Stack Overflow in Chi with Dynamodb

When a Chi service in Clojure exposes an endpoint that queries DynamoDB, a stack overflow can occur if recursive or deeply nested data structures are returned to the client and then re-submitted as input. In this combination, the risk typically maps to BOLA/IDOR and Input Validation checks in middleBrick scans. For example, an endpoint that accepts a `:id` path parameter and uses it to fetch an item may return a nested map containing references to other items. If the client echoes that structure back without validation, recursive references can cause the runtime call stack to grow beyond safe limits during serialization or traversal, leading to a stack overflow before the response is sent.

DynamoDB responses in Chi are often deserialized into Clojure data structures. If the application logic does not enforce depth limits or sanitize circular references, a malicious actor can craft a request that triggers deep recursion in the processing pipeline. This is especially relevant when using libraries that traverse or print data structures for logging or error reporting. A scanned endpoint might show that unchecked user-controlled fields are reflected in responses, enabling an attacker to induce a stack overflow by submitting deeply nested JSON that maps to recursive Clojure data after deserialization.

middleBrick detects this pattern by analyzing the OpenAPI spec for DynamoDB-integrated endpoints and correlating runtime findings from the Input Validation and BOLA/IDOR checks. The scanner identifies endpoints where response schemas include oneOf/anyOf or deeply nested objects without explicit depth constraints and flags them as high-risk for stack overflow when combined with recursive client-side processing. Findings include severity, detail, and remediation guidance mapped to OWASP API Top 10 and relevant compliance frameworks.

To prevent stack overflow when working with DynamoDB results in Chi, enforce depth limits during deserialization and avoid recursive data traversal in handlers. Below are concrete code examples using the AWS SDK for Java v2 with the DynamoDB client in a Chi application.

(ns myapp.api
  (:require [cheshire.core :as json]
            [com.amazonaws.services.dynamodbv2.AmazonDynamoDB :as dd]
            [com.amazonaws.services.dynamodbv2.document.spec.GetItemSpec :as get-spec]
            [com.amazonaws.services.dynamodbv2.document :as doc]
            [com.amazonaws.services.dynamodbv2.model.AttributeValue :as attr]
            [ring.util.response :refer [response]]))

(defn safe-get-item
  "Fetches an item by key and limits nested depth to avoid stack overflow."
  [^dd/AmazonDynamoDB client table-name key]
  (let [spec (doto (GetItemSpec.)
              (.withPrimaryKey "PK" (attr. (:pk key))
                               "SK" (attr. (:sk key)))
              .withConsistentRead true)
        item (.getItem (doc/Table. client table-name) spec)
        data (.asMap item)]
    (if (seq data)
      (assoc (json/parse-string (json/generate-string data) true)
             :safe true)
      {})))

(defn handler [request]
  (let [pk (get-in request [:params :pk])
        sk (get-in request [:params :sk])]
    (if (and (string? pk) (string? sk) (<= (count pk) 255) (<= (count sk) 255))
      (try
        (let [client (-> dd/AmazonDynamoDBClientBuilder/standard
                         .build)
              result (safe-get-item client "MyTable" {:pk pk :sk sk})]
          (response result))
        (catch Exception e
          {:status 500
           :body (str "Error: " (.getMessage e))}))
      {:status 400
       :body "Invalid key length"})))

Key remediation steps:

• Validate and constrain all user-supplied identifiers (e.g., PK/SK length) before using them in DynamoDB requests.
• Use a JSON library that supports depth limits during parsing (e.g., Cheshire with `:max-depth`) or manually inspect nested maps before further processing.
• Avoid recursive functions that traverse nested data; prefer iterative traversal or set a maximum depth when walking structures.
• Instrument logging to redact or truncate deeply nested fields to prevent accidental recursion in error paths.

middleBrick’s Pro plan supports continuous monitoring for endpoints interacting with DynamoDB, integrating with CI/CD via the GitHub Action to fail builds if a scan detects risky patterns like unbounded nesting or missing validation. The MCP Server enables scanning these endpoints directly from your IDE, providing findings with remediation guidance before deployment.