Type Confusion in Chi with Api Keys

Type confusion in Chi arises when an API endpoint fails to enforce strict type checks on user-controlled input used to select or construct cryptographic material such as API keys. If an endpoint accepts a parameter that determines which key to use—for example, a key identifier that should be an integer or a known enumeration but is instead treated as a generic string or object—Chi may coerce or misinterpret the value. This can cause the runtime to select the wrong key material, bypass key-index validation, or even interpret attacker-controlled bytes as a key handle, leading to authentication bypass or information disclosure.

Consider an endpoint that retrieves a key by index without validating that the index is within the bounds and type of the key store:

// Unsafe: keyId is used without type or bounds validation
const keys = [process.env.API_KEY_A, process.env.API_KEY_B];
const keyId = req.query.keyId; // e.g., keyId=1
const selectedKey = keys[keyId]; // Type confusion: keyId may be a string
res.json({ key: selectedKey });

If keyId is a string such as 1, JavaScript may still coerce it to a numeric index, but if an attacker supplies keyId=-1 or a non-integer like keyId=keys, the behavior becomes unpredictable and may expose an unintended key or return undefined, which some frameworks might treat as a valid fallback. An attacker can leverage this to probe key indices or cause the application to use a default or empty key, undermining authentication.

In Chi, when OpenAPI/Swagger specs define parameters that should map to a discrete set of key identifiers, failing to validate against the spec’s expected types and enum values allows runtime type confusion between the declared schema and the implementation. For example, a spec may declare an integer parameter, but if the server code treats it as a string and uses it in a lookup map, an attacker can supply crafted values (e.g., floating point numbers, objects serialized as JSON strings) that traverse into key selection logic. This misalignment can also interact with reflection-based key resolution, where the runtime inspects types dynamically and may select the wrong key material due to mismatched type assumptions.

Type confusion can further expose sensitive API keys when combined with unchecked deserialization or when key identifiers are derived from complex objects. If an endpoint accepts a JSON body with a key selector field and binds it directly to a language object without enforcing strict types, an attacker may supply nested structures or polymorphic inputs that cause the runtime to resolve to an incorrect key container. The result is that sensitive API keys may be returned or used in contexts they were never intended for, facilitating data exposure or privilege escalation.

Remediation centers on enforcing strict type and range checks before using any input to select cryptographic material. Always treat key identifiers as opaque, validated tokens and avoid direct indexing or reflection-based resolution of keys based on user input.

First, validate and sanitize the key identifier against an allowlist and ensure it is of the expected type before any lookup:

// Safe: strict type and bounds validation
const keys = [process.env.API_KEY_A, process.env.API_KEY_B];
let keyId = Number(req.query.keyId);
if (!Number.isInteger(keyId) || keyId < 0 || keyId >= keys.length) {
  return res.status(400).json({ error: 'invalid key identifier' });
}
const selectedKey = keys[keyId];
res.json({ key: selectedKey });

Second, when keys are stored in a map, use string constants and validate against the set of known keys instead of relying on numeric coercion:

// Safe: map with explicit key names and validation
const allowedKeys = new Set(['key-a', 'key-b']);
const keyName = String(req.query.keyName);
if (!allowedKeys.has(keyName)) {
  return res.status(403).json({ error: 'forbidden key name' });
}
const selectedKey = keyStore[keyName];
res.json({ key: selectedKey });

Third, if your Chi application uses OpenAPI specs to drive key selection, generate code with strict schema validation (e.g., using a validator library) and avoid dynamic key resolution based on raw input:

// Example using a validation library to enforce types before key use
const { validateRequest } = require('./openapi-validator');
const spec = require('./openapi.json');
app.get('/key', (req, res) => {
  const valid = validateRequest(spec, '/key', req);
  if (!valid) {
    return res.status(400).json({ error: 'validation failed' });
  }
  // Only after validation, use a controlled mapping
  const keyId = spec.parameters.keyId.example; // known safe value from spec
  const keys = [process.env.API_KEY_A, process.env.API_KEY_B];
  const selectedKey = keys[keyId];
  res.json({ key: selectedKey });
});

Additionally, avoid storing API keys in JavaScript objects that are keyed by user input; prefer environment variables with fixed indices or a secure key manager. Ensure that any reflection or dynamic type resolution in Chi is constrained to trusted schemas and that input conforms to the expected primitive types defined in the API specification.