From a4f06fdcfb240372daf03ea352b9f44952622215 Mon Sep 17 00:00:00 2001 From: Geoff Greer Date: Thu, 20 Nov 2025 15:24:51 -0800 Subject: [PATCH 1/4] Use user/password is examples to prevent url escaping errors. --- examples/mysql-test.yml | 5 ++++- examples/oracle-test.yml | 5 ++++- examples/postgres-test.yml | 5 ++++- examples/sap-hana-test.yml | 5 ++++- examples/sqlserver-test.yml | 5 ++++- examples/wordpress-test.yml | 5 ++++- 6 files changed, 24 insertions(+), 6 deletions(-) diff --git a/examples/mysql-test.yml b/examples/mysql-test.yml index 28ae7185..b4ddd515 100644 --- a/examples/mysql-test.yml +++ b/examples/mysql-test.yml @@ -6,7 +6,10 @@ app_description: Test configuration for MySQL with account provisioning and rand # Connection settings for the MySQL database connect: # Data Source Name (DSN) for our local MySQL instance running in Docker - dsn: "mysql://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_DATABASE}" + dsn: "mysql://${DB_HOST}:${DB_PORT}/${DB_DATABASE}" + # Username and password are provided separately so they can be properly URL encoded. + user: "${DB_USER}" + password: "${DB_PASSWORD}" # Definition of different resource types managed by this connector resource_types: diff --git a/examples/oracle-test.yml b/examples/oracle-test.yml index 79f11b3c..467d66d0 100644 --- a/examples/oracle-test.yml +++ b/examples/oracle-test.yml @@ -5,7 +5,10 @@ app_name: Oracle Test # Connection settings for the Oracle database connect: # Data Source Name (DSN) including credentials, host, port, and service name - dsn: "oracle://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_SERVICE}" + dsn: "oracle://${DB_HOST}:${DB_PORT}/${DB_SERVICE}" + # Username and password are provided separately so they can be properly URL encoded. + user: "${DB_USER}" + password: "${DB_PASSWORD}" # Definition of different resource types managed by this connector resource_types: diff --git a/examples/postgres-test.yml b/examples/postgres-test.yml index d592f30c..d9cd236f 100644 --- a/examples/postgres-test.yml +++ b/examples/postgres-test.yml @@ -6,7 +6,10 @@ app_description: Test configuration for PostgreSQL with employee_id and last_log # Connection settings for the PostgreSQL database connect: # Data Source Name (DSN) for our test PostgreSQL instance - dsn: "postgres://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_DATABASE}?sslmode=disable" + dsn: "postgres://${DB_HOST}:${DB_PORT}/${DB_DATABASE}?sslmode=disable" + # Username and password are provided separately so they can be properly URL encoded. + user: "${DB_USER}" + password: "${DB_PASSWORD}" actions: enable_user: diff --git a/examples/sap-hana-test.yml b/examples/sap-hana-test.yml index bb615e5d..8f8b2b2f 100644 --- a/examples/sap-hana-test.yml +++ b/examples/sap-hana-test.yml @@ -2,7 +2,10 @@ app_name: HANA Express Test connect: - dsn: "hdb://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_DATABASE}" + dsn: "hdb://${DB_HOST}:${DB_PORT}/${DB_DATABASE}" + # Username and password are provided separately so they can be properly URL encoded. + user: "${DB_USER}" + password: "${DB_PASSWORD}" resource_types: user: diff --git a/examples/sqlserver-test.yml b/examples/sqlserver-test.yml index a269293c..1fc7a874 100644 --- a/examples/sqlserver-test.yml +++ b/examples/sqlserver-test.yml @@ -6,7 +6,10 @@ app_description: