Nosql Injection in Fiber with Cockroachdb

NoSQL injection occurs when user-controlled input is used to construct database queries without proper validation or parameterization. In a Fiber application using CockroachDB, this typically arises when query building relies on string concatenation or dynamic filtering derived from request parameters. CockroachDB, while wire-compatible with PostgreSQL, still accepts query structures where untrusted input can alter query logic.

Consider a login endpoint that builds a SQL string from a username parameter:

// Unsafe: string concatenation with user input
username := c.QueryParams().Get("username")
query := fmt.Sprintf("SELECT id, password_hash FROM users WHERE username = '%s'", username)
row := db.QueryRow(query)

If an attacker provides admin' OR '1'='1 as username, the resulting query becomes:

SELECT id, password_hash FROM users WHERE username = 'admin' OR '1'='1'

This bypasses authentication. With CockroachDB, additional risks emerge when using placeholder styles incorrectly. For example, using $1 placeholders with string interpolation defeats parameterization:

// Misuse: injecting into placeholder syntax via string building
field := c.QueryParams().Get("field")
query := fmt.Sprintf("SELECT * FROM users ORDER BY %s $1", field)
rows, err := db.Query(query, sortValue)

Although $1 is parameterized, field is not, allowing injection into the column or ordering context. The scanner’s Input Validation and Property Authorization checks would flag this as an uncontrolled data flow into query construction, and the Inventory Management check would note non-parameterized elements.

Another vector involves dynamic filters in WHERE clauses built via concatenation:

status := c.QueryParams().Get("status")
query := "SELECT id, data FROM records WHERE 1=1" + status // status supplied by caller
rows, err := db.Query(query)

If status contains OR deleted = true, the logical conditions are altered. Because the scan runs unauthenticated, these endpoints are tested as part of the black-box attack surface, detecting query-building patterns that enable injection.

LLM/AI Security checks do not apply here because NoSQL injection in this context is a classical injection issue; however, the scanner’s twelve parallel checks ensure this vector is surfaced under BOLA/IDOR, Input Validation, and Property Authorization categories.

To eliminate NoSQL injection in Fiber with CockroachDB, use parameterized queries for all values and strictly control dynamic identifiers (such as column or table names) through allowlists. CockroachDB supports PostgreSQL-style placeholders ($1, $2, …), and the database/sql driver enforces proper escaping when placeholders are used correctly.

Secure login with parameterized query:

// Safe: parameterized query for values
username := c.QueryParams().Get("username")
query := "SELECT id, password_hash FROM users WHERE username = $1"
row := db.QueryRow(query, username)

For dynamic sorting or column selection, use an allowlist:

// Safe: allowlist for column names
allowed := map[string]string{
    "created_at": "created_at",
    "name":       "name",
    "status":     "status",
}
field, ok := allowed[c.QueryParams().Get("field")]
if !ok {
    // return a 400 error
}
query := fmt.Sprintf("SELECT * FROM users ORDER BY %s", field) // field is vetted
rows, err := db.Query(query)

When building conditional filters, construct the query with placeholders for values and allowlist for identifiers:

// Safe: dynamic filters with parameterized values
base := "SELECT id, data FROM records WHERE 1=1"
var args []interface{}{
    "pending",
}
if status := c.QueryParams().Get("status"); status != "" {
    base += fmt.Sprintf(" AND status = $%d", len(args)+1)
    args = append(args, status)
}
rows, err := db.Query(base, args...)

These patterns ensure that user input never alters query structure. The middleBrick CLI can validate these practices by scanning the unauthenticated endpoints; findings will reference Input Validation and Property Authorization with remediation guidance tied to OWASP API Top 10 and compliance mappings such as PCI-DSS and SOC2.

For continuous assurance, the Pro plan’s continuous monitoring and CI/CD integration via the GitHub Action can fail builds if new endpoints introduce non-parameterized queries, and the Web Dashboard allows tracking these changes over time.