Denial Of Service in Chi with Cockroachdb

Chi is a lightweight, idiomatic router for Clojure web applications, and Cockroachdb is a distributed SQL database designed for resilience and strong consistency. When these two are combined in production, Denial of Service (DoS) risks emerge primarily from resource saturation and long-running or unbounded queries that block connection pools and thread resources. Unlike single-node databases, Cockroachdb introduces additional network hops and consensus coordination; if a Chi handler awaits a Cockroachdb transaction without timeouts or context cancellation, an exhausted connection pool or overloaded node can stall request processing for all incoming traffic.

In a black-box scan, middleBrick tests for DoS-related findings under the Rate Limiting and Input Validation checks. For example, an endpoint that executes a heavy aggregation query on a large table without pagination or statement timeouts can cause CPU and I/O spikes on Cockroachdb nodes. Because Cockroachdb relies on Raft consensus, such queries can increase replication latency, leading to elevated latencies or timeouts in Chi handlers. This manifests as service-level degradation that appears as a low rate limit score or as input validation findings when retries or backpressure are not implemented.

A concrete anti-pattern in Chi is binding a route directly to a query that lacks context propagation:

(ns myapp.handler
  (:require [compojure.core :refer [defroutes GET]])
  (:import (java.sql Connection)))

(defn get-users [db-conn]
  (j/query db-conn ["SELECT id, email FROM users WHERE status = ?" "active"]))

(defroutes app-routes
  (GET "/users" req
    (get-users (:db req))))

If the users table grows and the SQL lacks a LIMIT or appropriate indexes, Cockroachdb may perform full table scans, increasing latency and holding connections. Chi may exhaust its available HTTP threads, causing new requests to queue or fail, effectively creating a denial of service for legitimate users. middleBrick’s OpenAPI/Swagger analysis can surface missing pagination or unbounded query patterns when a spec is provided, cross-referencing definitions with runtime behavior to highlight risky endpoints.

Additionally, unauthenticated LLM endpoints—should they be exposed behind Chi routes—can be probed for excessive agency or cost exploitation, indirectly contributing to DoS if backend calls spawn uncontrolled fan-out requests. The presence of such endpoints does not introduce new DoS mechanisms in Cockroachdb itself but can amplify load on backend services that interact with the database.

Remediation focuses on bounding resource usage, ensuring timeouts, and leveraging Cockroachdb features that reduce impact on Chi request lifecycle. Always use context with timeouts in database calls and enforce statement timeouts at the SQL level. Pagination and query constraints reduce the likelihood of long-running scans that could affect cluster stability.

Below is a revised, resilient pattern using next.jdbc with context propagation and a statement timeout:

(ns myapp.handler
  (:require [compojure.core :refer [defroutes GET]]
            [next.jdbc :as jdbc]
            [next.jdbc.result-set :as rs])
  (:import (java.time Duration)))

(defn get-users [ds]
  (let [ctx (-> (jdbc/get-connection ds)
                (.setNetworkTimeout (java.util.concurrent.Executors/newSingleThreadScheduledExecutor) 2000))]
    (jdbc/execute! ds ctx
      [(str "SELECT id, email FROM users WHERE status = ? LIMIT $1 OFFSET $2")
       "active" 50 0]
      {:builder-fn rs/as-unqualified-lower-maps})))

(def db-spec {:dbtype "postgresql"
              :dbname "mydb"
              :host "localhost"
              :port 26257
              :user "myuser"
              :password "mypass"})

(def ds (jdbc/get-datasource db-spec))

(defroutes app-routes
  (GET "/users" req
    (try
      (get-users ds)
      (catch Exception e
        {:status 500 :body "Internal server error"}))))

Key points:

Use a connection pool with bounded size to prevent resource exhaustion.
Set context-level timeouts (e.g., 2–5 seconds) so that queries do not block threads indefinitely.
Apply LIMIT and pagination to prevent large scans; create indexes on filtered columns like status.
Leverage Cockroachdb’s SET statement_timeout at the session or cluster level to enforce hard cutoffs on query execution time.

For continuous protection, the Pro plan’s monitoring can track query latencies and error rates across endpoints, while the GitHub Action can fail builds if a new route lacks timeout or pagination definitions. The MCP Server enables scanning API definitions directly from IDEs, helping developers catch risky patterns before deployment.