dohertj2/lmxopcua
1
0
Fork 0
Code Issues 32 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(reviews): close Driver.Sql-009 + Driver.Sql.Browser-001/002/003

Browse Source 
-003 is a documented Won't Fix: the mitigating control is the ConfigEditor page
policy on the only two surfaces that reach a browse session (/raw and /uns),
there is no HTTP endpoint for browse, and PageAuthorizationGuardTests pins both
pages to that exact policy. Recorded in docs/security.md under Control-Plane
Authorization and pointed at from SqlDriverBrowser's class summary.
This commit is contained in:
Joseph Doherty
2026-08-10 08:05:12 -04:00
parent cd4b29a368
commit 3427370831
4 changed files with 63 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code-reviews/Driver.Sql/findings.md
+2 -2
View File
@@ -184,13 +184,13 @@ surface.
| Severity | Low |
| Category | Security |
| Location | `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlDriverProbe.cs:83` |
| Status | Open |
| Status | Resolved |
**Description:** The probe surfaces the raw parser text on a malformed config ("Config JSON is invalid: " + `ex.Message`) where `SqlDriverBrowser.ParseDocument` deliberately withholds the identical message "because the malformed text may carry a connection string". The two read the same blob shape: the AdminUI Sql picker composes an ad-hoc document carrying a top-level `connectionString` literal, so a malformed paste is exactly the case that reaches both. `System.Text.Json`'s message quotes the offending token and the JSON path rather than the property value, so the current exposure is small — but the rule is stated absolutely elsewhere in this driver ("never `ex.Message` on an operator surface") and the probe is the one place that breaks it.
**Recommendation:** Match the browser: report the failure class, not the parser's message.
**Resolution:** _(open)_
**Resolution (2026-08-10):** Fixed in `073930e0`. The `JsonException`/`ArgumentNullException` catch now returns the browser's own wording — "Config JSON is not valid JSON. (The parser's message is withheld because the malformed text may carry a connection string.)" — and the class summary states the rule beside the existing "never the connection string" paragraph, so the two disciplines read as one. Pinned by `SqlDriverProbeTests.Probe_malformedConfig_withholdsTheParserMessage`, whose malformed input is a `connectionString` literal mis-quoted the way an operator's paste is (`Password=Sup3r;SecretTail`, unquoted `;`) so the parse fails partway *through* the credential. RED before the fix on `"LineNumber"` — the old message was `Config JSON is invalid: 'P' is an invalid start of a value. Path: $.connectionString | LineNumber: 0…`. The test asserts on the parser's structural tokens (`LineNumber`, `BytePositionInLine`) rather than only on the secret, because `System.Text.Json` quotes just the offending token: a leak-only assertion passes vacuously today and would go on passing if the message ever got *more* verbose.
---