Skip to content

FIX: security issue SEC101/037 : SQLLegacyCredentials fix #369

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
subrata-ms merged 4 commits into from
Dec 15, 2025
+42 −35
Merged

FIX: security issue SEC101/037 : SQLLegacyCredentials fix #369

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8f21a2e
security issue SEC101/037 : SQLLegacyCredentials fix
subrata-ms Dec 11, 2025
79b1eca
fix for review comments
subrata-ms Dec 12, 2025
0f23954
Merge branch 'main' into subrata-ms/SQLSecurityIssue
subrata-ms Dec 15, 2025
5c1c406
Merge branch 'main' into subrata-ms/SQLSecurityIssue
subrata-ms Dec 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions tests/test_002_types.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -531,6 +531,7 @@
This validates the fix for unix_utils.cpp to match ddbc_bindings.h behavior.
"""
import mssql_python
import os

# Test connection strings with various surrogate-related edge cases
# These should be handled gracefully without introducing invalid Unicode
Expand All @@ -539,7 +540,10 @@
# In UTF-16, high surrogates (0xD800-0xDBFF) must be followed by low surrogates
try:
# Create a connection string that would exercise the conversion path
conn_str = "Server=test_server;Database=TestDB;UID=user;PWD=password"
# Use environment variables or placeholder values to avoid SEC101/037 security warnings
test_server = os.getenv("TEST_SERVER", "localhost")
test_db = os.getenv("TEST_DATABASE", "TestDB")
conn_str = f"Server={test_server};Database={test_db};Trusted_Connection=yes"
conn = mssql_python.connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -548,7 +552,7 @@
# Low surrogate without high surrogate (invalid)
# In UTF-16, low surrogates (0xDC00-0xDFFF) must be preceded by high surrogates
try:
conn_str = "Server=test;Database=DB;ApplicationName=TestApp;UID=u;PWD=p"
conn_str = f"Server={os.getenv('TEST_SERVER', 'localhost')};Database=DB;ApplicationName=TestApp;Trusted_Connection=yes"
conn = mssql_python.connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -564,7 +568,7 @@

for test_str in emoji_tests:
try:
conn_str = f"Server=test;{test_str};UID=user;PWD=pass"
conn_str = f"Server=test;{test_str};Trusted_Connection=yes"
conn = mssql_python.connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand Down
46 changes: 23 additions & 23 deletions tests/test_013_sqlwchar_conversions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ def test_surrogate_pair_high_without_low(self):
# This tests the else branch at lines 112-115
try:
# Use a connection string to exercise the conversion path
conn_str = f"Server=test;Database={test_str};UID=user;PWD=pass"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -49,7 +49,7 @@ def test_surrogate_pair_high_without_low(self):
# High surrogate followed by non-surrogate
test_str2 = "Test\ud800X" # High surrogate followed by ASCII
try:
conn_str = f"Server=test;ApplicationName={test_str2};UID=u;PWD=p"
conn_str = f"Server=test;ApplicationName={test_str2};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -71,7 +71,7 @@ def test_surrogate_pair_low_without_high(self):
test_str = "\udc00Hello" # Low surrogate at start

try:
conn_str = f"Server=test;Database={test_str};UID=user;PWD=pass"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -80,7 +80,7 @@ def test_surrogate_pair_low_without_high(self):
# Low surrogate in middle (not preceded by high surrogate)
test_str2 = "A\udc00B" # Low surrogate between ASCII
try:
conn_str = f"Server=test;ApplicationName={test_str2};UID=u;PWD=p"
conn_str = f"Server=test;ApplicationName={test_str2};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand Down Expand Up @@ -111,7 +111,7 @@ def test_valid_surrogate_pairs(self):

for test_str in emoji_tests:
try:
conn_str = f"Server=test;Database={test_str};UID=user;PWD=pass"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand Down Expand Up @@ -144,7 +144,7 @@ def test_bmp_characters(self):

for test_str in bmp_tests:
try:
conn_str = f"Server=test;Database={test_str};UID=user;PWD=pass"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -170,7 +170,7 @@ def test_invalid_scalar_values(self):
# High surrogate alone
try:
test_str = "Test\ud800End"
conn_str = f"Server=test;Database={test_str};UID=user;PWD=pass"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -179,7 +179,7 @@ def test_invalid_scalar_values(self):
# Low surrogate alone
try:
test_str = "Start\udc00Test"
conn_str = f"Server=test;Database={test_str};UID=user;PWD=pass"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -188,7 +188,7 @@ def test_invalid_scalar_values(self):
# Mixed invalid surrogates
try:
test_str = "\ud800\ud801\udc00" # High, high, low (invalid pairing)
conn_str = f"Server=test;Database={test_str};UID=user;PWD=pass"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand Down Expand Up @@ -220,7 +220,7 @@ def test_wstring_to_sqlwchar_bmp(self):

for test_char in single_unit_tests:
try:
conn_str = f"Server=test;Database=DB_{test_char};UID=u;PWD=p"
conn_str = f"Server=test;Database=DB_{test_char};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand Down Expand Up @@ -253,7 +253,7 @@ def test_wstring_to_sqlwchar_surrogate_pairs(self):

for emoji in emoji_chars:
try:
conn_str = f"Server=test;Database=DB{emoji};UID=u;PWD=p"
conn_str = f"Server=test;Database=DB{emoji};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand Down Expand Up @@ -282,7 +282,7 @@ def test_wstring_to_sqlwchar_invalid_scalars(self):

for test_str, desc in invalid_tests:
try:
conn_str = f"Server=test;Database={test_str};UID=u;PWD=p"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -301,15 +301,15 @@ def test_empty_and_null_strings(self):

