Skip to content

Commit 29788eb

Browse files
authored
Remove examples that show insecure practices (dotnet#10435)
1 parent ca370f1 commit 29788eb

File tree

45 files changed

+834
-1737
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+834
-1737
lines changed

includes/forms-auth-warning.md

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
> [!WARNING]
2+
> Storing user credentials in the `credentials` section is **insecure**. Instead, use [Azure Key Vault](/azure/key-vault/general/overview).

includes/ropc-warning.md

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
> [!WARNING]
2+
> Microsoft does not recommend providing your user name and password directly, because it's an insecure pattern. Where possible, use more secure authentication flows, such as [Managed Identities for Azure resources](/sql/connect/ado-net/sql/azure-active-directory-authentication#using-managed-identity-authentication), or [Windows authentication](/sql/relational-databases/security/choose-an-authentication-mode#connecting-through-windows-authentication) for SQL Server.

snippets/csharp/VS_Snippets_ADO.NET/Classic WebData SqlCommand.ExecuteReader Example/CS/Project.csproj

+4-4
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22

33
<PropertyGroup>
44
<OutputType>Exe</OutputType>
5-
<TargetFramework>net6.0</TargetFramework>
5+
<TargetFramework>net8.0</TargetFramework>
66
</PropertyGroup>
7-
7+
88
<ItemGroup>
9-
<PackageReference Include="System.Data.SqlClient" Version="4.8.3" />
9+
<PackageReference Include="System.Data.SqlClient" Version="4.8.6" />
1010
</ItemGroup>
11-
11+
1212
</Project>
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
<Project Sdk="Microsoft.NET.Sdk">
2-
2+
33
<PropertyGroup>
44
<OutputType>Exe</OutputType>
5-
<TargetFramework>net6.0</TargetFramework>
5+
<TargetFramework>net8.0</TargetFramework>
66
</PropertyGroup>
7-
7+
88
<ItemGroup>
9-
<PackageReference Include="System.Data.SqlClient" Version="4.8.3" />
9+
<PackageReference Include="System.Data.SqlClient" Version="4.8.6" />
1010
</ItemGroup>
11-
11+
1212
</Project>

snippets/csharp/VS_Snippets_ADO.NET/Classic WebData SqlConnection.BeginTransaction Example/CS/Project.csproj

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22

33
<PropertyGroup>
44
<OutputType>Exe</OutputType>
5-
<TargetFramework>net6.0</TargetFramework>
5+
<TargetFramework>net8.0</TargetFramework>
66
</PropertyGroup>
77

88
<ItemGroup>
9-
<PackageReference Include="System.Data.SqlClient" Version="4.8.3" />
9+
<PackageReference Include="System.Data.SqlClient" Version="4.8.6" />
1010
</ItemGroup>
1111

12-
</Project>
12+
</Project>

snippets/csharp/VS_Snippets_ADO.NET/Classic WebData SqlConnection.BeginTransaction2 Example/CS/Project.csproj

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22

33
<PropertyGroup>
44
<OutputType>Exe</OutputType>
5-
<TargetFramework>net6.0</TargetFramework>
5+
<TargetFramework>net8.0</TargetFramework>
66
</PropertyGroup>
77

88
<ItemGroup>
9-
<PackageReference Include="System.Data.SqlClient" Version="4.8.3" />
9+
<PackageReference Include="System.Data.SqlClient" Version="4.8.6" />
1010
</ItemGroup>
1111

12-
</Project>
12+
</Project>

snippets/csharp/VS_Snippets_ADO.NET/Classic WebData SqlConnection.BeginTransaction3 Example/CS/Project.csproj

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22

33
<PropertyGroup>
44
<OutputType>Exe</OutputType>
5-
<TargetFramework>net6.0</TargetFramework>
5+
<TargetFramework>net8.0</TargetFramework>
66
</PropertyGroup>
77

88
<ItemGroup>
9-
<PackageReference Include="System.Data.SqlClient" Version="4.8.3" />
9+
<PackageReference Include="System.Data.SqlClient" Version="4.8.6" />
1010
</ItemGroup>
1111

12-
</Project>
12+
</Project>

snippets/csharp/VS_Snippets_ADO.NET/Classic WebData SqlDataReader.Read Example/CS/SqlDataReader.Read.csproj

+2-3
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,11 @@
22

33
<PropertyGroup>
44
<OutputType>Exe</OutputType>
5-
<TargetFramework>net6.0</TargetFramework>
6-
<Nullable>enable</Nullable>
5+
<TargetFramework>net8.0</TargetFramework>
76
</PropertyGroup>
87

