Injection Flaws in Chi with Mongodb

Chi is a functional, lightweight routing library for the Crystal programming language. When building HTTP APIs with Chi, developers often compose handlers that accept user input and forward it to a database such as Mongodb. Injection flaws arise when that input is used to construct database queries without proper validation, serialization, or type conversion, allowing an attacker to influence query logic. In Chi, this commonly occurs in route parameters, JSON payloads, or query strings that are deserialized and passed into Mongodb driver operations.

Mongodb query languages are expressive and type-aware, but they do not automatically protect against injection when application code builds filter documents dynamically using unchecked strings or numeric values. For example, concatenating user-controlled values into a filter document or using $where, $eval, or other server-side JavaScript features can lead to injection. Chi’s pattern-matching and parameter extraction can inadvertently forward attacker-controlled values into these constructions if the developer does not explicitly validate and sanitize inputs.

Consider a typical Chi handler that retrieves a user record by email:

app.get("/users/:email") do |env|
  email = env.params.url["email"] of String
  users = Mongo.find("users", {"email" => email})
  env.response.print users.to_json
end

At first glance this appears safe, but if the Mongodb driver or surrounding code builds the filter using string interpolation or dynamic keys, an email like "[email protected] could break the document structure. More critically, if the handler builds a filter using unchecked JSON input and operator-like keys such as {"$ne" => ""}, an attacker can manipulate the query logic. Chi does not inherently sanitize these values; it is the developer’s responsibility to ensure that constructed filter documents are free of unexpected operators or script-like expressions.

Another risk vector in Chi applications is the use of external specifications such as OpenAPI/Swagger. If the spec defines parameters that map directly to Mongodb filter fields without strict validation, runtime findings may reveal that user input reaches the database in an unexpected form. middleBrick’s OpenAPI analysis (with full $ref resolution) combined with its runtime checks can surface places where unauthenticated endpoints accept input that can alter query behavior, highlighting injection risks before deployment.

LLM/AI Security checks are particularly valuable in this context. middleBrick actively probes endpoints for prompt injection and output leakage, and it scans LLM responses for API keys or executable code that may be exfiltrated via injection-prone endpoints. For Chi services that integrate with AI models, this helps identify paths where user-controlled data could influence model prompts or tool calls.

In summary, injection flaws in Chi with Mongodb stem from dynamic query construction using untrusted input, misuse of operators, and insufficient validation at the boundary between Chi handlers and database operations. The framework does not automatically prevent these issues; mitigation requires disciplined input handling, strict schema validation, and leveraging tools that detect and report such findings.

Remediation focuses on ensuring that user input never directly shapes the structure of Mongodb query documents. Use static, pre-defined filters, validate and convert all inputs, and avoid operators that can be influenced by attacker data. The following patterns demonstrate secure approaches in Chi.

1. Use static filters with strict type conversion

Always parse and convert inputs to the expected types before building queries. Avoid passing raw strings into filter documents.

app.get("/users/:email") do |env|
  email = env.params.url["email"] of String
  # Validate email format before use
  if email =~ /^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$/
    users = Mongo.find("users", {"email" => email})
    env.response.print users.to_json
  else
    env.response.status_code = 400
    env.response.print {"error" => "invalid email"}.to_json
  end
end

2. Avoid dynamic keys and operator injection

Do not construct filter documents by merging user input into keys or values that resemble operators. Prefer explicit field selection.

def build_user_filter(params : Hash(String, String)) : Hash(String, String)
  filter = {} of String => String
  if username = params["username"]?
    filter["username"] = username
  end
  if status = params["status"]?
    # Ensure status is one of the allowed values to prevent injection via operator-like values
    allowed = Set(String).new(["active", "inactive", "suspended"])
    if allowed.includes?(status)
      filter["status"] = status
    end
  end
  filter
end

app.get("/users") do |env|
  filter = build_user_filter(env.params.query)
  users = Mongo.find("users", filter)
  env.response.print users.to_json
end

3. Do not use server-side JavaScript evaluation

Avoid features such as $where or $eval with any user-controlled data. If server-side logic is required, perform it in the application layer with strict input checks.

# Unsafe — do not build $where from user input
# Mongo.command({"$where" => "function() { return this.email === '#{email}' }"})

# Safe — perform filtering in Crystal after retrieving a bounded dataset
users = Mongo.find("users", {} of String => String)
matching = users.select { |u| u["email"].as_s == email }
env.response.print matching.to_json

4. Leverage schema validation and middleware

Use middleware to validate request shapes before handlers execute. This reduces the chance that malformed or malicious payloads reach database code.

app = Chi::Router.new do |r|
  r.post("/users") do |env|
    body = env.request.body.try(&.gets_to_end)
    parsed = JSON.parse(body) rescue nil
    if parsed.is_a?(Hash) && email = parsed["email"].try(&.as_s)
      if email =~ /^[^@\s]+@[^@\s]+\.[^@\s]+$/
        users = Mongo.find("users", {"email" => email})
        env.response.print users.to_json
      else
        env.response.status_code = 400
        env.response.print {"error" => "invalid email"}.to_json
      end
    else
      env.response.status_code = 400
      env.response.print {"error"}.to_json
    end
  end
end

These patterns ensure that input is strictly controlled, operators are not user-driven, and queries remain predictable. When combined with continuous scanning via the Pro plan’s GitHub Action and dashboard, teams can detect regressions that reintroduce injection risks after changes to Chi routes or Mongodb interactions.