Format String in Adonisjs with Api Keys

A format string vulnerability occurs when user-controlled input is passed directly to a function that interprets format specifiers (such as %s, %d, or %n) without proper sanitization or validation. In AdonisJS, this typically arises when constructing log entries, debug messages, or dynamic response content using data that originates from API keys or other request metadata. If an API key containing format specifiers is used in an unsafe logging or string interpolation routine, an attacker may be able to read from or write to memory by supplying crafted input like %x%x%x%x.

Consider a scenario where an AdonisJS service logs incoming API keys for audit purposes using logger.info('API key: %s', apiKey). If apiKey is attacker-controlled and contains format specifiers, Node.js’s util.format behavior (which underlies many AdonisJS logging integrations) can be abused to consume additional stack arguments, potentially exposing sensitive values or causing crashes. This is a format string vulnerability in the context of API key handling because the API key becomes the format string.

In a black-box scan, middleBrick checks for risky patterns where API key inputs flow into logging, error messages, or dynamic format operations without strict validation or canonicalization. For example, an endpoint that echoes an API key into a response or log using concatenation or unsafe interpolation can be probed for memory disclosure or denial of service. Because API keys often carry high entropy, they are more likely to contain sequences that resemble format directives, increasing the chance of unintended behavior when processed by vulnerable formatting routines.

AdonisJS does not inherently treat API keys as format strings, but developer practices—such as using console.log with multiple substitution tokens or constructing error messages via string concatenation—can introduce the vulnerability. A realistic risk pattern is:

// Risky: using user input as format string
const logMessage = util.format('Auth attempt with key: %s %s', apiKey, extra);
logger.info(logMessage);

If apiKey includes %s or other specifiers, util.format may consume additional arguments, leading to information leakage or instability. middleBrick’s checks include tracing data flows from authentication inputs (including API keys) through formatting and output routines to surface these classes of issues.

To remediate format string risks involving API keys in AdonisJS, ensure that API key values are never used as format specifiers or directly interpolated in functions that interpret format directives. Instead, treat API keys as opaque strings and use safe logging and string construction patterns.

1) Use parameterized logging without substitution placeholders for the API key value:

// Safe: pass API key as a separate argument, not a format token
logger.info({ apiKey: apiKey }, 'Auth attempt');

2) If you must construct a message, escape or sanitize the API key and avoid passing it to formatters that interpret %:

// Safe: escape user input and avoid dynamic format tokens
const escapedKey = apiKey.replace(/%/g, '%25');
logger.info(`Auth attempt with key: ${escapedKey}`);

3) Validate and normalize API keys before use, rejecting or redacting values that contain unexpected patterns:

// Safe: validate API key format and avoid risky usage
const API_KEY_REGEX = /^[A-Za-z0-9\-_]+$/;
if (!API_KEY_REGEX.test(apiKey)) {
  throw new Error('Invalid API key');
}
// Use key as a plain string in logs
logger.info({ action: 'authenticate' }, `key_present=${Boolean(apiKey)}`);

4) In middleware, avoid concatenating API keys into error messages or URLs without proper encoding:

// Safe: use URLSearchParams for query construction
const url = new URL('https://api.example.com');
url.searchParams.append('key', encodeURIComponent(apiKey));
return url.toString();

By combining input validation, safe logging practices, and avoiding format string interpolation with API keys, you reduce the attack surface associated with format string vulnerabilities in AdonisJS applications. middleBrick’s checks validate that API key flows do not reach format interpreters and that remediation guidance is reflected in the findings and per-category breakdowns you see in the dashboard, CLI JSON output, and GitHub Action reports.