Header Injection in Aspnet with Cockroachdb

Header Injection occurs when user-controlled data is reflected into HTTP response headers without proper validation or encoding. In an ASP.NET application that uses CockroachDB as the backend database, the risk is not that CockroachDB introduces a header injection flaw, but that application code handling database results constructs headers insecurely. Because CockroachDB is often deployed in distributed, multi-region environments and is commonly accessed via connection strings and drivers used in ASP.NET, patterns around data retrieval and response building become critical.

ASP.NET by default does not treat database values as safe for headers. If a developer reads a row from CockroachDB — for example, a user record containing fields like display name, tenant identifier, or trace metadata — and then places those values into headers such as Location, X-Forwarded-For, or custom headers, the application can reflect untrusted input into the header space. This can enable HTTP response splitting, header manipulation, or cache poisoning when the values contain newline characters (CRLF) that allow injection of additional headers or body content.

The combination of ASP.NET and CockroachDB often involves ORM usage (such as Entity Framework Core) where raw SQL or LINQ results are mapped into objects. If the developer uses these objects directly to build responses — for example, returning a user-supplied value from a CockroachDB column into a Location header during a redirect — and does not validate or sanitize the content, the application becomes vulnerable. A common scenario: an endpoint like /redirect?url={userInput} that also adds a CockroachDB-derived field such as X-Tenant-ID to the response headers without sanitization.

CockroachDB’s wire protocol and SQL syntax do not directly enable header injection, but features commonly used with ASP.NET can increase exposure. For instance, using SHOW or SELECT to return metadata that is then placed into headers (such as a X-Db-Version) without escaping newlines can allow an attacker to inject additional header lines. Because CockroachDB supports rich SQL expressions and can return arbitrary computed columns, developers must treat all query outputs as untrusted when used in header context.

Real-world impact examples include: an attacker providing a newline in a username stored in CockroachDB, which then appears in a X-User-Name header and is used to inject a second header like Set-Cookie: session=hijacked; or an open redirect where a CockroachDB-stored URL fragment is placed into the Location header, and newline characters allow splitting the response and smuggling requests.

Remediation focuses on strict input validation, output encoding for headers, and safe usage patterns when working with CockroachDB in ASP.NET. Always treat data from CockroachDB as untrusted, apply allowlists where possible, and avoid reflecting database fields directly into headers.

1. Avoid reflecting CockroachDB fields into response headers

Do not assign values from CockroachDB query results to headers such as Location, X-Forwarded-For, or custom headers. If metadata is needed for debugging, use a separate, controlled header namespace and encode values.

2. Validate and encode if reflection is necessary

If you must include a CockroachDB-derived value in a header, enforce strict validation and encode newlines. For custom headers, remove or replace CRLF sequences. Below is a safe pattern in ASP.NET Core using a CockroachDB connection with Npgsql.

// Example: safe header assignment from CockroachDB data in ASP.NET Core
using Npgsql;
using System.Text;

public async Task GetAndSetSafeHeader(HttpResponse response, string tenantId)
{
    await using var conn = new NpgsqlConnection("Host=your-cockroachdb-host;Database=yourdb;Username=youruser;Password=yourpass");
    await conn.OpenAsync();

    await using var cmd = new NpgsqlCommand("SELECT display_name FROM tenants WHERE id = @id", conn);
    cmd.Parameters.AddWithValue("id", tenantId);

    var displayName = await cmd.ExecuteScalarAsync() as string;
    if (string.IsNullOrEmpty(displayName))
    {
        response.StatusCode = 404;
        return;
    }

    // Safe: remove newlines and non-printable chars before using in a header
    var safeName = Encoding.UTF8.GetString(Encoding.UTF8.GetBytes(displayName)
        .Where(b => b >= 0x20 && b <= 0x7E).ToArray());
    response.Headers.Append("X-Display-Name", safeName);
}

3. Use allowlists for values used in redirects

When using CockroachDB values in redirects (e.g., stored URLs), validate against an allowlist or enforce strict URL parsing. Do not trust stored URLs to be safe.

// Example: safe redirect with validated origin in ASP.NET Core
[HttpGet("redirect")]
public IActionResult RedirectToOrigin(string origin)
{
    // Validate origin against allowlist
    var allowedOrigins = new HashSet<string> { "https://app.example.com", "https://dashboard.example.com" };
    if (!allowedOrigins.Contains(origin))
    {
        return BadRequest("Invalid origin");
    }

    // Fetch a CockroachDB-derived path segment safely
    await using var conn = new NpgsqlConnection("Host=your-cockroachdb-host;Database=yourdb;Username=youruser;Password=yourpass");
    await conn.OpenAsync();
    await using var cmd = new NpgsqlCommand("SELECT path FROM redirect_paths WHERE origin = @origin", conn);
    cmd.Parameters.AddWithValue("origin", origin);
    var path = await cmd.ExecuteScalarAsync() as string;

    // Do not reflect raw path into Location; ensure it's a safe relative path
    if (path != null && path.StartsWith("/", StringComparison.Ordinal))
    {
        return Redirect($"{origin}{path}");
    }
    return BadRequest("Invalid path");
}

4. Sanitize inputs used in SQL to avoid secondary injection

Even though header injection is the immediate concern, unsafe SQL construction using CockroachDB can lead to data leakage that feeds headers. Always use parameterized queries instead of string concatenation.

// UNSAFE: string concatenation — do not use
// var sql = $"SELECT display_name FROM tenants WHERE id = '{tenantId}'";

// SAFE: parameterized query with Npgsql for CockroachDB
await using var cmd = new NpgsqlCommand("SELECT display_name FROM tenants WHERE id = @id", conn);
cmd.Parameters.AddWithValue("id", tenantId);
var displayName = await cmd.ExecuteScalarAsync() as string;

5. Enforce strict header validation middleware

Add middleware to validate all outgoing headers and strip or replace dangerous characters like carriage return and line feed regardless of source, including those derived from CockroachDB.

// Example middleware in ASP.NET Core to strip CRLF from all headers
app.Use(async (context, next) =>
{
    await next.Invoke();
    var headers = context.Response.Headers;
    foreach (var key in headers.Keys.ToList())
    {
        var value = headers[key].ToString();
        if (value.Contains("\r") || value.Contains("\n"))
        {
            context.Response.Headers[key] = value.Replace("\r", "").Replace("\n", "");
        }
    }
});