Catch an injection attempt

Runs the sample. Generated for this page; it reads the connection string from the environment and first remakes the sample database from sample-schema.json.

using ArxSamples.DynamoDb;
using ArxSamples.DynamoDb.Operations.Create.RealCases;

// The connection string comes from the environment, never from the code (see "Configure the connection").
var connectionString = Environment.GetEnvironmentVariable("ARX_SAMPLES_DYNAMODB")
    ?? throw new InvalidOperationException("Set the ARX_SAMPLES_DYNAMODB environment variable to your Amazon DynamoDB connection string.");

var dbContext = new SampleContext(connectionString);

// Every run starts from the sample data: this deletes and makes again what sample-schema.json lists
// (save the file in the project folder, see Get started).
await dbContext.Direct.ResetAsync();

await new RealCase2_CatchAnInjectionAttempt().RunAsync(dbContext);

The sample, as it is in the repository.

using ARX.SDK;
using ARX.SDK.DynamoDb.Services;
using ARX.SDK.Services;

using static ArxSamples.DynamoDb.SampleOutput;

namespace ArxSamples.DynamoDb.Operations.Create.RealCases;

/// <summary>
/// A form whose fields become attributes, attacked three ways: an expression placeholder as a field name, SQL in a
/// field name, and key separators in a value meant to land on another customer's key.
/// </summary>
/// <remarks>
/// Names with <c>#</c>, <c>:</c> or SQL syntax are ARX1017 before anything is sent: names reach DynamoDB only as
/// placeholders. Values in key templates are escaped, so <c>#</c> in a value can't make another entity's key.
/// </remarks>
public sealed class RealCase2_CatchAnInjectionAttempt : ISample
{
    public string Name => "create-real-2-catch-an-injection-attempt";

    public string Title => "Catch an injection attempt";

    public async Task RunAsync(SampleContext dbContext)
    {
        await Scenario1_APlaceholderAsAFieldNameAsync(dbContext.Service);

        await Scenario2_SqlInAFieldNameAsync(dbContext.Service);

        await Scenario3_ASeparatorInAKeyValueAsync(dbContext.Service);
    }

    /// <summary>1. A field named "#pk": ARX1017.</summary>
    private static async Task Scenario1_APlaceholderAsAFieldNameAsync(ArxDynamoDbService service)
    {
        Step("1. A placeholder as a field name");

        var customer = new ArxEntity("customer");
        customer["customer_id"] = "C-D601";
        customer["#pk"] = "CUSTOMER#someone-else";

        try
        {
            await service.CreateAsync(customer);
        }
        catch (ArxValidationException exception) when (exception.Code == ArxErrorCode.SuspectedInjection)
        {
            ShowError(exception);
        }

        /* ===========================================================
         * [DIRECT QUERY CHECK]
         * -----------------------------------------------------------
         * SELECT "PK" FROM "crm" WHERE "PK" = 'CUSTOMER#C-D601'
         * -- Expect: no items.
         * ===========================================================
         */
    }

    /// <summary>2. SQL in a field name: ARX1017 too.</summary>
    private static async Task Scenario2_SqlInAFieldNameAsync(ArxDynamoDbService service)
    {
        Step("2. SQL in a field name");

        var customer = new ArxEntity("customer");
        customer["customer_id"] = "C-D602";
        customer["name'; DROP TABLE crm; --"] = "x";

        try
        {
            await service.CreateAsync(customer);
        }
        catch (ArxValidationException exception) when (exception.Code == ArxErrorCode.SuspectedInjection)
        {
            ShowError(exception);
        }

        /* ===========================================================
         * [DIRECT QUERY CHECK]
         * -----------------------------------------------------------
         * SELECT "PK" FROM "crm" WHERE "PK" = 'CUSTOMER#C-D602'
         * -- Expect: no items.
         * ===========================================================
         */
    }

    /// <summary>3. An order number "x#ORDER#y": escaped in the key, so it stays this customer's order.</summary>
    private static async Task Scenario3_ASeparatorInAKeyValueAsync(ArxDynamoDbService service)
    {
        Step("3. A separator in a key value");

        var order = new ArxEntity("sales_order");
        order["customer_id"] = "C-D603";
        order["order_number"] = "x#ORDER#y";
        order["status"] = "OPEN";
        order["ordered_on"] = "2026-11-09";

        await service.CreateAsync(order);

        Show("stored, its key escaped");

        /* ===========================================================
         * [DIRECT QUERY CHECK]
         * -----------------------------------------------------------
         * SELECT "SK", "order_number" FROM "crm" WHERE "PK" = 'CUSTOMER#C-D603'
         * -- Expect: 1 item, SK "ORDER#x%23ORDER%23y", order_number "x#ORDER#y".
         * ===========================================================
         */
    }
}

  > 1. A placeholder as a field name
      caught ArxValidationException: ARX1017 SuspectedInjection: Attribute name '#pk' looks like an SQL injection attempt (contains '#' or ':' (DynamoDB expression syntax)). ARX refused it before sending anything to the database. Names must come from your code or a fixed list, never from user input.
  > 2. SQL in a field name
      caught ArxValidationException: ARX1017 SuspectedInjection: Attribute name 'name'; DROP TABLE crm; --' looks like an SQL injection attempt (contains '''). ARX refused it before sending anything to the database. Names must come from your code or a fixed list, never from user input.
  > 3. A separator in a key value
      stored, its key escaped