g., tenant schemas), map the input to a known set and quote using Cockroachdb’s double‑quoting convention.

require "sequel"

ALLOWED_SCHEMAS = %w[public tenant_us tenant_eu].freeze

def self.find_in_tenant(tenant, user_id)
  raise ArgumentError, "Invalid tenant" unless ALLOWED_SCHEMAS.include?(tenant)
  schema = Sequel.identifier(tenant)
  # Using Hanami::Repository with a raw fragment, properly quoted
  Hanami::Repository["db"]
    .from(Sequel.qualify(schema, :users))
    .where(id: user_id)
    .to_a
end

If you must build SQL strings, use Sequel.identifier or Cockroachdb’s quote_identifier via the underlying adapter to ensure proper quoting:

identifier = connection.quote_identifier(user_supplied_name)
result = connection.fetch("SELECT * FROM #{identifier} WHERE active = $1", true).to_a

3. Avoiding dynamic object names in Hanami commands

In Hanami use cases where commands construct table or column names, refactor to static mappings:

MAPPING = {
  "profile" => "profiles",
  "account" => "accounts"
}.freeze

def self.call(params)
  table = MAPPING.fetch(params[:entity]) { raise ArgumentError, "Unsupported entity" }
  Hanami::Repository["db"]["SELECT * FROM #{table}"].to_a
end

For the GitHub Action, ensure your CI/CD pipeline runs middlebrick scan <url> to validate that no Beast Attack vectors remain. For the CLI, you can integrate checks directly into scripts with middlebrick scan <url> --format json. The MCP Server enables scanning APIs directly from your AI coding assistant, helping catch dangerous interpolations before they reach Cockroachdb.