Skip to content

Conversation

@mkincaid-bw
Copy link
Contributor

🎟️ Tracking

https://bitwarden.atlassian.net/browse/DBOPS-31

📔 Objective

Adding CSV import/export logic. Export works from SQL server, import works with SQL Server, Postgres, MariaDB, and Sqlite.

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

@github-actions
Copy link
Contributor

github-actions bot commented Nov 3, 2025

Logo
Checkmarx One – Scan Summary & Detailsed3eb021-777c-43b9-ba77-897900c6931f

New Issues (16)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
CRITICAL Second_Order_SQL_Injection /util/Seeder/Recipes/CsvMigrationRecipe.cs: 391
detailsThe application's method executes an SQL query with ExecuteScalar, at line 289 of /util/Seeder/Migration/Databases/SqliteImporter.cs. The applic...
ID: cGE3xOZaH88Gz%2Fcr%2FDgwiaYr%2FH8%3D
Attack Vector
CRITICAL Second_Order_SQL_Injection /util/Seeder/Migration/Databases/SqlServerImporter.cs: 230
detailsThe application's method executes an SQL query with ExecuteNonQuery, at line 442 of /util/Seeder/Migration/Databases/SqlServerImporter.cs. The a...
ID: D2zTXUpjPQNLJOavdVW1aoPwVh8%3D
Attack Vector
CRITICAL Second_Order_SQL_Injection /util/Seeder/Recipes/CsvMigrationRecipe.cs: 233
detailsThe application's method executes an SQL query with ExecuteScalar, at line 150 of /util/Seeder/Migration/Databases/SqlServerImporter.cs. The app...
ID: oNcghFr1WUnkpuxJAXuPBN4wGds%3D
Attack Vector
CRITICAL Second_Order_SQL_Injection /util/Seeder/Recipes/CsvMigrationRecipe.cs: 233
detailsThe application's method executes an SQL query with ExecuteScalar, at line 278 of /util/Seeder/Migration/Databases/MariaDbImporter.cs. The appli...
ID: cvol%2BqNTLHCuazHsKf5ovUT0jP8%3D
Attack Vector
CRITICAL Second_Order_SQL_Injection /util/Seeder/Recipes/CsvMigrationRecipe.cs: 233
detailsThe application's method executes an SQL query with ExecuteScalar, at line 289 of /util/Seeder/Migration/Databases/SqliteImporter.cs. The applic...
ID: Yt0EnFitMbr%2FFwkEqqFDICp%2Buaw%3D
Attack Vector
CRITICAL Second_Order_SQL_Injection /util/Seeder/Recipes/CsvMigrationRecipe.cs: 391
detailsThe application's method executes an SQL query with ExecuteScalar, at line 150 of /util/Seeder/Migration/Databases/SqlServerImporter.cs. The app...
ID: 9YEVCIRIBAoEECM7wXQ5aIGdItQ%3D
Attack Vector
CRITICAL Second_Order_SQL_Injection /util/Seeder/Recipes/CsvMigrationRecipe.cs: 391
detailsThe application's method executes an SQL query with ExecuteScalar, at line 278 of /util/Seeder/Migration/Databases/MariaDbImporter.cs. The appli...
ID: jXy10VD%2F66%2FbBIrDyONCnXgojlo%3D
Attack Vector
CRITICAL Second_Order_SQL_Injection /util/Seeder/Migration/Databases/PostgresImporter.cs: 110
detailsThe application's method executes an SQL query with ExecuteScalar, at line 391 of /util/Seeder/Migration/Databases/PostgresImporter.cs. The appl...
ID: DsjLOsHvgU49nzW3WKoS9N6dzbQ%3D
Attack Vector
CRITICAL Second_Order_SQL_Injection /util/Seeder/Migration/Databases/PostgresImporter.cs: 110
detailsThe application's method executes an SQL query with ExecuteNonQuery, at line 416 of /util/Seeder/Migration/Databases/PostgresImporter.cs. The ap...
ID: cMOFslLrlh4a7megM8jtTnDY0yo%3D
Attack Vector
CRITICAL Second_Order_SQL_Injection /util/Seeder/Migration/Databases/SqlServerImporter.cs: 351
detailsThe application's method executes an SQL query with ExecuteNonQuery, at line 372 of /util/Seeder/Migration/Databases/SqlServerImporter.cs. The a...
ID: W8AhIpUs%2FnL4Z%2FCnG5MTXAUbGYI%3D
Attack Vector
CRITICAL Second_Order_SQL_Injection /util/Seeder/Migration/Databases/SqlServerExporter.cs: 71
detailsThe application's method executes an SQL query with ExecuteScalar, at line 155 of /util/Seeder/Migration/Databases/SqlServerExporter.cs. The app...
ID: AHp6wtyGm9TwCJdFgCbM3n%2Boylw%3D
Attack Vector
CRITICAL Second_Order_SQL_Injection /util/Seeder/Migration/Databases/SqlServerExporter.cs: 71
detailsThe application's method executes an SQL query with ExecuteReader, at line 258 of /util/Seeder/Migration/Databases/SqlServerExporter.cs. The app...
ID: pUWaZllxqSH5vLyyMOtiyIqJFOM%3D
Attack Vector
CRITICAL Second_Order_SQL_Injection /util/Seeder/Migration/Databases/SqlServerExporter.cs: 71
detailsThe application's method executes an SQL query with ExecuteReader, at line 196 of /util/Seeder/Migration/Databases/SqlServerExporter.cs. The app...
ID: nvMr%2BozK2J%2F1bijteGSMyl1NZnU%3D
Attack Vector
CRITICAL Second_Order_SQL_Injection /util/Seeder/Migration/Databases/PostgresImporter.cs: 110
detailsThe application's method executes an SQL query with ExecuteNonQuery, at line 316 of /util/Seeder/Migration/Databases/PostgresImporter.cs. The ap...
ID: 5tjJy8lr0qKxFDozko6MimNymrU%3D
Attack Vector
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1173
detailsMethod at line 1173 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
ID: 6GA994hLReGx06zegbIVf0zLKS8%3D
Attack Vector
MEDIUM CSRF /src/Api/Vault/Controllers/CiphersController.cs: 1063
detailsMethod at line 1063 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ...
ID: 1ASa3fD%2B%2F8ZzX0qmzlB45VXqwoc%3D
Attack Vector

