Buffer Overflow in Hanami with Cockroachdb

A buffer overflow in a Hanami application that uses CockroachDB typically arises when untrusted input is used to construct SQL queries or when application-layer buffers are sized based on untrusted lengths without proper validation. CockroachDB, while PostgreSQL-wire compatible, enforces strict type and length checks on the server side; however, the client-side code in Hanami can still create unsafe conditions before requests reach the database. For example, if a Hanami entity reads a large request payload into a fixed-size Ruby string or array and then passes it directly to a SQL VALUES clause or uses string interpolation, the oversized input can overflow in-memory buffers at the application layer, leading to crashes or potential code execution paths.

Consider a Hanami endpoint that accepts a user-supplied description field and inserts it into a CockroachDB table without length validation:

module Web::Controllers::Items
  class Create
    include Web::Action

    def call(params)
      DB["INSERT INTO items (description) VALUES (?)", params[:description]] # unsafe if description is huge
    end
  end
end

If params[:description] is extremely large (e.g., tens of megabytes), the Ruby process may exhaust memory or exhibit undefined behavior before the parameterized query is even sent to CockroachDB. While CockroachDB will reject overly large packets or malformed inputs based on its own limits, the vulnerability surface exists in the Hanami app’s handling of data prior to transmission. Additionally, dynamic SQL construction using string concatenation can exacerbate risks:

query = "SELECT * FROM items WHERE category = '#{params[:category]}' AND notes LIKE '%#{params[:search]}%"
DB[query] # unsafe string interpolation

In this scenario, a long params[:search] value can bloat the resulting query string and stress buffers in the Ruby interpreter or the underlying DB driver. Although CockroachDB will enforce its own packet and SQL size limits, the application may crash during query construction or while waiting for the response, effectively creating a denial-of-service vector that an attacker can trigger remotely.

Moreover, Hanami’s use of Rack middleware means large request bodies are parsed before reaching application code. Without explicit size limits on Rack parsers, an oversized payload can consume excessive memory during parsing, indirectly relating to buffer handling in the broader runtime. The combination of Hanami’s object-oriented mapping and CockroachDB’s strict server-side validation means many issues are caught early by CockroachDB, but the client-side buffer handling in Ruby remains the weak link that must be secured.

Remediation focuses on input validation, safe query construction, and size limits at the Hanami layer before data reaches CockroachDB. Always use parameterized queries and enforce length and type constraints in Hanami entities and validations.

1) Use parameterized queries with explicit type casting and length checks:

module Web::Controllers::Items
  class Create
    include Web::Action

    def call(params)
      description = params[:description]
      # Validate length before sending to CockroachDB
      if description.to_s.bytesize > 10_000
        self.status = 422
        return { error: "description too long" }
      end
      # Safe: parameterized with bound values
      DB.execute("INSERT INTO items (description) VALUES ($1)", description)
    end
  end
end

2) Define a Hanami entity with built-in validations that enforce size constraints, ensuring only safe data is passed to CockroachDB:

module Entities
  class ItemEntity
    include Hanami::Entity

    attributes :id, :description

    validates :description, length: { maximum: 10_000 }, presence: true
  end
end

# In your action
module Web::Controllers::Items
  class Create
    include Web::Action

    def call(params)
      entity = Entity::ItemEntity.new(params)
      if entity.valid?
        DB[:items].insert(entity.to_h)
        self.status = 201
      else
        self.status = 422
        { errors: entity.errors }
      end
    end
  end
end

3) For dynamic queries, use Hanami’s dataset API rather than string interpolation, and apply CockroachDB-compatible placeholders:

query = DB[:items].where(category: params[:category]).where { notes.like("%#{params[:search]}%") }
results = query.limit(100).to_a # safe, bounded dataset

4) Configure Rack request size limits in your Hanami application to prevent oversized bodies from being parsed:

# config/application.rb
module MyApp
  class Application < Hanami::Application
    configure do |config|
      config.middleware.insert_before Rack::Runtime, Rack::RequestSizeLimit, 10 * 1024 * 1024 # 10 MB
    end
  end
end

These steps ensure that buffer overflow risks are mitigated at the Hanami application layer while leveraging CockroachDB’s robustness for safe data storage. By validating sizes and using parameterized queries, you reduce the attack surface and avoid relying on CockroachDB alone to catch malformed input.