Null Pointer Dereference in Adonisjs with Cockroachdb

A null pointer dereference in AdonisJS when using CockroachDB typically occurs when application code assumes a database query result is an object or record but receives null or undefined. Because CockroachDB is compatible with PostgreSQL protocol, AdonisJS often interacts with it via the pg-based generic SQL client. If a query such as User.query().where('id', userId).first() finds no matching row, first() resolves to null. Accessing properties on that null value (e.g., user.email) throws a null pointer dereference, which may surface as an unhandled exception in the HTTP layer, potentially causing process crashes or information leakage in logs.

This risk is heightened when AdonisJS routes do not validate the presence of required route parameters before constructing queries. For example, using a dynamic segment like /users/:id without verifying that id is a valid integer or that a corresponding row exists can lead to unsafe assumptions. Additionally, CockroachDB’s distributed nature means network partitions or transient errors can result in incomplete result sets or unexpected null returns, which AdonisJS code must handle explicitly. If error handling middleware is not configured to catch null pointer dereferences, the framework may return 500 responses that expose stack traces, aiding an attacker in mapping the application structure.

An unauthenticated attacker could probe endpoints with crafted IDs (e.g., negative numbers, non-numeric strings, or extremely large values) to trigger such dereferences consistently. This behavior may be uncovered during the Input Validation and BOLA/IDOR checks run by middleBrick, which correlate runtime findings with OpenAPI/Swagger specs (including $ref resolution) to highlight endpoints where missing object references are not properly guarded. Without explicit null checks, the application’s attack surface expands, particularly when sensitive data access patterns depend on object properties that are assumed non-null.

Defensive programming and explicit query contracts are essential when working with CockroachDB in AdonisJS. Always treat first(), find(), or similar finders as possibly returning null. Use conditional logic or schema-level constraints to ensure safe access patterns. Below are concrete, working examples for AdonisJS v6+ using the Database module with CockroachDB.

1. Safe retrieval with null guard

import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'
import User from 'App/Models/User'

export default class UsersController {
  public async show({ params, response }: HttpContextContract) {
    const user = await User.query()
      .where('id', params.id)
      .preload('posts')
      .first()

    if (!user) {
      return response.notFound({ message: 'User not found' })
    }

    return user
  }
}

2. Using transactions with existence checks

import Database from '@ioc:Adonis/Lucid/Database'

export async function getUserWithOrders(userId: string) {
  const result = await Database.transaction(async (trx) => {
    const user = await User.query()
      .usingTransaction(trx)
      .where('id', userId)
      .first()

    if (!user) {
      throw new Error('USER_NOT_FOUND')
    }

    const orders = await user.related('orders').query().exec()
    return { user, orders }
  })
  return result
}

3. Schema-level constraints and casts

Ensure your database schema on CockroachDB enforces non-nullable columns where appropriate, and use AdonisJS schema casts to avoid undefined fields:

import { DateTime } from 'luxon'

export default class User {
  public id: number
  public email: string
  public createdAt: DateTime
  public updatedAt: DateTime

  public static boot() {
    this.addHook('beforeSave', async (userInstance) => {
      if (!userInstance.email) {
        throw new Error('EMAIL_REQUIRED')
      }
    })
  }

  public static castFields = {
    createdAt: (value) => DateTime.fromISO(value as string),
    updatedAt: (value) => DateTime.fromISO(value as string),
  }
}

4. Parameter validation before querying

import { schema } from '@ioc:Adonis/Core/Validator'

const userQuerySchema = schema.create({
  id: schema.number([rules.positive(), rules.unsigned()]),
})

export default class UsersController {
  public async show({ request, response }: HttpContextContract) {
    const validated = await request.validate({ schema: userQuerySchema })
    const user = await User.find(validated.id)

    if (!user) {
      return response.notFound({ message: 'User not found' })
    }

    return user
  }
}

5. Middleware-based existence checks for routes

Use route-level middleware or implicit bindings to centralize existence checks:

import User from 'App/Models/User'
import Route from '@ioc:Adonis/Core/Route'

Route.group(() => {
  Route.get('/users/:id', async ({ params, response }) => {
    const user = await User.findOrFail(params.id)
    return user
  }).middleware('ensureUserExists')
}).prefix('api/v1')