Skip to content

.Net MEVD Document untrusted input in query translators#12129

Merged
adamsitnik merged 8 commits intomicrosoft:feature-vector-data-preb3from
adamsitnik:sqlInjection
May 19, 2025
Merged

.Net MEVD Document untrusted input in query translators#12129
adamsitnik merged 8 commits intomicrosoft:feature-vector-data-preb3from
adamsitnik:sqlInjection

Conversation

@adamsitnik
Copy link
Member

I've not found a place where an untrusted input was being handled incorrectly, so I've just added comments and structured the code in a way it would be harder to introduce such bug in the future.

In contributes to #11154

@adamsitnik adamsitnik requested a review from roji May 16, 2025 12:29
@adamsitnik adamsitnik requested a review from a team as a code owner May 16, 2025 12:29
@markwallace-microsoft markwallace-microsoft added .NET Issue or Pull requests regarding .NET code kernel Issues or pull requests impacting the core kernel memory labels May 16, 2025

this._parameters.Add(name, value);
this._sql.Append('@').Append(name);
// The param name is just the index, so there is no need for escaping or quoting.
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It mimics what the two other SQL translator do. I know it's not perfect, but it's simple and it always works and we have little of time.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, we can improve this later.

Copy link
Member

@roji roji left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's a // TODO: escaping comment in AzureAISearchFilterTranslator - I think I wasn't 100% sure when writing the code if single-quote escaping in the way I did it is sufficient... Would you mind taking checking this out (I think it's fine, but just in case...)?

There are a few supressions of CA2100 (which warns against SQL injection). I think these are OK: the warning is also emitted when interpolating e.g. table/column names into SQL strings, which we have to do. But if possible, can you give these few places a look to make sure we're not doing something weird? If any suppression is unnecessary we can remove it, and for others, it would be good to limit the scope to the relevant lines (the suppressions are currently very wide).


this._parameters.Add(name, value);
this._sql.Append('@').Append(name);
// The param name is just the index, so there is no need for escaping or quoting.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, we can improve this later.

- extend the special characters test with [ ] < > and $
- remove TODO
@adamsitnik adamsitnik merged commit d4e8274 into microsoft:feature-vector-data-preb3 May 19, 2025
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

kernel Issues or pull requests impacting the core kernel memory .NET Issue or Pull requests regarding .NET code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants