Stack Overflow in Fiber with Dynamodb

A Stack Overflow in a Fiber application that uses DynamoDB typically arises from unbounded recursion or deeply nested structures when serializing or deserializing data, often triggered through user-controlled input that maps to DynamoDB attribute values. When a Fiber route accepts JSON payloads and directly constructs DynamoDB expression attribute values or condition expressions, an attacker can supply deeply nested objects or arrays that cause the application’s JSON parser or the SDK’s expression builder to recurse excessively.

For example, consider a handler that builds a DynamoDB UpdateItem input using a user-supplied map intended for SET updates. If the map contains nested objects that mirror DynamoDB’s attribute value structure (e.g., nested maps under a top-level key), and the application recursively traverses these structures to validate or transform them, an attacker can send a payload with thousands of levels of nesting. This consumes stack space rapidly and leads to a stack overflow crash, resulting in denial of service.

The combination of Fiber’s lightweight stack management and the DynamoDB SDK’s recursive handling of complex attribute structures amplifies the risk. Unlike traditional SQL ORMs, DynamoDB’s attribute format encourages nested maps, which may be processed recursively in application code. If input validation does not enforce depth limits or reject overly nested structures, the attack surface is effectively the user-supplied JSON that maps 1:1 to DynamoDB expression values.

In the context of middleBrick’s 12 security checks, this scenario maps to Input Validation and Unsafe Consumption findings. The scanner would flag missing depth constraints on nested objects, missing size limits on arrays, and absence of schema guards on deserialized payloads that directly influence DynamoDB expression construction.

An example of a vulnerable route:

app.Put("/update/:id", func(c *fiber.Ctx) error {
    var input map[string]interface{}
    if err := c.BodyParser(&input); err != nil {
        return c.Status(fiber.StatusBadRequest).SendString("invalid body")
    }
    // input may contain deeply nested maps that will be used in DynamoDB expression attribute values
    updateInput := &dynamodb.UpdateItemInput{
        TableName: aws.String("Items"),
        Key: map[string]*dynamodb.AttributeValue{
            "id": {S: aws.String(c.Params("id"))},
        },
        UpdateExpression: aws.String("SET #data = :val"),
        ExpressionAttributeNames: map[string]*string{
            "#data": aws.String("data"),
        },
        ExpressionAttributeValues: buildAttributeValues(input["data"]), // user-influenced
    }
    // ... execute update
    return c.SendStatus(fiber.StatusOK)
})

// Vulnerable recursive helper that does not limit nesting depth
func buildAttributeValues(val interface{}) map[string]*dynamodb.AttributeValue {
    switch v := val.(type) {
    case map[string]interface{}:
        m := make(map[string]*dynamodb.AttributeValue)
        for k, sub := range v {
            m[k] = buildAttributeValues(sub)
        }
        return map[string]*dynamodb.AttributeValue{
            "M": {M: m},
        }
    case float64:
        return map[string]*dynamodb.AttributeValue{
            "N": {N: aws.String(strconv.FormatFloat(v, 'f', -1, 64))},
        }
    case string:
        return map[string]*dynamodb.AttributeValue{
            "S": {S: aws.String(v)},
        }
    case bool:
        return map[string]*dynamodb.AttributeValue{
            "BOOL": {BOOL: aws.Bool(v)},
        }
    default:
        return map[string]*dynamodb.AttributeValue{}
    }
}

If the attacker sends {"data": {"a": {"b": { ... }}}} with thousands of levels, buildAttributeValues recurses deeply and crashes the process. This is a Stack Overflow vector facilitated by the DynamoDB attribute format and unchecked deserialization in Fiber handlers.

middleBrick would detect this pattern as an Input Validation finding, highlighting missing constraints on nested object depth and recommending structural guards before constructing DynamoDB expressions.

To remediate Stack Overflow risks when using DynamoDB with Fiber, constrain the structure and depth of data that flows into DynamoDB expression construction. Validate and sanitize user input before it reaches recursive helper functions, and enforce strict limits on nesting and collection size.