98
<ItemGroup>
10-
<PackageReference Include="System.Data.SqlClient" Version="4.8.3" />
9+
<PackageReference Include="System.Data.SqlClient" Version="4.8.6" />
1110
</ItemGroup>
1211

1312
</Project>
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<OutputType>Exe</OutputType>
5+
<TargetFramework>net8.0</TargetFramework>
6+
</PropertyGroup>
7+
8+
<ItemGroup>
9+
<PackageReference Include="System.Data.SqlClient" Version="4.8.6" />
10+
</ItemGroup>
11+
12+
</Project>

snippets/csharp/VS_Snippets_ADO.NET/DataWorks SqlConnectionStringBuilder.Remove/CS/source.cs

+10-19
Original file line numberDiff line numberDiff line change
@@ -10,38 +10,29 @@ static void Main()
1010
try
1111
{
1212
string connectString =
13-
"Data Source=(local);User ID=ab;Password= a1Pass@@11;" +
13+
"Data Source=(local);User ID=ab;Password=myPassw0rd;" +
1414
"Initial Catalog=AdventureWorks";
1515

16-
SqlConnectionStringBuilder builder = new SqlConnectionStringBuilder(connectString);
17-
Console.WriteLine("Original: " + builder.ConnectionString);
16+
SqlConnectionStringBuilder builder = new(connectString);
17+
Console.WriteLine($"Original: {builder.ConnectionString}");
1818

19-
// Use the Remove method
20-
// in order to reset the user ID and password back to their
21-
// default (empty string) values.
19+
// Remove the User ID and Password.
2220
builder.Remove("User ID");
2321
builder.Remove("Password");
2422

25-
// Turn on integrated security:
23+
// Enable integrated security.
2624
builder.IntegratedSecurity = true;
2725

28-
Console.WriteLine("Modified: " + builder.ConnectionString);
29-
30-
using (SqlConnection
31-
connection = new SqlConnection(builder.ConnectionString))
32-
{
33-
connection.Open();
34-
// Now use the open connection.
35-
Console.WriteLine("Database = " + connection.Database);
36-
}
26+
Console.WriteLine($"Modified: {builder.ConnectionString}");
3727
}
3828
catch (Exception ex)
3929
{
4030
Console.WriteLine(ex.Message);
4131
}
42-
43-
Console.WriteLine("Press any key to finish.");
44-
Console.ReadLine();
4532
}
4633
}
34+
/* This code example produces the following output:
35+
* Original: Data Source=(local);Initial Catalog=AdventureWorks;User ID=ab;Password=myPassw0rd
36+
* Modified: Data Source=(local);Initial Catalog=AdventureWorks;Integrated Security=True
37+
*/
4738
// </Snippet1>
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<OutputType>Exe</OutputType>
5+
<TargetFramework>net4.8</TargetFramework>
6+
<LangVersion>11</LangVersion>
7+
</PropertyGroup>
8+
9+
<ItemGroup>
10+
<PackageReference Include="System.Data.SqlClient" Version="4.8.6" />
11+
</ItemGroup>
12+
13+
</Project>
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,37 @@
1-

2-
3-
using System;
4-
// <Snippet1>
5-
using System.Data;
1+
using System;
62
using System.Data.SqlClient;
73

84
class Program
95
{
106
static void Main()
117
{
8+
// <Snippet1>
129
// Create a new SqlConnectionStringBuilder and
1310
// initialize it with a few name/value pairs.
14-
SqlConnectionStringBuilder builder =
15-
new SqlConnectionStringBuilder(GetConnectionString());
11+
SqlConnectionStringBuilder builder = new(
12+
"Server=(local);Integrated Security=true;" +
13+
"Initial Catalog=AdventureWorks"
14+
);
1615

1716
// The input connection string used the
1817
// Server key, but the new connection string uses
1918
// the well-known Data Source key instead.
20-
Console.WriteLine(builder.ConnectionString);
21-
22-
// Pass the SqlConnectionStringBuilder an existing
23-
// connection string, and you can retrieve and
24-
// modify any of the elements.
25-
builder.ConnectionString = "server=(local);user id=ab;" +
26-
"password= a!Pass113;initial catalog=AdventureWorks";
19+
Console.WriteLine($"Original connection string: '{builder.ConnectionString}'");
2720

