Http Request Smuggling in Chi with Firestore

Http Request Smuggling can occur in a Chi application that uses Firestore when request parsing and routing are inconsistent between frontend and backend handlers, and when Firestore data shapes influence how requests are interpreted. Chi is a minimalistic Clojure web framework that relies on explicit middleware to parse headers, bodies, and cookies. If a route expects a JSON body that includes a Firestore document ID or path, but an earlier middleware or proxy does not normalize content-length or transfer-encoding, an attacker can craft requests where the body is interpreted differently by the frontend load balancer versus the Chi application.

For example, a mixed-content-length smuggling scenario can arise when a request includes both a Content-Length and a Transfer-Encoding header. A frontend proxy may process based on Content-Length, while Chi parses the body according to Transfer-Encoding. If the body contains a Firestore document path like /databases/(default)/documents/users/abc123, the discrepancy can cause the backend to read an extra body segment as a new Firestore operation or parameter, leading to unauthorized data access or injection of malicious document references. This becomes especially risky when Firestore security rules rely on request-scoped variables that are manipulated via the smuggling vector.

Another relevant pattern is request splitting via crafted HTTP headers that affect how Firestore queries are constructed. If user-controlled headers are reflected into Firestore document IDs or collection names without strict validation, an attacker can inject newline characters to split requests and cause the Chi handler to process a second request that references a different Firestore path. Because Firestore paths are often concatenated dynamically in Chi handlers, a single smuggling point can expose multiple logical data boundaries. The unauthenticated attack surface tested by middleBrick can surface these inconsistencies by probing endpoints that accept Firestore identifiers in URLs or bodies without strict schema enforcement.

middleBrick’s 12 security checks, including Input Validation, Property Authorization, and Unsafe Consumption, are designed to detect anomalies in how Firestore identifiers are handled in Chi routes. By scanning the unauthenticated API surface, it can identify endpoints where smuggling techniques like CL.TE or TE.CL may alter the intended Firestore document being accessed. The scanner does not fix the routing or parsing logic, but it provides prioritized findings with remediation guidance to help developers align request handling and Firestore data access patterns.

To mitigate Http Request Smuggling in Chi when working with Firestore, enforce strict header and body parsing before any Firestore operations. Ensure that middleware for JSON parsing consumes the entire body based on Content-Length or Transfer-Encoding, but not both, and reject requests that contain both headers. Use Chi’s wrap-params and wrap-keyword-params to normalize inputs, and validate Firestore document IDs against a strict pattern before concatenating paths.

Example: Safe Firestore document lookup in Chi

(ns my-app.handler
  (:require [cheshire.core :as json]
            [ring.util.response :as resp]
            [firebase-admin.firestore :as fs]))

(defn validate-doc-id [id]
  (when (re-matches #"^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$" id)
    id))

(defn get-user-handler [request]
  (let [user-id (get-in request [:params :user-id])
        doc-id (validate-doc-id user-id)]
    (if doc-id
      (let [db (fs/get-firestore)
            doc-ref (.document db (str "users/" doc-id))
            snapshot (.get doc-ref)]
        (if (.exists snapshot)
          (resp/json-response (.toHashMap snapshot))
          (resp/not-found (json/generate-string {:error "not found"}))))
      (resp/bad-request (json/generate-string {:error "invalid document ID"})))))

Example: Explicit body parsing to prevent smuggling

(ns my-app.middleware
  (:require [ring.middleware.content-length :refer [wrap-content-length]]
            [ring.middleware.transfer-encoding :refer [wrap-transfer-encoding]]))

;; Use only one body parsing strategy; disable conflicting middleware
(def app
  (-> (routes
        (GET "/users/:user-id" [] get-user-handler))
      wrap-content-length
      ;; Do not enable wrap-transfer-encoding if Content-Length is enforced
      ))

Example: Rejecting ambiguous headers

(ns my-app.middleware
  (:require [ring.util.response :as resp]))

(defn reject-ambiguous-headers [handler]
  (fn [request]
    (if (and (get-in request [:headers "content-length"])
             (get-in request [:headers "transfer-encoding"]))
      (resp/response "Ambiguous headers; request rejected")
      (handler request))))

(def app
  (-> (routes
        (GET "/lookup" [] handler))
      reject-ambiguous-headers))

These patterns ensure that Firestore identifiers are handled consistently across frontend and Chi routes, reducing the risk of request interpretation differences that enable smuggling. middleBrick can validate that such controls are in place by checking for proper input validation and header handling, surfacing findings related to BOLA/IDOR and Input Validation with actionable guidance.