@codecov
Copy link

codecov bot commented Nov 3, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 52.27%. Comparing base (b4d6f3c) to head (bb30b54).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #6534   +/-   ##
=======================================
  Coverage   52.27%   52.27%           
=======================================
  Files        1909     1909           
  Lines       84598    84598           
  Branches     7558     7558           
=======================================
  Hits        44223    44223           
  Misses      38659    38659           
  Partials     1716     1716           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

using var command = new NpgsqlCommand(query, _connection);
command.Parameters.AddWithValue("tableName", tableName);

using var reader = command.ExecuteReader();

Check failure

Code scanning / Checkmarx One

Second Order SQL Injection Critical

Second Order SQL Injection
using var command = new NpgsqlCommand(query, _connection);
command.Parameters.AddWithValue("tableName", tableName);

using var reader = command.ExecuteReader();

Check failure

Code scanning / Checkmarx One

Second Order SQL Injection Critical

Second Order SQL Injection
using var command = new NpgsqlCommand(query, _connection);
command.Parameters.AddWithValue("tableName", tableName);

using var reader = command.ExecuteReader();

Check failure

Code scanning / Checkmarx One

Second Order SQL Injection Critical

Second Order SQL Injection
query += " ORDER BY TABLE_NAME";

using var command = new SqlCommand(query, _connection);
using var reader = command.ExecuteReader();

Check failure

Code scanning / Checkmarx One

Second Order SQL Injection Critical

Second Order SQL Injection
query += " ORDER BY TABLE_NAME";

using var command = new SqlCommand(query, _connection);
using var reader = command.ExecuteReader();

Check failure

Code scanning / Checkmarx One

Second Order SQL Injection Critical

Second Order SQL Injection

importer.DisableForeignKeys();

var csvFiles = Directory.GetFiles(_config.CsvSettings.OutputDir, "*.csv");

Check failure

Code scanning / Checkmarx One

Second Order SQL Injection Critical

Second Order SQL Injection

importer.DisableForeignKeys();

var csvFiles = Directory.GetFiles(_config.CsvSettings.OutputDir, "*.csv");

Check failure

Code scanning / Checkmarx One

Second Order SQL Injection Critical

Second Order SQL Injection
var reporter = new VerificationReporter(_loggerFactory.CreateLogger<VerificationReporter>());
reporter.StartVerification();

var csvFiles = Directory.GetFiles(_config.CsvSettings.OutputDir, "*.csv");

Check failure

Code scanning / Checkmarx One

Second Order SQL Injection Critical

Second Order SQL Injection
var reporter = new VerificationReporter(_loggerFactory.CreateLogger<VerificationReporter>());
reporter.StartVerification();

var csvFiles = Directory.GetFiles(_config.CsvSettings.OutputDir, "*.csv");

Check failure

Code scanning / Checkmarx One

Second Order SQL Injection Critical

Second Order SQL Injection
var reporter = new VerificationReporter(_loggerFactory.CreateLogger<VerificationReporter>());
reporter.StartVerification();

var csvFiles = Directory.GetFiles(_config.CsvSettings.OutputDir, "*.csv");

Check failure

Code scanning / Checkmarx One

Second Order SQL Injection Critical

Second Order SQL Injection
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants