microsoft / microsoft/DacFx

Password visible in clear text in the process command line - Source/Target Passwords

Open
#182 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
C#
Stars
460
Forks
29
Avg merge
4d 9h
Merged PRs (30d)
7

Description

- SqlPackage or DacFx Version:
- .NET Framework (Windows-only) or .NET Core:
- Environment (local platform and source/target platforms):

**Steps to Reproduce:**

1. Try to export a database using SQL Authentication in Azure SQL. The executable accepts the password as {String} instead of {SecureString}.

**Did this occur in prior versions? If not - which version(s) did it work in?**
It happens with all versions of SQLPackage.exe.

(DacFx/SqlPackage/SSMS/Azure Data Studio)

Contributor guide

Open the contributing guide

Research direction

Start at the SqlPackage.exe export path for SQL Authentication against Azure SQL and trace how the source and target passwords reach the process command line. Confirm the behavior on the affected versions, then define tests that verify passwords are not exposed as clear-text command-line arguments.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, sql
Domain
cli, databases, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.