[6.1.7 Cherry-pick] Address CodeQL finding: PKCS#1 padding (SM03799) - #4526
Open
github-actions[bot] wants to merge 2 commits into
Open
[6.1.7 Cherry-pick] Address CodeQL finding: PKCS#1 padding (SM03799)#4526github-actions[bot] wants to merge 2 commits into
github-actions[bot] wants to merge 2 commits into
Conversation
To resolve, run: git cherry-pick c642196
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
… providers Manual resolution of the cherry-pick of #4517 into release/6.1. The upstream change annotated the sign/verify call sites in the refactored EncryptedColumnEncryptionKeyParameters and ColumnMasterKeyMetadata types, which do not exist on release/6.1. Applied the equivalent [SM03799] suppressions to the corresponding pre-refactor call sites in the certificate store, CNG, and CSP column encryption key store providers. Always Encrypted requires RSA PKCS#1 v1.5 signature padding for the encrypted CEK blob and column master key metadata. These formats are fixed by the Always Encrypted specification and are produced/consumed by SQL Server tooling and other drivers, so switching to PSS would break interoperability. The SM02196 weak-hash portion of #4517 targeted tools/PackageValidator, which does not exist on release/6.1, so it is not applicable here. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c71c86f5-f9e1-4ed5-a01b-a9f8113a171d
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
cheenamalhotra
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
Ports the upstream CodeQL suppression for SM03799 (RSA PKCS#1 v1.5 signature padding) into the release/6.1 branch by annotating the pre-refactor Always Encrypted provider call sites where PKCS#1 padding is required for interoperability.
Changes:
- Add
// CodeQL [SM03799]suppression annotations at Always Encrypted RSA sign/verify call sites in the CSP provider. - Add
// CodeQL [SM03799]suppression annotations at Always Encrypted RSA sign/verify call sites in the CNG provider. - Add
// CodeQL [SM03799]suppression annotations at Always Encrypted RSAPKCS1 formatter/deformatter usage in the certificate store provider.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlColumnEncryptionCspProvider.Windows.cs | Adds SM03799 suppression comments on PKCS#1 v1.5 SignData/VerifyData usage. |
| src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlColumnEncryptionCngProvider.Windows.cs | Adds SM03799 suppression comments on PKCS#1 v1.5 SignData/VerifyData usage. |
| src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlColumnEncryptionCertificateStoreProvider.Windows.cs | Adds SM03799 suppression comments around RSAPKCS1SignatureFormatter/Deformatter usage. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
mdaigle
approved these changes
Aug 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick of #4517 (c642196) into
release/6.1. Conflicts have been resolved manually.Conflict resolution
The upstream commit touched four files, none of which exist on
release/6.1:release/6.1.../AlwaysEncrypted/EncryptedColumnEncryptionKeyParameters.cs.../AlwaysEncrypted/ColumnMasterKeyMetadata.cstools/PackageValidator/src/AssemblyInspector.cstools/PackageValidator/src/PortablePdb.csSM03799 (PKCS#1 signature padding) — ported
On
main, the RSA PKCS#1 v1.5 sign/verify logic for all AE key store providers is centralized inEncryptedColumnEncryptionKeyParametersandColumnMasterKeyMetadata. Onrelease/6.1that logic still lives in the individual providers, so the// CodeQL [SM03799]suppressions were applied to the equivalent pre-refactor call sites:SqlColumnEncryptionCertificateStoreProvider.Windows.cs—RSAPKCS1SignatureFormatter/RSAPKCS1SignatureDeformatterSqlColumnEncryptionCngProvider.Windows.cs—SignData/VerifyDatawithRSASignaturePadding.Pkcs1SqlColumnEncryptionCspProvider.Windows.cs—RSACryptoServiceProvider.SignData/VerifyDataAlways Encrypted requires RSA PKCS#1 v1.5 signature padding for both the encrypted CEK blob and the column master key metadata. These formats are fixed by the Always Encrypted specification and are produced/consumed by SQL Server tooling and other drivers, so switching to PSS would break interoperability.
SM02196 (weak hash) — not applicable
That portion of #4517 targeted
tools/PackageValidator, which does not exist onrelease/6.1. No SHA-1 hashing occurs in the 6.1 driver sources outside the already-suppressedRSA_OAEP(SHA1)sites (SM03796). Nothing to port.Checklist