Below are concrete, safe patterns for Fiber handlers that interact with DynamoDB, using the AWS SDK for Go v2.

1. Validate input depth and size before building expressions

Implement a non-recursive validator that checks maps and arrays to a fixed maximum depth (e.g., 5) and rejects oversized collections.

const maxDepth = 5

func validateDepth(val interface{}, depth int) error {
    if depth > maxDepth {
        return fmt.Errorf("nesting too deep")
    }
    switch v := val.(type) {
    case map[string]interface{}:
        if len(v) > 100 { // arbitrary size guard
            return fmt.Errorf("map too large")
        }
        for _, sub := range v {
            if err := validateDepth(sub, depth+1); err != nil {
                return err
            }
        }
    case []interface{}:
        if len(v) > 100 {
            return fmt.Errorf("array too large")
        }
        for _, sub := range v {
            if err := validateDepth(sub, depth+1); err != nil {
                return err
            }
        }
    }
    return nil
}

func safeBuildAttributeValues(val interface{}) (map[string]*dynamodb.AttributeValue, error) {
    if err := validateDepth(val, 0); err != nil {
        return nil, err
    }
    // same recursive builder as before, now guarded by depth checks
    // ...
}

2. Use strongly-typed structures instead of interface{} maps

Define structs that mirror the expected DynamoDB item shape and unmarshal directly into them. This prevents uncontrolled nesting and allows you to enforce field constraints.

type ItemData struct {
    Name  string                 `json:"name"`
    Props map[string]interface{} `json:"props" maxdepth:"5"`
}

app.Put("/update/:id", func(c *fiber.Ctx) error {
    var payload struct {
        Data ItemData `json:"data"`
    }
    if err := c.BodyParser(&payload); err != nil {
        return c.Status(fiber.StatusBadRequest).SendString("invalid body")
    }
    // payload.Data is now bounded and typed
    av, err := safeBuildAttributeValues(payload.Data.Props)
    if err != nil {
        return c.Status(fiber.StatusBadRequest).SendString("invalid structure")
    }
    updateInput := &dynamodb.UpdateItemInput{
        TableName: aws.String("Items"),
        Key: map[string]*dynamodb.AttributeValue{
            "id": {S: aws.String(c.Params("id"))},
        },
        UpdateExpression: aws.String("SET #data = :val"),
        ExpressionAttributeNames: map[string]*string{
            "#data": aws.String("data"),
        },
        ExpressionAttributeValues: av,
    }
    // ... execute update
    return c.SendStatus(fiber.StatusOK)
})

3. Prefer condition expressions and avoid dynamic nesting

When possible, use simple scalar condition values rather than constructing nested maps from user input. For updates that set known fields, map user input to predefined attribute paths instead of allowing arbitrary nesting.

app.Post("/set-field", func(c *fiber.Ctx) error {
    var req struct {
        Field string          `json:"field"`
        Value json.RawMessage `json:"value"`
    }
    if err := c.BodyParser(&req); err != nil {
        return c.Status(fiber.StatusBadRequest).SendString("invalid body")
    }
    // Validate Value is a simple scalar (number/string/bool) before conversion
    // Map req.Field to a known attribute and build a simple ExpressionAttributeValues
    attrVal, err := simpleValueToAttribute(req.Value)
    if err != nil {
        return c.Status(fiber.StatusBadRequest).SendString("invalid value")
    }
    updateInput := &dynamodb.UpdateItemInput{
        TableName: aws.String("Items"),
        Key: map[string]*dynamodb.AttributeValue{
            "id": {S: aws.String(c.Params("id"))},
        },
        UpdateExpression: aws.String(fmt.Sprintf("SET %s = :val", req.Field)),
        ExpressionAttributeValues: map[string]*dynamodb.AttributeValue{
            ":val": attrVal,
        },
    }
    // ... execute update
    return c.SendStatus(fiber.StatusOK)
})

These patterns eliminate deep recursion by design, ensuring that user input never drives unbounded stack usage when constructing DynamoDB expression attribute values in Fiber handlers.