Addressed and suppressed CodeQL warnings with explanatory comments in the JDBC codebase.#2677
Merged
Addressed and suppressed CodeQL warnings with explanatory comments in the JDBC codebase.#2677
Conversation
… the JDBC codebase.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2677 +/- ##
============================================
- Coverage 51.82% 51.80% -0.03%
+ Complexity 4021 4019 -2
============================================
Files 147 147
Lines 33800 33800
Branches 5650 5650
============================================
- Hits 17518 17509 -9
- Misses 13811 13819 +8
- Partials 2471 2472 +1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
David-Engel
previously approved these changes
Jun 11, 2025
David-Engel
approved these changes
Jun 13, 2025
machavan
approved these changes
Jun 17, 2025
This was referenced Jul 3, 2025
VID-20250716-WA0026.mp4 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
CodeQL static analysis raised warnings for certain cryptographic algorithms and usages in the JDBC driver codebase. These warnings were triggered in files supporting NTLM authentication, Always Encrypted, legacy private key handling, and secure in-memory string encryption. However, these usages are intentional and required for compatibility with SQL Server features, industry standards, and appropriate security contexts.
Resolution details:
This PR adds CodeQL suppression comments to the affected lines of code. These suppressions are justified and documented to ensure clarity and maintain compliance with external standards or backward compatibility. No functional code changes were made. The updates are as follows:
Suppression added for use of HmacMD5 algorithm, which is required for NTLM support.
// CodeQL [SM05136] HmacMD5 is required for NTLM support
Suppression added for use of RSA_OAEP with SHA1, which is mandated by SQL Server for Always Encrypted.
// CodeQL [SM03796] Required for an external standard: Always Encrypted only supports encrypting column encryption keys with RSA_OAEP(SHA1) (https://learn.microsoft.com/en-us/sql/t-sql/statements/create-column-encryption-key-transact-sql?view=sql-server-ver16)
Suppressions added to maintain backward compatibility with older private key formats.
// CodeQL [SM05136] Required for backwards compatibility reading of old private keys
Suppression added for RSA_OAEP(SHA1) usage required by Always Encrypted.
// CodeQL [SM03796] Required for an external standard: Always Encrypted only supports encrypting column encryption keys with RSA_OAEP(SHA1) (https://learn.microsoft.com/en-us/sql/t-sql/statements/create-column-encryption-key-transact-sql?view=sql-server-ver16)
Suppressions added for the use of AES/GCM/NoPadding, which is a modern and secure cipher.
// This cipher is used appropriately in a short-lived, in-memory scenario, with each nonce only used once for encryption.
Testing
No functional changes were made; therefore, no new tests were added. Existing test coverage remains valid, and this change is limited to documentation-only suppressions to pass CodeQL analysis while preserving required functionality.