Skip to content

.Net: [MEVD] Do a proper pass to ensure that all names are property sanitized (prevent SQL injection) #11154

New issue
New issue
Closed
Closed
.Net: [MEVD] Do a proper pass to ensure that all names are property sanitized (prevent SQL injection)#11154
Assignees
adamsitnik
Labels
.NETIssue or Pull requests regarding .NET codeBuildFeatures planned for next Build conferencemsft.ext.vectordataRelated to Microsoft.Extensions.VectorData

Description

@roji
Shay Rojansky (roji)
opened on Mar 24, 2025

There are some cases where we're integrating externally-provided string directly into SQL without quoting/sanitation, e.g. here. We should do a proper pass before releasing to ensure we don't do this anywhere.

/cc westey (@westey-m) Dmytro Struk (@dmytrostruk) Adam Sitnik (@adamsitnik)

Activity

  1. Shay Rojansky (roji)
    added
    BuildFeatures planned for next Build conference
    msft.ext.vectordataRelated to Microsoft.Extensions.VectorData
    on Mar 24, 2025
  2. Mark Wallace (markwallace-microsoft)
    added
    .NETIssue or Pull requests regarding .NET code
    triage
    on Mar 24, 2025
  3. github-actions
    changed the title [-][MEVD] Do a proper pass to ensure that all names are property sanitized (prevent SQL injection)[/-] [+].Net: [MEVD] Do a proper pass to ensure that all names are property sanitized (prevent SQL injection)[/+] on Mar 24, 2025
  4. Shay Rojansky (roji)
    removed
    triage
    on Mar 24, 2025

  5. roji commented on Mar 24, 2025

    @roji
    Shay Rojansky (roji)
    on Mar 24, 2025
    MemberAuthor

    Seems like we also have some suppressions for CA2100, we should remove these.

  6. Shay Rojansky (roji)
    added this to Semantic Kernelon Apr 7, 2025
  7. Shay Rojansky (roji)
    assigned
    Adam Sitnik (adamsitnik)
    on Apr 7, 2025
  8. Shay Rojansky (roji)
    moved this to Backlog: Planned in Semantic Kernelon Apr 7, 2025
  9. Adam Sitnik (adamsitnik)
    added a commit that references this issue on Apr 18, 2025

    .Net MEVD Sqlite: Escaping (#11534)

    cd0f985
  10. Adam Sitnik (adamsitnik)
    moved this from Backlog: Planned to Sprint: In Review in Semantic Kernelon Apr 24, 2025
  11. Adam Sitnik (adamsitnik)
    added a commit that references this issue on May 19, 2025

    .Net MEVD Document untrusted input in query translators (#12129)

    d4e8274

  12. adamsitnik commented on May 19, 2025

    @adamsitnik
    Adam Sitnik (adamsitnik)
    on May 19, 2025
    Member

    Fixed by #12129, for what is left I've created #12161 that does not need to be fixed before BUILD

  13. Adam Sitnik (adamsitnik)
    closed this as completedon May 19, 2025
  14. Adam Sitnik (adamsitnik)
    moved this from Sprint: In Review to Sprint: Done in Semantic Kernelon May 19, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

.NETIssue or Pull requests regarding .NET codeBuildFeatures planned for next Build conferencemsft.ext.vectordataRelated to Microsoft.Extensions.VectorData

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions