Format String in Express with Cockroachdb

A format string vulnerability arises when user-controlled input is passed directly into a formatting function such as console.log, printf-style functions, or database logging without proper sanitization. In an Express application using CockroachDB, this commonly occurs when constructing SQL strings or log messages with unchecked request parameters. Because CockroachDB uses a PostgreSQL-wire compatible protocol, format strings in logging or error messages can reveal sensitive information or enable injection when combined with improper string interpolation.

Consider an endpoint that builds a SQL query by concatenating user input into a string before sending it to CockroachDB. If the application logs the query using a format string that includes unsanitized input, an attacker can supply format specifiers (e.g., %s, %x, %n) that cause the logging function to read from the stack or write arbitrary values. In a clustered or serverless environment, such logs may be centralized and increase the risk of information leakage. Moreover, if the application uses pg-style parameterization incorrectly—mixing format strings with parameterized queries—developers may inadvertently create a path for injection or exposure of internal state.

The risk is amplified when the application does not validate or sanitize inputs before using them in logging or query construction. For example, an endpoint that accepts an identifier and logs it with a format string like console.log('Fetching record: %s', userInput) is generally safe; however, if the logging mechanism itself uses a C-style function or a templating function that interprets format specifiers, and the attacker can control the format string, they may read memory contents or cause crashes. In the context of CockroachDB, this can lead to unintended query behavior or leakage of connection metadata when error messages are formatted with user data.

To illustrate, an unsafe implementation might concatenate SQL and then log using a vulnerable formatter:

const query = 'SELECT * FROM accounts WHERE id = ' + userSuppliedId;
console.log(query);
client.query(query, (err, res) => { /* ... */ });

If userSuppliedId contains format specifiers and the logging library interprets them, the application may expose internal variables or crash. CockroachDB error messages that include unsanitized input can also reveal schema details when improperly formatted. The key issue is the lack of input validation and the use of unsafe string construction and logging patterns that do not distinguish between data and format directives.

Remediation focuses on strict separation of SQL code and data, avoiding string concatenation for queries, and ensuring logs do not interpret user input as format directives. Use parameterized queries with placeholders and let the CockroachDB driver handle escaping. Never embed user input directly into SQL strings or into log messages that may be processed by format-string-sensitive functions.

Below is a safe Express pattern using the pg client (CockroachDB-compatible) with parameterized queries and safe logging:

const express = require('express');
const { Pool } = require('pg');
const app = express();

const pool = new Pool({
  connectionString: process.env.DATABASE_URL,
});

app.get('/account/:id', async (req, res) => {
  const userId = req.params.id;
  // Safe: use parameterized query, no string interpolation
  const query = 'SELECT * FROM accounts WHERE id = $1';
  const values = [userId];

  try {
    const result = await pool.query(query, values);
    // Safe logging: log a static message with JSON-serialized data, not user input as format string
    console.log('Query executed', { query: 'SELECT * FROM accounts WHERE id = $1', params: values });
    res.json(result.rows);
  } catch (err) {
    // Safe: log error without injecting user input into the message format
    console.error('Database query failed', { error: err.message, stack: err.stack });
    res.status(500).send('Internal server error');
  }
});

app.listen(3000, () => console.log('Server running on port 3000'));

Key practices:

• Always use parameterized queries ($1, $2 placeholders) with the CockroachDB-compatible driver; never concatenate user input into SQL strings.
• Log static messages and include user input only as structured data (e.g., JSON fields) rather than embedding it in format strings.
• Validate and sanitize inputs before use, even when using parameterization, to enforce type and format constraints (e.g., ensure userId is an integer).
• Ensure error messages returned by CockroachDB are not directly exposed to end users in a way that might be interpreted as format strings in downstream logging systems.

These steps mitigate format string risks by eliminating the conditions under which user-controlled data could be interpreted as format directives, while maintaining compatibility with CockroachDB’s SQL semantics in Express applications.