Email Injection in Adonisjs with Cockroachdb

Email injection occurs when user-controlled data is concatenated into email headers or commands without proper validation or escaping. In an AdonisJS application using CockroachDB, this typically manifests in workflows where user input (e.g., a name, reply-to address, or subject) is passed to an email service or database query that later influences outbound email delivery. Because CockroachDB is a SQL-compatible distributed database, injection risk centers on how data is handled before it reaches the database and how it is later used in email contexts.

Consider an endpoint that stores a user profile and sends a confirmation email. If the name field is taken directly from the request and interpolated into an SQL string, an attacker can inject SQL via the name. If that same name is then used in an email header (e.g., in a custom Reply-To or display name), it can become an email injection vector. For example:

const userInputName = req.input('name'); // attacker-controlled: "Smith <[email protected]>"
const query = `INSERT INTO users (name, email) VALUES ('${userInputName}', '[email protected]')`;
await Database.query(query);

Here, the unsanitized userInputName is interpolated into a raw SQL string. Successful SQL injection could allow read/write to other tables. Subsequently, if the stored name is later used in an email header like Reply-To without sanitization, it can enable email header injection:

// Later, when sending an email using a Node mailer
await Mail.send(new Message()
  .to('[email protected]')
  .from('[email protected]')
  .replyTo(userStoredName) // userStoredName may contain: "Smith\r\nCC: [email protected]"
  .subject('Welcome')
  .htmlView('welcome', { name: 'Smith' })
);

The combination of AdonisJS (which encourages ORM use but still allows raw queries), CockroachDB (which accepts standard SQL syntax), and improper input handling creates conditions where both SQL injection and email injection can occur. Attack patterns include header injection via CRLF sequences (e.g., %0d%0a or \r\n) and SQL injection via crafted strings that break query syntax. These issues map to OWASP API Top 10 categories such as Broken Object Level Authorization and Injection, and may intersect with compliance frameworks like PCI-DSS and SOC2 when email channels handle sensitive data.

To detect such issues, middleBrick scans the unauthenticated surface of an API endpoint and correlates findings across the database and email layers. It checks whether user input is validated before SQL execution and whether it is escaped before inclusion in email headers, surfacing high-severity findings with remediation guidance.

Remediation focuses on parameterized queries and strict header validation. For database interactions, always use AdonisJS query builder parameterization or Lucid ORM bound parameters instead of string interpolation. For email headers, sanitize and validate any user-derived content before it reaches mail drivers.

SQL-safe examples with CockroachDB

Use parameterized queries with the query builder to avoid SQL injection:

// Safe: using query builder with bindings
const userInputName = req.input('name');
const userInputEmail = req.input('email');
await Database.from('users').insert({
  name: userInputName,
  email: userInputEmail
});

If using raw SQL, bind parameters explicitly:

// Safe: raw query with bindings
const userInputName = req.input('name');
const userInputEmail = req.input('email');
await Database.rawQuery('INSERT INTO users (name, email) VALUES (?, ?)', [userInputName, userInputEmail]);

With Lucid ORM models, ensure mass assignment protection and use safe merge:

// Safe: using model with guarded fields
const user = new User();
user.merge(req.only(['name', 'email']));
await user.save();

Email header sanitization

Validate and sanitize any user input used in email headers. Reject or encode newline characters and restrict characters to a safe subset. For display names and reply-to addresses, use a library to encode according to RFC 5322:

// Example sanitization for email headers
const sanitizeHeader = (input) => {
  // Remove CR/LF and restrict to printable ASCII
  return input.replace(/[\r\n]+/g, '').replace(/[^\x20-\x7E]/g, '');
};

const safeName = sanitizeHeader(req.input('name'));
await Mail.send(new Message()
  .to('[email protected]')
  .from('[email protected]')
  .replyTo(safeName) // safe: no CRLF sequences
  .subject('Welcome')
  .htmlView('welcome', { name: safeName })
);

Apply similar rules for subject lines and other header fields. middleBrick’s LLM/AI Security checks can complement these defenses by verifying that outputs do not inadvertently expose injected patterns or PII in email interactions.

Finally, adopt continuous scanning via the middleBrick CLI or GitHub Action to fail builds if risky patterns are detected. The Pro plan enables scheduled scans and alerts, ensuring ongoing protection as code evolves.