Information Disclosure in Cockroachdb

// Secure error handling for Cockroachdb
func queryUsers(ctx context.Context, id string) ([]User, error) {
    rows, err := db.QueryContext(ctx, "SELECT id, name, email FROM users WHERE id = $1", id)
    if err != nil {
        // Log detailed error internally
        logErrorWithDetails(err, "queryUsers", id)
        
        // Return generic error to client
        return nil, errors.New("database query failed")
    }
    defer rows.Close()
    
    var users []User
    for rows.Next() {
        var u User
        if err := rows.Scan(&u.ID, &u.Name, &u.Email); err != nil {
            logErrorWithDetails(err, "scan row")
            return nil, errors.New("database error")
        }
        users = append(users, u)
    }
    
    return users, nil
}

Cockroachdb provides built-in features for secure query execution. Use prepared statements and parameterized queries to prevent SQL injection and information disclosure through query structure:

// Secure Cockroachdb query patterns
stmt, err := db.Prepare("SELECT id, name, email FROM users WHERE id = $1")
if err != nil {
    return err
}
defer stmt.Close()

// Always use parameterized queries
rows, err := stmt.Query(id)
if err != nil {
    // Handle error securely
}

Configure Cockroachdb to minimize information disclosure through SQL shell and administrative interfaces:

-- Secure Cockroachdb configuration
SET sql_safe_updates = true;
SET require_secure_defaults = true;
ALTER ROLE admin SET password_expiration = '2030-01-01';
-- Disable information schema access for non-admin users
REVOKE SELECT ON information_schema FROM public;

-- Create least-privilege database user
CREATE USER app_user WITH PASSWORD 'strong_password';
GRANT SELECT ON users TO app_user;
REVOKE ALL ON information_schema FROM app_user;

Implement application-level query result sanitization to prevent timing attacks and information leakage:

// Constant-time response to prevent timing attacks
func checkUserExists(ctx context.Context, id string) bool {
    var exists bool
    
    // Use constant-time query
    err := db.QueryRowContext(
        ctx,
        "SELECT EXISTS(SELECT 1 FROM users WHERE id = $1)",
        id,
    ).Scan(&exists)
    
    if err != nil {
        logErrorWithDetails(err, "checkUserExists", id)
        return false
    }
    
    return exists
}

For AI/ML applications using Cockroachdb as a vector store, implement strict output filtering and system prompt isolation:

# Secure AI endpoint with Cockroachdb
@app.route('/chat/completions', methods=['POST'])
def secure_chat():
    data = request.json
    prompt = data.get('prompt', '')
    
    # Filter for SQL injection attempts
    if any(keyword in prompt.lower() for keyword in ['select', 'insert', 'delete', 'update']):
        return jsonify({
            "error": "Invalid request",
            "detail": "Query contains restricted keywords"
        }), 400
    
    # Query vector store securely
    try:
        results = db.sql("SELECT response FROM ai_responses WHERE embedding <@ $1 LIMIT 1", [embed_prompt(prompt)])
        
        # Mask any database-related content in response
        sanitized_response = re.sub(r'\b(users|tables|select|cockroachdb|cockroach)\b', '[REDACTED]', results[0])
        
        return jsonify({"choices": [{"text": sanitized_response}]})
    except Exception as e:
        log.error(f"AI query failed: {e}")
        return jsonify({"error": "Service unavailable"}), 500