Zone Transfer in Feathersjs with Cockroachdb

A Zone Transfer in the context of Feathers.js with CockroachDB typically refers to an insecure data exposure pattern where a service endpoint returns more data than intended, often due to missing property-level authorization or unsafe consumption of query results. Feathers.js is a real-time web framework that relies on services defined as JavaScript objects with CRUD methods. When these services query CockroachDB, a distributed SQL database, improper query handling can expose entire database rows, including sensitive fields, to unauthenticated or low-privilege actors.

Consider a Feathers service defined without property-level authorization. If the service queries CockroachDB using a broad find() without filtering fields based on user roles, the response may include sensitive columns such as password_hash, api_key, or personal identifiable information (PII). This becomes a Zone Transfer issue when an attacker can trigger the endpoint (e.g., via a public route) and receive a full zone transfer of data, analogous to DNS zone transfers but applied to data exposure across API boundaries.

The risk is amplified when OpenAPI/Swagger specs are used without runtime validation. If the spec defines a response schema that includes sensitive fields, but the Feathers service does not enforce field-level filtering at runtime, the unauthenticated attack surface includes these over-permissive endpoints. Additionally, if CockroachDB connection strings or credentials are inadvertently logged or exposed through error messages, an attacker may leverage this information to construct further attacks, such as SSRF or injection, against the database layer.

Real-world examples include services that return entire database records without masking or redaction. For instance, a user profile endpoint might return internal identifiers, roles, and tokens if property authorization is not enforced. This aligns with the BOLA/IDOR and Property Authorization checks in middleBrick, which test whether data exposure occurs when unauthorized actors request resources.

Using middleBrick, such misconfigurations are detectable through its 12 parallel security checks. The scanner analyzes the Feathers.js service definitions and CockroachDB interaction patterns, cross-referencing the OpenAPI spec with runtime behavior. It flags findings like missing field-level controls, excessive data exposure, and unsafe consumption, providing severity ratings and remediation guidance mapped to frameworks such as OWASP API Top 10.

To remediate Zone Transfer risks in Feathers.js services backed by CockroachDB, implement property-level field filtering and strict query constraints. Below are concrete code examples demonstrating secure service definitions and database interactions.

1. Define a Feathers service with field selection

Use the feathers-hooks-common package to apply hooks that strip sensitive fields based on user roles. Ensure your service only returns necessary data.

const { iff, isProvider } = require('feathers-hooks-common');
const { remove } = require('feathers-hooks-common');

app.use('/users', {
  async find(params) {
    const result = await originalFind(params);
    // Example: remove sensitive fields for non-admin users
    if (!params.user || !params.user.isAdmin) {
      result.data = result.data.map(user => ({
        id: user.id,
        email: user.email,
        name: user.name
        // Exclude password_hash, api_key, roles, etc.
      }));
    }
    return result;
  }
}, hooks);

2. Use CockroachDB parameterized queries with column filtering

When querying CockroachDB, explicitly select only required columns and use parameterized statements to prevent injection and limit data exposure.

const { Client } = require('pg'); // CockroachDB compatible PostgreSQL driver

const client = new Client({
  connectionString: process.env.COCKROACHDB_URI
});

async function getUserProfile(userId, requesterRole) {
  await client.connect();
  let query = 'SELECT id, email, name FROM users WHERE id = $1';
  if (requesterRole === 'admin') {
    query = 'SELECT id, email, name, role, created_at FROM users WHERE id = $1';
  }
  const res = await client.query(query, [userId]);
  await client.end();
  return res.rows[0];
}

3. Apply role-based property filtering in hooks

Leverage Feathers hooks to dynamically remove fields based on authorization. This ensures that even if the database returns extra columns, they are not transmitted to the client.

const { iff, isProvider, preventChanges } = require('feathers-hooks-common');
const { get } = require('lodash');

const filterFields = (allowedFields) => (context) => {
  if (Array.isArray(context.result.data)) {
    context.result.data = context.result.data.map(item => {
      const filtered = {};
      allowedFields.forEach(field => {
        if (item.hasOwnProperty(field)) {
          filtered[field] = item[field];
        }
      });
      return filtered;
    });
  } else if (context.result.data) {
    const item = context.result.data;
    const filtered = {};
    allowedFields.forEach(field => {
      if (item.hasOwnProperty(field)) {
        filtered[field] = item[field];
      }
    });
    context.result.data = filtered;
  }
  return context;
};

app.use('/profiles', {
  before: {
    all: [iff(isProvider('external'), preventChanges(['id', 'email']))]
  },
  after: {
    all: [filterFields(['id', 'email', 'name'])]
  }
});

4. Validate and sanitize inputs to prevent injection

Even with CockroachDB's strong typing, always validate inputs at the Feathers layer to avoid accidental data leakage through error messages or malformed queries.

const { validator } = require('feathers-validator');

app.use('/search', validator({
  query: {
    name: { isString: true, trim: true, escape: true },
    limit: { isInt: { min: 1, max: 100 } }
  }
}));

These practices reduce the risk of Zone Transfer by ensuring that data exposure is controlled at the service, query, and field levels. middleBrick can validate these implementations by scanning your Feathers endpoints and checking for missing property-level controls, unsafe consumption, and data exposure issues.