2821
// Now that the connection string has been parsed,
2922
// you can work with individual items.
30-
Console.WriteLine(builder.Password);
31-
builder.Password = "new@1Password";
23+
Console.WriteLine($"Initial catalog: '{builder.InitialCatalog}'");
24+
builder.InitialCatalog = "Northwind";
3225
builder.AsynchronousProcessing = true;
3326

3427
// You can refer to connection keys using strings,
3528
// as well. When you use this technique (the default
3629
// Item property in Visual Basic, or the indexer in C#),
37-
// you can specify any synonym for the connection string key
38-
// name.
30+
// you can specify any synonym for the connection string key name.
3931
builder["Server"] = ".";
4032
builder["Connect Timeout"] = 1000;
4133
builder["Trusted_Connection"] = true;
42-
Console.WriteLine(builder.ConnectionString);
43-
44-
Console.WriteLine("Press Enter to finish.");
45-
Console.ReadLine();
46-
}
47-
48-
private static string GetConnectionString()
49-
{
50-
// To avoid storing the connection string in your code,
51-
// you can retrieve it from a configuration file.
52-
return "Server=(local);Integrated Security=SSPI;" +
53-
"Initial Catalog=AdventureWorks";
34+
Console.WriteLine($"Modified connection string: '{builder.ConnectionString}'");
35+
// </Snippet1>
5436
}
5537
}
56-
// </Snippet1>
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<OutputType>Exe</OutputType>
5+
<TargetFramework>net4.8</TargetFramework>
6+
</PropertyGroup>
7+
8+
<ItemGroup>
9+
<Reference Include="System.Configuration" />
10+
<Reference Include="System.Web" />
11+
</ItemGroup>
12+
13+
</Project>
Original file line numberDiff line numberDiff line change
@@ -1,61 +1,52 @@
11
using System;
2-
using System.Configuration;
3-
using System.Web.Configuration;
42
using System.Web;
3+
using System.Web.Configuration;
54

65
namespace Samples.AspNet.Configuration
76
{
8-
97
class UsingAuthenticationSection
108
{
11-
public static void Main()
12-
{
13-
9+
public static void Main()
10+
{
1411
// <Snippet1>
1512
// Get the Web application configuration.
1613
System.Configuration.Configuration configuration =
17-
System.Web.Configuration.WebConfigurationManager.OpenWebConfiguration(
14+
WebConfigurationManager.OpenWebConfiguration(
1815
"/aspnetTest");
1916

20-
// Get the section.
17+
// Get the authentication section.
2118
AuthenticationSection authenticationSection =
2219
(AuthenticationSection)configuration.GetSection(
2320
"system.web/authentication");
24-
2521
// </Snippet1>
2622

2723
// <Snippet2>
28-
AuthenticationSection newauthenticationSection =
24+
AuthenticationSection newauthenticationSection =
2925
new AuthenticationSection();
30-
3126
// </Snippet2>
3227

3328
// <Snippet3>
3429
// Get the current Passport property.
35-
PassportAuthentication currentPassport =
30+
PassportAuthentication currentPassport =
3631
authenticationSection.Passport;
3732

3833
// Get the Passport redirect URL.
39-
string passRedirectUrl =
40-
currentPassport.RedirectUrl;
41-
34+
string passRedirectUrl = currentPassport.RedirectUrl;
4235
// </Snippet3>
4336

4437
// <Snippet4>
4538
// Get the current Mode property.
46-
AuthenticationMode currentMode =
39+
AuthenticationMode currentMode =
4740
authenticationSection.Mode;
4841

4942
// Set the Mode property to Windows.
50-
authenticationSection.Mode =
43+
authenticationSection.Mode =
5144
AuthenticationMode.Windows;
52-
5345
// </Snippet4>
5446

5547
// <Snippet5>
5648
// Get the current Forms property.
57-
58-
FormsAuthenticationConfiguration currentForms =
49+
FormsAuthenticationConfiguration currentForms =
5950
authenticationSection.Forms;
6051

6152
// Get the Forms attributes.
@@ -71,8 +62,7 @@ public static void Main()
7162
FormsProtectionEnum protection = currentForms.Protection;
7263
string defaultUrl = currentForms.DefaultUrl;
7364
string domain = currentForms.Domain;
74-
7565
// </Snippet5>
7666
}
77-
}
67+
}
7868
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<OutputType>Exe</OutputType>
5+
<TargetFramework>net4.8</TargetFramework>
6+
</PropertyGroup>
7+
8+
<ItemGroup>
9+
<Reference Include="System.Configuration" />
10+
<Reference Include="System.Web" />
11+
</ItemGroup>
12+
13+
</Project>

0 commit comments

Comments
 (0)