Server Side Template Injection in Fiber with Cockroachdb

Server Side Template Injection (SSTI) occurs when an attacker can inject template directives that are subsequently evaluated by the server-side templating engine. In a Fiber application using Go templates with data derived from Cockroachdb, the risk arises when user-controlled input is merged into templates or passed into database queries that influence what the template engine executes.

Consider a scenario where an endpoint accepts a template_name parameter to select a Go *template parsed from disk or a registry, and also accepts an id to fetch a record from Cockroachdb. If the application uses user input to dynamically select template files or to construct queries without strict allowlisting, an attacker may supply a crafted value that changes which template is loaded or which fields are queried. Even without direct code execution in the template, injection can lead to unintended data access or information disclosure when sensitive fields retrieved from Cockroachdb are exposed through the template context.

For example, if the application dynamically builds SQL for Cockroachdb using string concatenation based on user input, and then passes the results into a template, an attacker might manipulate the query to retrieve additional columns or rows. If the template then iterates over these results and exposes fields such as internal identifiers, tokens, or configuration flags, the combination of SSTI-prone dynamic template selection and broad Cockroachdb data exposure increases the impact. The templating engine may also expose internal functions or variables; if the application registers helper functions that interact with Cockroachdb, an attacker could invoke those functions through injected template code.

Because middleBrick tests unauthenticated attack surfaces, it can detect patterns where user input influences template selection or where data from Cockroachdb is reflected in template output without proper escaping. The scanner checks for reflected injection points and excessive data exposure, highlighting risks where sensitive columns from Cockroachdb might be surfaced through templates.

Remediation focuses on strict input validation, allowlisting, and safe data handling between Cockroachdb and the template layer. Avoid dynamic template file selection based on user input; if dynamic templates are necessary, use a predefined map of allowed names to parsed templates.

When querying Cockroachdb, use parameterized statements to prevent injection at the database level and ensure only intended data is retrieved. Never inject user input directly into SQL strings. Retrieve only the fields you need and avoid exposing internal columns via broad selects.

In the template, always use proper escaping functions provided by the Go template engine. If you must inject dynamic data structures, define explicit view models that expose only safe fields and avoid registering custom functions that perform further database operations unless absolutely necessary and tightly controlled.

Example of a safe Fiber handler using Cockroachdb with parameterized queries and a restricted template selection:

package main

import (
	"context"
	"html/template"
	"net/http"

	"github.com/gofiber/fiber/v2"
	"github.com/jackc/pgx/v5/pgxpool"
)

// allowedTemplates maps template names to parsed *template.Template.
// This avoids dynamic file inclusion based on user input.
var allowedTemplates = map[string]*template.Template{
	"profile": template.Must(template.ParseFiles("templates/profile.html")),
	"status":  template.Must(template.ParseFiles("templates/status.html")),
}

func main() {
	app := fiber.New()

	pool, err := pgxpool.New(context.Background(), "postgres://user:pass@localhost:26257/mydb?sslmode=disable")
	if err != nil {
		panic(err)
	}
	defer pool.Close()

	app.Get("/user/:name", func(c *fiber.Ctx) error {
		// Strict allowlist for template selection
		tmpl, ok := allowedTemplates[c.Params("template")]
		if !ok {
			return c.Status(http.StatusBadRequest).SendString("invalid template")
		}

		// Safe: parameterized query to Cockroachdb
		var user struct {
			Username template.HTML // explicitly typed for escaping
			Status   string
		}
		err := pool.QueryRow(c.Context(), "SELECT username, status FROM users WHERE username = $1 LIMIT 1", c.Params("name")).Scan(&user.Username, &user.Status)
		if err != nil {
			return c.Status(http.StatusInternalServerError).SendString("db error")
		}

		// Render with the selected template; username is escaped by template.HTML type
		return tmpl.Execute(c.Response().Writer, user)
	})

	app.Listen(":3000")
}

If you use the CLI, you can scan from terminal with middlebrick scan <url> to validate that these patterns reduce SSTI risk. The GitHub Action can add API security checks to your CI/CD pipeline, failing builds if risk scores drop below your threshold, while the MCP Server lets you scan APIs directly from your AI coding assistant within the IDE.