Catch an injection attempt

Runs the sample. Generated for this page; it reads the connection string from the environment and first remakes the sample database from sample-schema.json.

using ArxSamples.DynamoDb;
using ArxSamples.DynamoDb.Operations.Delete.RealCases;

// The connection string comes from the environment, never from the code (see "Configure the connection").
var connectionString = Environment.GetEnvironmentVariable("ARX_SAMPLES_DYNAMODB")
    ?? throw new InvalidOperationException("Set the ARX_SAMPLES_DYNAMODB environment variable to your Amazon DynamoDB connection string.");

var dbContext = new SampleContext(connectionString);

// Every run starts from the sample data: this deletes and makes again what sample-schema.json lists
// (save the file in the project folder, see Get started).
await dbContext.Direct.ResetAsync();

await new RealCase1_CatchAnInjectionAttempt().RunAsync(dbContext);

The sample, as it is in the repository.

using ARX.SDK;
using ARX.SDK.DynamoDb.Services;
using ARX.SDK.Services;

using static ArxSamples.DynamoDb.SampleOutput;

namespace ArxSamples.DynamoDb.Operations.Delete.RealCases;

/// <summary>
/// A "remove my order" endpoint attacked two ways: a match column named with expression syntax, and a value written to
/// widen the delete to every order; then the honest request.
/// </summary>
/// <remarks>
/// A name with expression or SQL syntax is ARX1017. Values are never part of an expression: ARX sends no PartiQL, and a value
/// only ever names one key.
/// </remarks>
public sealed class RealCase1_CatchAnInjectionAttempt : ISample
{
    public string Name => "delete-real-1-catch-an-injection-attempt";

    public string Title => "Catch an injection attempt";

    public async Task RunAsync(SampleContext dbContext)
    {
        foreach (var (customerId, number) in new[] { ("C-D321", "SO-D321"), ("C-D322", "SO-D322") })
        {
            var order = new ArxEntity("sales_order");
            order["customer_id"] = customerId;
            order["order_number"] = number;
            order["status"] = "OPEN";
            order["ordered_on"] = "2026-11-05";
            await dbContext.Service.CreateAsync(order);
        }

        await Scenario1_ExpressionSyntaxInTheMatchAsync(dbContext.Service);

        await Scenario2_AValueThatWidensTheDeleteAsync(dbContext.Service);

        await Scenario3_TheHonestRequestAsync(dbContext.Service);
    }

    /// <summary>1. The match names "order_number OR attribute_exists(PK)": ARX1017.</summary>
    private static async Task Scenario1_ExpressionSyntaxInTheMatchAsync(ArxDynamoDbService service)
    {
        Step("1. Expression syntax in the match");

        var match = new ArxEntity("sales_order");
        match["customer_id"] = "C-D321";
        match["order_number OR attribute_exists(PK)"] = "x";

        try
        {
            await service.DeleteAsync(match, new ArxDeleteOptions { Match = ArxMatch.Columns("customer_id", "order_number OR attribute_exists(PK)") });
        }
        catch (ArxValidationException exception) when (exception.Code == ArxErrorCode.SuspectedInjection)
        {
            ShowError(exception);
        }

        /* ===========================================================
         * [DIRECT QUERY CHECK]
         * -----------------------------------------------------------
         * SELECT "SK" FROM "crm" WHERE "PK" = 'CUSTOMER#C-D321'
         * -- Expect: 1 item, ORDER#SO-D321.
         * ===========================================================
         */
    }

    /// <summary>2. A customer id of "C-D321' OR '1'='1": only a value, it names no item, so nothing goes.</summary>
    private static async Task Scenario2_AValueThatWidensTheDeleteAsync(ArxDynamoDbService service)
    {
        Step("2. A value that widens the delete");

        var match = new ArxEntity("sales_order") { RecordId = ArxRecordId.Of("order_number", "SO-D322") };
        match["customer_id"] = "C-D321' OR '1'='1";

        int deleted = await service.DeleteAsync(match);

        Show($"{deleted} items deleted");

        /* ===========================================================
         * [DIRECT QUERY CHECK]
         * -----------------------------------------------------------
         * SELECT "SK" FROM "crm" WHERE "PK" = 'CUSTOMER#C-D322'
         * -- Expect: 1 item, ORDER#SO-D322.
         * ===========================================================
         */
    }

    /// <summary>3. The customer removes its own order.</summary>
    private static async Task Scenario3_TheHonestRequestAsync(ArxDynamoDbService service)
    {
        Step("3. The honest request");

        var match = new ArxEntity("sales_order") { RecordId = ArxRecordId.Of("order_number", "SO-D321") };
        match["customer_id"] = "C-D321";

        int deleted = await service.DeleteAsync(match);

        Show($"{deleted} item deleted");

        /* ===========================================================
         * [DIRECT QUERY CHECK]
         * -----------------------------------------------------------
         * SELECT "SK" FROM "crm" WHERE "PK" = 'CUSTOMER#C-D321'
         * -- Expect: no items.
         * ===========================================================
         */
    }
}

  > 1. Expression syntax in the match
      caught ArxValidationException: ARX1017 SuspectedInjection: Attribute name 'order_number OR attribute_exists(PK)' looks like an SQL injection attempt (contains '('). ARX refused it before sending anything to the database. Names must come from your code or a fixed list, never from user input.
  > 2. A value that widens the delete
      0 items deleted
  > 3. The honest request
      1 item deleted