Password visible in clear text in the process command line - Source/Target Passwords
- Dominant language
- C#
- Stars
- 460
- Forks
- 29
- Avg merge
- 4d 9h
- Merged PRs (30d)
- 7
Description
- SqlPackage or DacFx Version:
- .NET Framework (Windows-only) or .NET Core:
- Environment (local platform and source/target platforms):
**Steps to Reproduce:**
1. Try to export a database using SQL Authentication in Azure SQL. The executable accepts the password as {String} instead of {SecureString}.
**Did this occur in prior versions? If not - which version(s) did it work in?**
It happens with all versions of SQLPackage.exe.
(DacFx/SqlPackage/SSMS/Azure Data Studio)
Contributor guide
Research direction
Start at the SqlPackage.exe export path for SQL Authentication against Azure SQL and trace how the source and target passwords reach the process command line. Confirm the behavior on the affected versions, then define tests that verify passwords are not exposed as clear-text command-line arguments.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, sql
- Domain
- cli, databases, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100