Use After Free in Adonisjs with Firestore

Use After Free occurs when memory is deallocated but references to it remain and are subsequently accessed. In a Node.js environment such as AdonisJS, this typically surfaces through retained references to objects, closures, or async callbacks that keep pointers alive after they should be considered invalid. When integrating with Google Cloud Firestore, the interaction between AdonisJS request handling, Firestore client instances, and Firestore document snapshots can create conditions where stale references are used to access data or trigger operations.

Consider an AdonisJS service that creates a Firestore client per request or reuses a shared client across requests. If a document snapshot is captured in a closure and the request context is recycled or the snapshot is retained beyond the lifecycle of the originating query, the snapshot may refer to internal buffers that have been released. An attacker can exploit this by manipulating request timing, concurrency, or error handling to cause the application to act on a dangling reference — for example, by triggering a re-query or a retry that reuses a stale snapshot.

In Firestore-specific scenarios, this can manifest when you store a snapshot or a document reference in an in-memory cache, session, or event emitter and later use it after the underlying gRPC stream or client state has been closed. For instance, if an unsubscribe callback or a listener is not properly cleaned up, and the snapshot is later used to read or write data, the operation may proceed on invalid memory. This can lead to unpredictable behavior, information disclosure, or attempts to write malformed data based on cached state.

AdonisJS middleware and route handlers that do not explicitly clear Firestore listeners or release references to snapshots between requests increase the risk. A common pattern is attaching a snapshot to the request context for later use in hooks or policies. If the request context is reused or the snapshot is retained after the response is sent, subsequent operations may inadvertently use freed memory. The Firestore Node.js SDK manages its own internal buffers for streaming results; if those buffers are released while a reference still exists in userland code, the stage is set for Use After Free.

Real-world attack patterns include forcing errors in authentication or network layers to cause early exit paths that skip cleanup, or leveraging high concurrency to race between request completion and snapshot disposal. The combination of AdonisJS’s lifecycle hooks and Firestore’s asynchronous streaming amplifies the risk if developers assume that snapshots are stable across asynchronous boundaries without explicit validation or scoping.

To mitigate Use After Free when using Firestore in AdonisJS, ensure that Firestore clients, snapshots, and listeners are explicitly managed and released within the request lifecycle. Avoid storing snapshots or document references beyond the scope of a single request, and always clean up asynchronous resources in finally blocks or lifecycle hooks.

Below are concrete, working examples for AdonisJS that demonstrate safe patterns:

import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'
import { Firestore, doc, getDoc, onSnapshot } from 'firebase/firestore'
import { db } from '@ioc:Adonis/Addons/Firestore'

export default class DocumentsController {
  public async show({ params, request, response }: HttpContextContract) {
    const docRef = doc(db, 'items', params.id)
    let snapshot = null

    try {
      snapshot = await getDoc(docRef)
      if (!snapshot.exists()) {
        return response.notFound({ error: 'Document not found' })
      }
      // Use snapshot data immediately and do not store it beyond this scope
      const data = snapshot.data()
      return response.ok(data)
    } catch (error) {
      console.error('Firestore read error:', error)
      return response.internalServerError({ error: 'Failed to load document' })
    } finally {
      // Ensure no lingering references; in this case, snapshot is a plain object
      // but if using listeners, they must be unsubscribed here
    }
  }

  public async subscribe({ params, response }: HttpContextContract) {
    const docRef = doc(db, 'items', params.id)
    let unsubscribe = null

    try {
      unsubscribe = onSnapshot(docRef, (snapshot) => {
        if (!snapshot.exists) {
          console.warn('Document no longer available')
          return
        }
        // Process snapshot data within the callback scope
        console.log('Current data:', snapshot.data())
      }, (error) => {
        console.error('Listener error:', error)
      })

      // Simulate request-scoped subscription; in a real app, you would tie this
      // to a WebSocket or SSE lifecycle and call unsubscribe on disconnect
      await new Promise((resolve) => setTimeout(resolve, 10000))
    } catch (error) {
      console.error('Subscription setup failed:', error)
    } finally {
      if (unsubscribe) {
        unsubscribe()
      }
    }
  }
}

Key remediation practices:

• Do not cache Firestore snapshots or document references in global or session state.
• Always unsubscribe from listeners in a finally block or via middleware cleanup hooks in AdonisJS.
• Use request-scoped Firestore clients or ensure client instances are properly closed when the application shuts down.
• Validate snapshot existence before accessing data, and handle null or undefined cases explicitly.
• Leverage AdonisJS middleware to clean up resources after the response is sent, ensuring no dangling references persist.

These patterns reduce the chance of Use After Free by ensuring that Firestore resources are tied strictly to the request lifecycle and are explicitly released when no longer needed.