Test configuration for SQL Server with random password generati # Connection settings for the SQL Server database connect: # Data Source Name (DSN) for our test SQL Server instance - dsn: "sqlserver://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}?database=${DB_DATABASE}" + dsn: "sqlserver://${DB_HOST}:${DB_PORT}?database=${DB_DATABASE}" + # Username and password are provided separately so they can be properly URL encoded. + user: "${DB_USER}" + password: "${DB_PASSWORD}" # Definition of different resource types managed by this connector resource_types: diff --git a/examples/wordpress-test.yml b/examples/wordpress-test.yml index f7037184..0a8e1dc3 100644 --- a/examples/wordpress-test.yml +++ b/examples/wordpress-test.yml @@ -5,7 +5,10 @@ app_description: Test configuration for WordPress with password support # Connection configuration using a MySQL DSN. connect: - dsn: "mysql://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_DATABASE}?charset=utf8mb4&parseTime=True&loc=Local" + dsn: "mysql://${DB_HOST}:${DB_PORT}/${DB_DATABASE}?charset=utf8mb4&parseTime=True&loc=Local" + # Username and password are provided separately so they can be properly URL encoded. + user: "${DB_USER}" + password: "${DB_PASSWORD}" resource_types: user: From ea79f2f420a7e315e0783e12b892aec2203de39a Mon Sep 17 00:00:00 2001 From: Geoff Greer Date: Thu, 20 Nov 2025 15:29:24 -0800 Subject: [PATCH 2/4] Add SQL injection test to Postgres example data. --- test/postgres-init.sql | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/test/postgres-init.sql b/test/postgres-init.sql index d1cdca96..9e5d5f35 100644 --- a/test/postgres-init.sql +++ b/test/postgres-init.sql @@ -31,7 +31,9 @@ INSERT INTO users (username, email, employee_id, status, account_type, created_a ('service.acct', 'service@example.com', 'SVC001', 'active', 'service', '2025-02-01 08:00:00', NULL), ('disabled.user', 'disabled@example.com', 'EMP004', 'disabled', 'human', '2025-02-15 10:15:00', '2025-03-01 11:10:00'), ('bjorn.tipling.c1', 'bjorn.tipling@conductorone.com', 'EMP005', 'active', 'human', '2025-03-01 09:00:00', '2025-04-18 10:15:00'), -('bjorn.tipling.ins', 'bjorn.tipling@insulator.one', 'EMP006', 'active', 'human', '2025-03-05 11:30:00', '2025-04-18 14:30:00'); +('bjorn.tipling.ins', 'bjorn.tipling@insulator.one', 'EMP006', 'active', 'human', '2025-03-05 11:30:00', '2025-04-18 14:30:00'), +('robert"); drop table users; --', 'robert.tables@example.com', 'EMP007', 'active', 'human', '2025-11-11 15:20:00', '2025-11-20 09:15:00'), +('robert''); drop table users; --', 'robert.tables2@example.com', 'EMP008', 'active', 'human', '2025-11-15 07:45:00', '2025-11-18 10:10:00'); -- Update users to establish manager relationships -- jane.doe and john.smith report to admin @@ -49,6 +51,12 @@ UPDATE users SET manager_id = 1 WHERE username = 'bjorn.tipling.c1'; -- bjorn.tipling.ins reports to bjorn.tipling.c1 UPDATE users SET manager_id = (SELECT id FROM users WHERE username = 'bjorn.tipling.c1') WHERE username = 'bjorn.tipling.ins'; +-- robert.tables reports to admin +UPDATE users SET manager_id = 1 WHERE username = 'robert.tables'; + +-- robert.tables2 reports to robert.tables +UPDATE users SET manager_id = (SELECT id FROM users WHERE username = 'robert.tables') WHERE username = 'robert.tables2'; + -- Create roles table