Header Injection in Fiber with Cockroachdb

Header Injection in a Fiber application that interacts with Cockroachdb typically arises when user-controlled input is used to construct HTTP headers or SQL commands without proper validation or parameterization. Because Cockroachdb is compatible with PostgreSQL wire protocol, many standard SQL injection and header manipulation patterns apply, but the interaction with Fiber’s HTTP stack can introduce additional risk vectors.

In Fiber, route handlers often read values from request headers to decide how to build responses or forward requests. If these values are passed directly into Cockroachdb queries—such as dynamic database names, schema-qualified table references, or conditional logic in SQL statements—an attacker can inject newline characters (\r\n) or other header-like sequences to alter the intended SQL command. For example, a header value used in a query label or comment can terminate the intended statement and append a new command, leading to unauthorized data access or modification.

Another scenario occurs when response headers are constructed using data retrieved from Cockroachdb. If the database returns user-influenced content (such as usernames or metadata) and this content is placed into headers like X-User-Role or X-Trace-ID without sanitization, an attacker can inject additional headers. This can cause HTTP response splitting, cache poisoning, or the smuggling of malicious directives downstream through proxies or load balancers.

Because middleBrick tests unauthenticated attack surfaces, it flags scenarios where header-derived inputs reach the database layer or where database-derived data influences HTTP headers. The 12 security checks run in parallel, and findings related to Input Validation, Property Authorization, and Data Exposure often highlight these cross-layer issues. By mapping findings to frameworks such as OWASP API Top 10 and PCI-DSS, middleBrick helps teams understand how a seemingly innocuous header can become a pivot point for broader compromise when combined with Cockroachdb interactions.

Remediation focuses on strict input validation, parameterized queries, and safe header handling. Never concatenate user input directly into SQL strings or header values. Use placeholders and prepared statements to ensure data is treated strictly as values, not executable code.

Example 1: Safe query with parameterized values

const { Pool } = require('pg');
const pool = new Pool({
  connectionString: process.env.DATABASE_URL,
});

app.get('/user/:id', async (c) => {
  const userId = c.params.id;
  // Use parameterized query to avoid injection
  const result = await pool.query('SELECT id, name, email FROM users WHERE id = $1', [userId]);
  return c.json(result.rows[0]);
});

Example 2: Avoid dynamic database or schema names from headers

If you must use dynamic identifiers, validate them against a strict allowlist. Do not use header values directly in object names.

const allowedSchemas = ['public', 'tenant_a', 'tenant_b'];
app.get('/data', async (c) => {
  const schema = c.get('X-Schema-Name');
  if (!allowedSchemas.includes(schema)) {
    return c.status(400).json({ error: 'invalid schema' });
  }
  const result = await pool.query(`SELECT * FROM ${schema}.records WHERE active = $1`, [true]);
  return c.json(result.rows);
});

Example 3: Sanitize data before placing it in response headers

Ensure any data from Cockroachdb that goes into headers is stripped of newline and control characters.

app.get('/profile', async (c) => {
  const user = await pool.query('SELECT username, role FROM profiles WHERE user_id = $1', [c.get('X-User-ID')]);
  if (user.rows.length === 0) return c.status(404).send();
  const safeUsername = user.rows[0].username.replace(/[\r\n]+/g, '');
  c.set('X-Username', safeUsername);
  c.set('X-Role', user.rows[0].role);
  return c.json(user.rows[0]);
});

Example 4: Use middleware for header validation

Centralize header sanitization to prevent accidental leakage of sensitive or database-derived values.

app.use((c, next) => {
  const raw = c.get('X-Custom-Header');
  if (raw && /[\r\n]/.test(raw)) {
    return c.status(400).json({ error: 'invalid header' });
  }
  return next();
});