Nosql Injection in Echo Go with Cockroachdb

Nosql Injection occurs when user-controlled input is used to construct queries without proper validation or parameterization, allowing an attacker to alter query logic. In an Echo Go service that uses CockroachDB, this often manifests when query building relies on string concatenation or improperly handled map structures instead of prepared statements or typed ORM methods.

Echo is a minimal, idiomatic Go web framework. When developers build handlers that directly assemble SQL strings—especially with CockroachDB’s PostgreSQL-wire compatibility—dynamic values such as sort fields, filter keys, or JSONB traversal expressions can become injection points. CockroachDB supports standard PostgreSQL syntax and JSON operators, which attackers can exploit by injecting operators or subexpressions into input that influences key selection, JSON path traversal, or conditional logic.

Consider an endpoint that retrieves user profiles with a flexible filter expressed as a JSON key. An unsafe implementation might concatenate user input directly into the SQL string:

filterKey := c.FormValue("filter_key") // attacker-controlled
query := fmt.Sprintf("SELECT id, data->'%s' AS value FROM profiles WHERE id = $1", filterKey)
row := db.QueryRow(query, userID)

If filter_key is supplied as id or data->>'password' || ' OR ''1'='1, the effective query can bypass intended filtering or extract sensitive JSON fields. CockroachDB’s JSON operators (->, ->>, ::jsonb) are compatible with injection patterns common in NoSQL-like manipulation, and the PostgreSQL wire protocol used by CockroachDB does not inherently neutralize these risks when queries are constructed imperatively.

Another vector involves sorting or pagination parameters that dictate column names or direction. If these are interpolated directly, an attacker can inject crafted tokens to influence result ordering or cause information leakage through error messages or timing differences. Because Echo does not enforce a schema on incoming request parameters, developers must explicitly validate and sanitize all inputs that affect query structure.

Middleware that logs requests can inadvertently amplify exposure if structured query arguments are captured without redaction. Additionally, features such as upserts that build dynamic ON CONFLICT clauses using string assembly can be abused to bypass uniqueness constraints or trigger unintended write paths when injection manipulates the conflict specification.

Remediation focuses on strict separation of query structure from data, using parameterized statements and explicit allowlists for schema objects such as column and table names. CockroachDB’s PostgreSQL compatibility means standard database/sql best practices apply, but additional care is needed for JSON operators and dynamic clauses.

For JSON field access, avoid injecting raw key names into operator strings. Instead, validate the key against a known set and use the jsonb_extract_path_text function with placeholders for values only:

allowedKeys := map[string]bool{"email": true, "status": true, "created_at": true}
filterKey := c.FormValue("filter_key")
if !allowedKeys[filterKey] {
    http.Error(c.Response(), "invalid filter", 400)
    return
}
// Safe: key is validated; only data is parameterized via JSON operators
query := "SELECT id, data->>:key AS value FROM profiles WHERE id = $1"
row := db.QueryRow(query, filterKey, userID)

When dynamic sorting is required, define an allowlist of column identifiers and map user input to stable column names:

sortField := c.QueryParam("sort")
order := "asc"
if c.QueryParam("order") == "desc" {
    order = "desc"
}
allowedSort := map[string]string{
    "name":  "name",
    "email": "data->>'email'",
    "ts":    "created_at",
}
col, ok := allowedSort[sortField]
if !ok {
    http.Error(c.Response(), "invalid sort field", 400)
    return
}
query := fmt.Sprintf("SELECT id, %s FROM profiles ORDER BY %s NULLS LAST", col, order)
rows, err := db.Query(query)

For dynamic JSON updates in upserts, prefer constructing the JSONB value explicitly and using jsonb_set with placeholders for data rather than embedding keys in the SQL string:

updateQuery := `
  INSERT INTO profiles (id, data) VALUES ($1, $2::jsonb)
  ON CONFLICT (id) DO UPDATE SET data = jsonb_set(profiles.data, '{email}', $3, true)
`
_, err := db.Exec(updateQuery, userID, `{"initial": true}`, `{"email": $1}`)

Use the middlebrick CLI to validate that no unsafe patterns remain in your handlers:

middlebrick scan https://api.yourservice.com/openapi.json

Integrate the GitHub Action to enforce score thresholds in CI/CD and add the MCP Server to your IDE for inline guidance while editing Go handlers. The Dashboard helps track how remediation affects your security posture over time.