Out Of Bounds Write in Actix with Firestore

An Out Of Bounds Write occurs when a program writes data outside the intended memory boundaries. In an Actix web service that integrates with Google Cloud Firestore, this typically manifests as unchecked user input used to index into arrays, buffers, or structured data that is later synchronized to Firestore documents. Because Firestore stores nested maps and arrays, an attacker can supply array indices or map keys that drive writes beyond expected ranges or into adjacent logical structures, potentially overwriting other entities or fields when the client-side state is later committed to Firestore.

In the Actix runtime, this risk is introduced when request payloads are deserialized into Rust structs without strict bounds validation and then passed to Firestore operations such as set, update, or transactions. For example, if an endpoint accepts a JSON array and uses its elements to index into a Firestore document field that is itself an array, missing length checks can allow an attacker to write to indices that modify unrelated elements or expand the array in unintended ways. Because Firestore does not inherently enforce fixed-size arrays and treats numeric keys in maps as strings, out of bounds writes may silently create new fields or corrupt data structures used by other services.

The combination increases impact: Actix services often process high-throughput requests, and a single malicious payload can propagate corrupted state into Firestore documents that are read by other clients or downstream systems. Common triggers include missing validation on collection indices, unchecked numeric inputs used in map keys, and unsafe deserialization of JSON that maps directly to Firestore-compatible nested objects. These patterns violate secure coding practices for input validation and can lead to data integrity issues that are difficult to detect without runtime security checks such as those provided by scanning tools.

Remediation focuses on strict input validation, explicit bounds enforcement, and defensive handling of Firestore data structures before any write operation. Always validate array indices and map keys against expected ranges and schemas before constructing Firestore update payloads in Actix handlers.

Example: Safe array update with bounds checking

use actix_web::{web, HttpResponse, Result};
use google_cloud_firestore::client::Client;
use serde::{Deserialize, Serialize};

#[derive(Deserialize, Serialize)]
struct UpdateArrayPayload {
    index: usize,
    value: String,
}

async fn update_array_item(
    payload: web::Json,
    client: web::Data<Client>,
) -> Result<HttpResponse> {
    // Enforce strict bounds before interacting with Firestore
    const MAX_ARRAY_SIZE: usize = 100;
    if payload.index >= MAX_ARRAY_SIZE {
        return Ok(HttpResponse::BadRequest().json(serde_json::json!({
            "error": "index_out_of_bounds",
            "message": format!("Index {} exceeds maximum allowed size {}", payload.index, MAX_ARRAY_SIZE)
        })));
    }

    // Safe: index is within bounds, construct a Firestore update path targeting a specific array element
    let doc_ref = client.collection("items").doc("example_doc");
    let update_map = hashmap! {
        format!("ordered_items.{}", payload.index) => payload.value.clone()
    };
    
    // In practice, use the Firestore SDK's update method with a map of field paths to values
    // doc_ref.update(&update_map).await?;
    // For illustration, we print the intended update
    println!("Would update Firestore: {:?}", update_map);

    Ok(HttpResponse::Ok().json(serde_json::json!({
        "status": "success",
        "index": payload.index,
        "value": payload.value
    })))
}

Example: Safe map key validation for Firestore document fields

use actix_web::{web, HttpResponse, Result};
use google_cloud_firestore::client::Client;
use std::collections::HashMap;

async fn update_user_profile(
    user_input: web::Json<HashMap<String, String>>
) -> Result<HttpResponse> {
    // Define allowed keys to prevent injection of unexpected fields
    let allowed_keys = ["display_name", "email", "theme"];
    for key in user_input.keys() {
        if !allowed_keys.contains(&key.as_str()) {
            return Ok(HttpResponse::BadRequest().json(serde_json::json!({
                "error": "invalid_field",
                "message": format!("Field '{}' is not allowed", key)
            })));
        }
    }

    // Construct a Firestore update map only with validated keys
    let doc_ref = client.collection("users").doc("current_user");
    // doc_ref.update(&user_input).await?;
    println!("Would update Firestore with validated fields: {:?}", user_input);

    Ok(HttpResponse::Ok().json(serde_json::json!({
        "status": "validated",
        "fields": user_input.len()
    })))
}

General defensive practices

• Validate all incoming indices and keys against server-side constants before constructing Firestore field paths.
• Use strongly-typed structures and avoid raw deserialization into maps for array-like data unless bounds are explicitly checked.
• Leverage Firestore update semantics carefully: numeric keys in documents should be treated as strings, and operations should explicitly define field paths rather than relying on dynamic index expansion.
• Implement logging and monitoring for rejected requests to detect probing patterns that may indicate Out Of Bounds Write attempts.

By combining Actix middleware validation with disciplined Firestore update patterns, you reduce the risk of corrupted documents and unintended field modifications.