Stack Overflow in Fiber with Api Keys

A Stack Overflow in a Fiber-based API often occurs when recursive structures or uncontrolled data expansion are introduced while processing API keys. For example, if an API key is used to index nested objects or to dynamically build responses without depth limits, a crafted key containing deeply nested JSON or repeated references can cause the JSON parser or reflection logic to exceed stack capacity. This is especially relevant when API keys are embedded in request paths, headers, or query parameters that are then reflected into JSON bodies or logs without canonicalization.

Consider an endpoint that retrieves user preferences keyed by API key and returns a nested structure:

// Risky: key used to index into a nested map without validation
const preferences = {
  'ak_live_abc123': {
    theme: 'dark',
    nested: {
      previous: {
        older: {
          // arbitrarily deep nesting can overflow the stack
        }
      }
    }
  }
};

If an attacker supplies an API key that maps to a deeply nested object (or if the key is used to traverse a graph), the server may crash or exhibit erratic behavior due to stack exhaustion. In a black-box scan, middleBrick tests for BOLA/IDOR and Input Validation across the unauthenticated attack surface; if the endpoint reflects the API key into recursive structures or allows path traversal via the key, it can surface Stack Overflow conditions alongside authorization issues.

Additionally, if OpenAPI specs define parameters that accept API keys but do not constrain their structure or length, runtime processing may construct recursive objects inadvertently. For instance, using a key to build a response that re-includes the key in child objects without depth guards can create circular references when serialized, leading to stack overflow during JSON.stringify. middleBrick’s LLM/AI Security checks also flag patterns where keys influence prompt or data construction that could lead to excessive recursion in downstream agents.

In summary, the combination of Fiber routing that uses API keys for object traversal, insufficient input validation, and recursive data building creates a stack overflow risk. The scanner validates input validation and property authorization to detect whether API keys are used in ways that can trigger deep recursion or uncontrolled nesting.

Remediation focuses on validating and sanitizing API keys before they are used to index data or build responses. Avoid using raw API keys as object keys or traversal paths. Instead, map them to bounded, controlled structures and enforce strict schema validation.

1. Use a Map with bounded entries and reject unexpected key formats early:

import { Router } from 'express';
import { body, param, validationResult } from 'express-validator';

const router = Router();

// Validate API key format and length before use
router.get('/prefs/:key',
  param('key').isString().isLength({ max: 64 }).withMessage('key too long'),
  (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    const key = req.params.key;
    // Use a controlled map instead of dynamic nesting
    const safePreferences = getUserPreferences(key);
    res.json(safePreferences);
  }
);

2. If you must deserialize user-supplied structures, set depth limits and avoid recursive parsing of keys:

import { parse } from 'json5'; // or a safe parser

function safeParseWithDepth(value: string, maxDepth = 4) {
  let depth = 0;
  const reviver = (key: string, val: any) => {
    if (val && typeof val === 'object' && depth++ > maxDepth) {
      throw new Error('Nesting depth exceeded');
    }
    return val;
  };
  return parse(value, reviver);
}

3. Prefer constant-time lookups and avoid key-derived paths to prevent path traversal or recursion:

// Good: key used as a simple lookup in a bounded map
const userPrefsMap = new Map>();
userPrefsMap.set('ak_live_abc123', { theme: 'dark' });

app.get('/prefs', (req, res) => {
  const apiKey = req.headers['x-api-key'] as string | undefined;
  if (!apiKey || !/^[a-z0-9_]{8,64}$/i.test(apiKey)) {
    return res.status(400).json({ error: 'invalid key' });
  }
  const prefs = userPrefsMap.get(apiKey);
  res.json(prefs || {});
});

4. Apply property authorization checks so that API keys do not inadvertently expose or traverse unauthorized nested resources:

// After lookup, ensure the key has rights to the returned subset
const authorized = authorizeByKey(req.params.key, requestedResource);
if (!authorized) {
  return res.status(403).json({ error: 'forbidden' });
}

By combining format validation, depth limits, bounded maps, and property authorization, you mitigate Stack Overflow risks and reduce BOLA/IDOR exposure when API keys are involved. middleBrick’s CLI can be used to verify these fixes: scan from terminal with middlebrick scan <url> to confirm that input validation and property authorization findings are resolved.