# Empty string
try:
conn_str = "Server=test;Database=;UID=user;PWD=pass"
conn_str = "Server=test;Database=;Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
pass

# Very short strings
try:
conn_str = "Server=a;Database=b;UID=c;PWD=d"
conn_str = "Server=a;Database=b;Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand Down Expand Up @@ -337,7 +337,7 @@ def test_mixed_character_sets(self):

for test_str in mixed_tests:
try:
conn_str = f"Server=test;Database={test_str};UID=u;PWD=p"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand Down Expand Up @@ -371,7 +371,7 @@ def test_boundary_code_points(self):

for test_char, desc in boundary_tests:
try:
conn_str = f"Server=test;Database=DB{test_char};UID=u;PWD=p"
conn_str = f"Server=test;Database=DB{test_char};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand Down Expand Up @@ -403,7 +403,7 @@ def test_surrogate_pair_calculations(self):
# low = (0 & 0x3FF) + 0xDC00 = 0xDC00
min_supp = "\U00010000"
try:
conn_str = f"Server=test;Database=DB{min_supp};UID=u;PWD=p"
conn_str = f"Server=test;Database=DB{min_supp};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -415,7 +415,7 @@ def test_surrogate_pair_calculations(self):
# low = (0xF600 & 0x3FF) + 0xDC00 = 0x200 + 0xDC00 = 0xDE00
emoji = "😀"
try:
conn_str = f"Server=test;Database={emoji};UID=u;PWD=p"
conn_str = f"Server=test;Database={emoji};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -427,7 +427,7 @@ def test_surrogate_pair_calculations(self):
# low = (0xFFFFF & 0x3FF) + 0xDC00 = 0x3FF + 0xDC00 = 0xDFFF
max_unicode = "\U0010ffff"
try:
conn_str = f"Server=test;Database=DB{max_unicode};UID=u;PWD=p"
conn_str = f"Server=test;Database=DB{max_unicode};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand Down Expand Up @@ -455,7 +455,7 @@ def test_null_terminator_handling(self):

for test_str in length_tests:
try:
conn_str = f"Server=test;Database={test_str};UID=u;PWD=p"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -475,7 +475,7 @@ def test_unicode_round_trip_ascii(self):

for test_str in ascii_tests:
try:
conn_str = f"Server=test;Database={test_str};UID=u;PWD=p"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -490,7 +490,7 @@ def test_unicode_round_trip_emoji(self):

for emoji in emoji_tests:
try:
conn_str = f"Server=test;Database=DB{emoji};UID=u;PWD=p"
conn_str = f"Server=test;Database=DB{emoji};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -513,7 +513,7 @@ def test_unicode_round_trip_multilingual(self):

for test_str in multilingual_tests:
try:
conn_str = f"Server=test;Database={test_str};UID=u;PWD=p"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand Down
18 changes: 9 additions & 9 deletions tests/test_014_ddbc_bindings_coverage.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ def test_valid_scalar_values(self):

for char in valid_chars:
try:
conn_str = f"Server=test;Database=DB{char};UID=u;PWD=p"
conn_str = f"Server=test;Database=DB{char};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand Down Expand Up @@ -72,30 +72,30 @@ def test_surrogate_range(self):

# Just before surrogate range (valid)
try:
conn_str = "Server=test;Database=DB\ud7ff;UID=u;PWD=p"
conn_str = "Server=test;Database=DB\ud7ff;Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
pass

# Inside surrogate range (invalid)
try:
conn_str = "Server=test;Database=DB\ud800;UID=u;PWD=p"
conn_str = "Server=test;Database=DB\ud800;Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
pass

try:
conn_str = "Server=test;Database=DB\udfff;UID=u;PWD=p"
conn_str = "Server=test;Database=DB\udfff;Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
pass

# Just after surrogate range (valid)
try:
conn_str = "Server=test;Database=DB\ue000;UID=u;PWD=p"
conn_str = "Server=test;Database=DB\ue000;Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand Down Expand Up @@ -123,7 +123,7 @@ def test_utf32_valid_scalars(self):

for test_str in valid_tests:
try:
conn_str = f"Server=test;Database={test_str};UID=u;PWD=p"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -143,7 +143,7 @@ def test_utf32_invalid_scalars(self):

for test_str in invalid_tests:
try:
conn_str = f"Server=test;Database={test_str};UID=u;PWD=p"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -169,7 +169,7 @@ def test_utf32_encode_valid(self):

for test_str in valid_tests:
try:
conn_str = f"Server=test;Database={test_str};UID=u;PWD=p"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand All @@ -188,7 +188,7 @@ def test_utf32_encode_invalid(self):

for test_str in invalid_tests:
try:
conn_str = f"Server=test;Database={test_str};UID=u;PWD=p"
conn_str = f"Server=test;Database={test_str};Trusted_Connection=yes"
conn = connect(conn_str, autoconnect=False)
conn.close()
except Exception:
Expand Down
Loading