Database names with spaces cause firewall detection to fail - sqlcmd argument not quoted
- Dominant language
- TypeScript
- Stars
- 142
- Forks
- 73
- PR merge metrics
- No merged PRs in 30d
Description
When the connection string contains a database name with a space (e.g. `Initial Catalog=MyDatabase Live`), the firewall IP detection step fails because the database name is not properly quoted when passed to sqlcmd.
**Error:**
```
Failed to add firewall rule. Unable to detect client IP Address. Sqlcmd: 'Live': Unknown command. Enter '--help' for command help.
```
**Debug output:**
```
##[debug]Validating if client has access to 'MyDatabase Live' on 'myserver.database.windows.net'.
##[debug]The process 'sqlcmd' failed with exit code 1
##[debug]SqlCmd stderr: Sqlcmd: 'Live': Unknown command. Enter '--help' for command help.
```
The action correctly parses the database name as `MyDatabase Live`, but fails to quote it when executing sqlcmd.
**Environment:**
- `azure/sql-action@v2.3`
- `runs-on: ubuntu-latest`
- Azure SQL Database with `Authentication=Active Directory Default`
**Connection string:**
```
Server=myserver.database.windows.net;Initial Catalog=MyDatabase Live;Authentication=Active Directory Default;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;
```
**Attempted workarounds (none worked):**
- Single quotes: `Initial Catalog='MyDatabase Live'`
- Double quotes: `Initial Catalog="MyDatabase Live"`
**Potential root cause:**
The `detectIPAddress` function extracts the database name correctly but may pass it to sqlcmd as the `-d` argument without quoting, resulting in:
```
sqlcmd -S myserver.database.windows.net -d MyDatabase Live -Q "select getdate()"
```
**Expected behaviour:**
```
sqlcmd -S myserver.database.windows.net -d "MyDatabase Live" -Q "select getdate()"
```
Contributor guide
Assessment
This issue has not been assessed yet.