Stack Overflow in Feathersjs with Cockroachdb

FeathersJS is a framework for creating REST and WebSocket APIs rapidly. When FeathersJS services connect to CockroachDB, a distributed SQL database, certain usage patterns can expose unbounded result sets or inefficient queries that amplify the risk of denial-of-service through resource exhaustion. Stack Overflow in this context refers to unbounded data retrieval that overwhelms service memory or thread pools, not a language runtime exception.

Consider a FeathersJS service that defines a find method without query constraints or pagination. If this service proxies directly to a CockroachDB table with many rows, a single request can trigger a large in-memory sort or join on the database side, consuming significant memory and CPU on the database nodes. CockroachDB may return a large result set over the network, and FeathersJS may attempt to materialize all rows in Node.js memory. This combination can lead to process instability or service unavailability, effectively creating a stack overflow condition at the application or protocol layer.

Additionally, complex query shapes involving multiple JOINs, window functions, or large batch operations can cause long-running SQL statements when CockroachDB execution plans are not properly tuned. FeathersJS defaults to returning all results, so without explicit pagination (e.g., $limit), the client can inadvertently trigger resource spikes. These patterns are especially risky when unauthenticated or low-rate-limit protections are not enforced, allowing an attacker to craft requests that maximize query cost.

The interaction with CockroachDB’s wire protocol and FeathersJS’s real-time layer can also exacerbate issues. Streaming large result sets over WebSockets may hold open connections and buffers, increasing memory pressure. Since FeathersJS does not inherently bound result sizes, the database driver can stream many rows, and the application layer may queue them in Node.js event loop buffers, leading to backpressure failures or crashes.

To mitigate Stack Overflow risks when using FeathersJS with CockroachDB, apply pagination, query constraints, and timeouts consistently. Below are concrete, realistic code examples for a FeathersJS service that safely interfaces with CockroachDB using the pg client.

1. Define a FeathersJS service with safe pagination

Configure the service to enforce a maximum page size and validate incoming query parameters. This prevents clients from requesting unbounded result sets.

const { Service } = require('feathersjs');
const { Pool } = require('pg');

const pool = new Pool({
  connectionString: process.env.COCKROACHDB_URI,
  max: 20,
  keepAliveMillis: 30000,
});

class SafeNotesService extends Service {
  async find(params = {}) {
    const { query } = params;
    const page = Math.max(1, Number(query.page) || 1);
    const perPage = Math.min(Number(query.perPage) || 20, 100); // enforce ceiling
    const offset = (page - 1) * perPage;

    const client = await pool.connect();
    try {
      const res = await client.query(
        'SELECT id, title, created_at FROM notes ORDER BY created_at DESC OFFSET $1 LIMIT $2',
        [offset, perPage]
      );
      return {
        total: await this.getTotalCount(client),
        limit: perPage,
        skip: offset,
        data: res.rows,
      };
    } finally {
      client.release();
    }
  }

  async get(id, params = {}) {
    const client = await pool.connect();
    try {
      const res = await client.query(
        'SELECT id, title, content, created_at FROM notes WHERE id = $1',
        [id]
      );
      if (res.rows.length === 0) {
        throw new Error('NOT_FOUND');
      }
      return res.rows[0];
    } finally {
      client.release();
    }
  }

  async getTotalCount(client) {
    const res = await client.query('SELECT COUNT(*) AS total FROM notes');
    return Number(res.rows[0].total);
  }
}

module.exports = function () {
  const app = require('feathersjs')();
  app.use('/notes', new SafeNotesService());
  return app;
};

2. Use query constraints and timeouts to avoid long-running statements

CockroachDB benefits from bounded queries with explicit timeouts. The example below sets a statement timeout per connection and restricts expensive operations via query hints.

const poolWithTimeout = new Pool({
  connectionString: process.env.COCKROACHDB_URI,
  statement_timeout: 5000, // 5 seconds
  max: 10,
});

async function searchNotes(pool, searchTerm) {
  const client = await pool.connect();
  try {
    // Use parameterized queries to prevent injection and ensure plan stability
    const res = await client.query(
      'SELECT id, title FROM notes WHERE title ILIKE $1 LIMIT 50',
      [`%${searchTerm}%`]
    );
    return res.rows;
  } finally {
    client.release();
  }
}

3. Validate and sanitize input to protect against injection and malformed queries

Always validate pagination tokens and filter inputs. Use Joi or similar schemas to reject malformed requests early.

const Joi = require('joi');

const paginationSchema = Joi.object({
  page: Joi.number().integer().min(1).default(1),
  perPage: Joi.number().integer().min(1).max(100).default(20),
  sort: Joi.string().valid('created_at', 'title').default('created_at'),
});

async function validateAndFind(params) {
  const { value, error } = paginationSchema.validate(params.query, { abortEarly: false });
  if (error) {
    throw new Error('VALIDATION_ERROR');
  }
  // proceed with safe value
}

4. Leverage CockroachDB-specific features for safe execution

CockroachDB supports application-name labeling and prepared statements. Use these to improve observability and plan reuse.

const poolLabeled = new Pool({
  connectionString: process.env.COCKROACHDB_URI,
  application_name: 'feathers-service-notes',
});

async function getWithPrepared(pool, userId) {
  const client = await pool.connect();
  try {
    await client.query('PREPARE stmt_get_user (INT) AS SELECT id, email FROM users WHERE id = $1');
    const res = await client.query('EXECUTE stmt_get_user($1)', [userId]);
    return res.rows;
  } finally {
    await client.query('DEALLOCATE PREPARE stmt_get_user');
    client.release();
  }
}

5. Apply rate limiting and circuit breakers at the FeathersJS layer

Although this document focuses on database-side safety, coupling query constraints with service-level rate limits prevents overwhelming CockroachDB under burst traffic. Use Feathers hooks to enforce limits before queries are issued.

const feathersRateLimit = require('feathers-rate-limit');

app.use('/notes', new SafeNotesService(), {
  before: {
    all: [feathersRateLimit({ interval: 60 * 1000, max: 100 })],
  },
});