Crlf Injection in Firestore

The fix for CRLF injection in Firestore‑backed services is to ensure that any value originating from a Firestore document is properly sanitized before it becomes part of an HTTP header, query string, or log line. The principle is to treat all document data as untrusted and apply encoding or validation appropriate to the target context.

Recommended practices:

• Header values: Use built‑in HTTP libraries that automatically percent‑encode or reject invalid characters. In Node.js, the http and https modules will throw if a header value contains \r\n. When constructing headers manually, strip or reject new‑line characters:

function safeHeaderValue(value) {
  if (typeof value !== 'string') return String(value);
  // Remove CR and LF characters
  return value.replace(/[\r\n]/g, '');
}

// Usage
const headers = {
  'X-Order-ID': safeHeaderValue(orderId)
};

• Query strings: Use encodeURIComponent for each parameter value, which will convert \r\n to %0D%0A, preventing them from being interpreted as line terminators.

const query = new URLSearchParams({
  orderId: encodeURIComponent(orderId)
}).toString();
const url = `https://example.com/api?${query}`;

• JSON bodies: When sending data as JSON, rely on JSON.stringify which properly escapes control characters, including \r\n, as \u000d\u000a. Avoid manual string concatenation.

// Safe
const body = JSON.stringify({ orderId, amount });
// Unsafe – do NOT do this
// const body = `{"orderId":"${orderId}","amount":${amount}}`;

• Logging: If you stream Firestore changes to a logging service, ensure the logging library treats incoming text as raw data and does not interpret line breaks as separate log entries. Most structured logging libraries (e.g., Winston, Bunyan) handle this automatically when you pass an object rather than a formatted string.

By applying these defenses consistently across all outbound interactions triggered by Firestore events, you eliminate the vector for CRLF injection. middleBrick’s continuous monitoring (available on the Pro plan) can re‑scan your endpoints on a schedule and alert you if a regression introduces unsafe concatenation patterns.

Duplicate heading unintentionally added; please ignore.