Out Of Bounds Read in Feathersjs with Cockroachdb

An Out Of Bounds Read occurs when an application reads memory or data locations outside the intended buffer or record range. In a Feathersjs service that uses Cockroachdb as the backing store, this typically arises from incorrect pagination, missing bounds checks on array indices, or unsafe iteration over query results that map to Cockroachdb rows. Because Feathersjs is a framework-agnostic CRUD layer, it relies on the adapter and query structure to enforce limits; if the implementation does not properly constrain result sets or indexes, it can request rows beyond the allocated result set or iterate past the end of a retrieved array.

When a Feathersjs service issues a query to Cockroachdb—such as a find with pagination parameters like $skip and $limit—an incorrectly calculated offset or limit can cause the application to read past the last valid row. For example, if the client supplies a large $skip value or if the server-side logic computes an offset based on untrusted input, Cockroachdb may return an empty result set or a shifted window. If the Feathersjs service then assumes a fixed-size array and accesses an index that does not exist (e.g., rows[index] where index equals or exceeds the array length), the runtime may read arbitrary memory, leading to information disclosure or instability.

Another scenario involves using array indices from query results as keys to access related data structures without validating that the index is within the bounds of the array returned by Cockroachdb. Suppose a Feathersjs hook retrieves a list of records and later uses an id or positional index supplied by the client to index into an in-memory array. If the index is not checked against the actual length of the array, an out-of-bounds read can occur. This is especially risky when integrating with Cockroachdb features like array or JSONB columns, where nested structures are traversed based on dynamic paths that may not be validated.

Because middleBrick scans the unauthenticated attack surface and tests input validation and property authorization across 12 parallel checks, it can surface these classes of flaw in a Feathersjs + Cockroachdb stack. The scanner does not rely on internal architecture details but instead exercises endpoints with crafted payloads to detect whether out-of-bounds conditions manifest in responses or error patterns. Findings include severity ratings and remediation guidance mapped to frameworks such as OWASP API Top 10, helping teams understand how unsafe indexing or pagination in Feathersjs can expose data via Cockroachdb queries.

To prevent Out Of Bounds Read when using Feathersjs with Cockroachdb, enforce strict bounds on pagination, validate all user-supplied indices, and avoid using raw indices to access arrays derived from query results. Below are concrete code examples that demonstrate secure patterns.

1. Safe pagination with $skip and $limit

Always validate that $skip and $limit are non-negative integers and that the resulting window is within reasonable bounds. Use server-side defaults and caps to avoid extreme offsets that could cause empty results or shifted reads.

// services/items/index.js
const { Service } = require('feathersjs');
const { Sequelize } = require('sequelize');
const { PostgrestAdapter } = require('@feathersjs/adapter-sequelize');

class ItemsService extends Service {
  async find(params) {
    const sequelize = new Sequelize(process.env.DATABASE_URL);
    const { $skip = 0, $limit = 10 } = params.query;

    // Validate inputs
    const skip = Math.max(0, Number.isFinite($skip) ? $skip : 0);
    const limit = Math.max(1, Math.min(100, Number.isFinite($limit) ? $limit : 10));

    // Use Sequelize with Cockroachdb-safe query building
    const rows = await sequelize.query(
      'SELECT * FROM items ORDER BY id LIMIT :limit OFFSET :skip',
      { replacements: { limit, skip }, type: Sequelize.QueryTypes.SELECT }
    );

    // Ensure we do not index beyond the returned length
    return { total: rows.length, data: rows };
  }
}

module.exports = function () {
  const app = this;
  app.use('/items', new ItemsService());
};

2. Validating indices before array access

If your Feathersjs hook or service derives an array from a Cockroachdb query (e.g., a JSONB column containing a list), always check the index against the array length before reading.

// A hook that safely accesses an element from a JSONB array column
const { iff, isProvider } = require('feathers-hooks-common');

function safeArrayAccess() {
  return async context => {
    const { data } = context;
    // Suppose data.numbers is an array from Cockroachdb
    if (Array.isArray(data.numbers)) {
      const requestedIndex = Number(data.index);
      if (Number.isFinite(requestedIndex) && requestedIndex >= 0 && requestedIndex < data.numbers.length) {
        context.result = { value: data.numbers[requestedIndex] };
      } else {
        throw new Error('Index out of bounds');
      }
    }
    return context;
  };
}

// Usage in a service hook
const app = require('feathersjs')();
app.service('compute').hooks({
  after: [iff(isProvider('external'), safeArrayAccess())]
});

3. Using parameterized queries to avoid injection-driven bounds manipulation

Ensure that any dynamic values used in WHERE clauses or OFFSET calculations are passed as parameters rather than concatenated into raw SQL, preventing attackers from crafting inputs that shift read windows.

// Safe parameterized query to Cockroachdb via pg module (used under the hood by many Feathers adapters)
const { Pool } = require('pg');
const pool = new Pool({ connectionString: process.env.DATABASE_URL });

async function getPagedItems(offset, limit) {
  const client = await pool.connect();
  try {
    const res = await client.query(
      'SELECT id, name FROM items ORDER BY id ASC LIMIT $1 OFFSET $2',
      [limit, offset]
    );
    return res.rows;
  } finally {
    client.release();
  }
}

// In a Feathers service
app.use('/paged-items', {
  async find(params) {
    const { $skip = 0, $limit = 10 } = params.query;
    const safeSkip = Math.max(0, parseInt($skip, 10) || 0);
    const safeLimit = Math.max(1, Math.min(50, parseInt($limit, 10) || 10));
    const rows = await getPagedItems(safeSkip, safeLimit);
    return { total: rows.length, data: rows };
  }
});

4. Leverage middleBrick scans to validate remediation

After applying these fixes, use the middleBrick CLI to re-scan endpoints and confirm that input validation and property authorization checks pass. The CLI can be run locally with middlebrick scan <url>, and the GitHub Action can enforce a minimum score before merging. Continuous monitoring in the Pro plan helps detect regressions that could reintroduce out-of-bounds behavior in Feathersjs services backed by Cockroachdb.