Stack Overflow in Chi with Cockroachdb

Chi is a lightweight HTTP routing library for Go, and CockroachDB is a distributed SQL database. When a Chi application streams large result sets or handles unbounded query responses to render paginated or real-time views, the interaction can expose patterns that resemble stack overflow risks even though the database does not have a traditional call stack. In this context, "Stack Overflow" refers to unbounded recursion or deeply nested query joins caused by misconfigured recursive common table expressions (CTEs) or application-level pagination that repeatedly fetches overlapping data without termination guards. Chi’s pattern of composing handlers and middleware can inadvertently propagate these unbounded requests when query parameters are not validated against the capabilities of CockroachDB.

With CockroachDB, recursive CTEs are supported, but if a Chi route constructs a recursive query using user-supplied parameters (e.g., a parent_id that references its own row), an attacker can craft input that causes the database to perform deep recursive scans. Because Chi encourages clean URL patterns and parameter parsing, developers may pass unchecked path or query parameters directly into SQL, enabling paths such as /items/{id}/children where id maps to a recursive CTE anchor that loops indefinitely across distributed nodes. CockroachDB will attempt to fulfill the recursion, consuming memory and processing resources on the cluster, and the Chi server may keep many open HTTP connections waiting for response, creating denial-of-service conditions that mirror stack exhaustion.

Additionally, if the application uses Chi’s route groups to nest middleware for authentication and pagination, and the pagination logic issues iterative queries to CockroachDB without cursor-based limits, the combined behavior can lead to excessive in-flight queries and large result buffering. CockroachDB’s distributed nature means each node may return partial results, and if the Chi handler aggregates these without backpressure, memory usage on the service can grow rapidly. This is not a classic software stack overflow but a resource exhaustion pattern that arises from the interplay: Chi’s flexible routing encouraging complex parameter-driven queries and CockroachDB’s recursive capabilities enabling deep or wide traversals when input constraints are absent.

Real-world example: a route GET /categories/{id}/tree in Chi decodes id as an integer but does not verify acyclic constraints. The handler builds a recursive CTE in CockroachDB like WITH RECURSIVE t(id, path) AS (SELECT id, ARRAY[id] FROM categories WHERE id = $1 UNION ALL SELECT c.id, t.path || c.id FROM categories c, t WHERE c.parent_id = t.id AND NOT c.id = ANY(t.path)) SELECT * FROM t;. If the data contains a cycle (e.g., a row whose parent eventually points back to an ancestor), CockroachDB traverses deeply until memory or statement timeout intervenes. Chi’s middleware may also log each recursion step for debugging, increasing overhead. The combination therefore creates a vulnerability where unbounded recursion in SQL, triggered by flexible routing, leads to resource exhaustion that resembles stack overflow symptoms.

To mitigate recursion-related resource exhaustion when using Chi with CockroachDB, validate and constrain recursive queries at the application and database level. Use integer ID validation in Chi to ensure path parameters are within expected ranges, and enforce a maximum recursion depth in the SQL CTE. Below is a secure Chi route example that limits depth and checks for cycles before issuing the query.

// Chi route with safe recursion guard
package main

import (
    "context"
    "fmt"
    "net/http"
    "strconv"

    "github.com/go-chi/chi/v5"
    "github.com/lib/pq"
    "database/sql"
    _ "github.com/cockroachdb/libsqlc-go/libsqlc"
)

func categoriesHandler(db *sql.DB) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        idStr := chi.URLParam(r, "id")
        rawID, err := strconv.Atoi(idStr)
        if err != nil || rawID < 1 {
            http.Error(w, `{"error": "invalid category id"}`, http.StatusBadRequest)
            return
        }

        const maxDepth = 100
        query := `
WITH RECURSIVE t(id, path, depth) AS (
    SELECT id, ARRAY[id], 0
    FROM categories
    WHERE id = $1
    UNION ALL
    SELECT c.id, t.path || c.id, t.depth + 1
    FROM categories c, t
    WHERE c.parent_id = t.id
      AND NOT c.id = ANY(t.path)
      AND t.depth < $2
)
SELECT id, path, depth FROM t;`

        rows, err := db.QueryContext(r.Context(), query, rawID, maxDepth)
        if err != nil {
            http.Error(w, `{"error": "query failed"}`, http.StatusInternalServerError)
            return
        }
        defer rows.Close()

        var results []map[string]interface{}
        for rows.Next() {
            var id int
            var path pq.Int64Array
            var depth int
            if err := rows.Scan(&id, &path, &depth); err != nil {
                http.Error(w, `{"error": "scan failed"}`, http.StatusInternalServerError)
                return
            }
            results = append(results, map[string]interface{}{
                "id":    id,
                "path":  path,
                "depth": depth,
            })
        }
        // Output results as JSON (omitted for brevity)
        fmt.Fprintf(w, `{"data": %v}`, results)
    }
}

func main() {
    db, err := sql.Open("postgres", "postgresql://...")
    if err != nil {
        panic(err)
    }
    r := chi.NewRouter()
    r.Get("/categories/{id}/tree", categoriesHandler(db))
    http.ListenAndServe(":8080", r)
}

The key fixes are: (1) strict integer parsing and range checks on the Chi URL parameter, (2) a maxDepth constant limiting recursion to a safe value (e.g., 100), passed as a query parameter to CockroachDB, and (3) cycle prevention via NOT c.id = ANY(t.path) to avoid infinite loops. This prevents unbounded resource consumption while still allowing hierarchical queries.

For continuous protection, use the middleBrick CLI to scan your Chi endpoints and verify that recursive endpoints do not accept unbounded depth. Run middlebrick scan <your-chi-api-url> to get a security risk score and findings that may highlight unchecked recursive parameters. If you integrate middleBrick into your workflow, the GitHub Action can fail builds when a Chi API’s risk score drops below your chosen threshold, helping prevent regressions that could enable Stack Overflow-style exhaustion against CockroachDB.