CREATE TABLE roles ( id SERIAL PRIMARY KEY, @@ -78,7 +86,11 @@ INSERT INTO user_roles (user_id, role_id) VALUES (3, 3), -- john.smith also has reader role (4, 2), -- service.acct has user role (6, 1), -- bjorn.tipling.c1 has admin role -(7, 2); -- bjorn.tipling.ins has user role +(7, 2), -- bjorn.tipling.ins has user role +(8, 2), -- robert.tables has user role +(9, 2), -- robert.tables2 has user role +(9, 1); -- robert.tables2 has admin role + -- Create table to track last login attempts (for testing date formats) CREATE TABLE login_history ( @@ -97,7 +109,9 @@ INSERT INTO login_history (user_id, login_time, login_time_text, login_time_alt) (3, '2025-04-16 16:20:00', '16-APR-2025 16:20:00', '16/04/2025 16:20:00'), (5, '2025-03-01 11:10:00', '01-MAR-2025 11:10:00', '01/03/2025 11:10:00'), (6, '2025-04-18 10:15:00', '18-APR-2025 10:15:00', '18/04/2025 10:15:00'), -(7, '2025-04-18 14:30:00', '18-APR-2025 14:30:00', '18/04/2025 14:30:00'); +(7, '2025-04-18 14:30:00', '18-APR-2025 14:30:00', '18/04/2025 14:30:00'), +(8, '2025-11-11 15:20:00', '11-NOV-2025 15:20:00', '11/11/2025 15:20:00'), +(9, '2025-11-15 07:45:00', '15-NOV-2025 07:45:00', '15/11/2025 07:45:00'); -- Create test table for employee IDs in different formats CREATE TABLE employee_data ( @@ -117,7 +131,9 @@ INSERT INTO employee_data (user_id, employee_id, employee_number, employee_code) (4, 'SVC001', 20001, 'S-20001'), (5, 'EMP004', 10004, 'E-10004'), (6, 'EMP005', 10005, 'E-10005'), -(7, 'EMP006', 10006, 'E-10006'); +(7, 'EMP006', 10006, 'E-10006'), +(8, 'EMP007', 10007, 'E-10007'), +(9, 'EMP008', 10008, 'E-10008'); -- Create features table CREATE TABLE features ( From d735d25949cb32792ce61f0c516e8b9b4848a569 Mon Sep 17 00:00:00 2001 From: Geoff Greer Date: Thu, 20 Nov 2025 15:48:25 -0800 Subject: [PATCH 3/4] Fix test. --- pkg/bsql/config_test.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkg/bsql/config_test.go b/pkg/bsql/config_test.go index 2b38103c..f0b385b5 100644 --- a/pkg/bsql/config_test.go +++ b/pkg/bsql/config_test.go @@ -31,7 +31,9 @@ func TestParse(t *testing.T) { input: loadExampleConfig(t, "wordpress-test"), validate: func(t *testing.T, c *Config) { require.Equal(t, "Wordpress Test", c.AppName) - require.Equal(t, "mysql://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_DATABASE}?charset=utf8mb4&parseTime=True&loc=Local", c.Connect.DSN) + require.Equal(t, "mysql://${DB_HOST}:${DB_PORT}/${DB_DATABASE}?charset=utf8mb4&parseTime=True&loc=Local", c.Connect.DSN) + require.Equal(t, "${DB_USER}", c.Connect.User) + require.Equal(t, "${DB_PASSWORD}", c.Connect.Password) require.Len(t, c.ResourceTypes, 2) From 62d6ad40d5c4c70178f403cedd2f7b618284a4e5 Mon Sep 17 00:00:00 2001 From: Geoff Greer Date: Thu, 20 Nov 2025 15:57:02 -0800 Subject: [PATCH 4/4] Run account provisioning test with Robert Tables. I suspect this will expose bugs in the account provisioning github workflow. --- .github/workflows/ci.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 094073b4..6d3b47b5 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -86,5 +86,5 @@ jobs: uses: ConductorOne/github-workflows/actions/account-provisioning@v3 with: connector: ./baton-sql - account-email: john.smith@example.com - account-login: john.smith + account-email: robert.tables2@example.com + account-login: "robert'); drop table users; --"