FIX: security issue SEC101/037 : SQLLegacyCredentials fix

[Subrata (subrata-ms)]

Work Item / Issue Reference

[AB#40951

GitHub Issue: #<ISSUE_NUMBER>

---

Summary

This pull request updates several test files to improve security and consistency in database connection strings. The main change is replacing hardcoded usernames and passwords with Trusted_Connection=yes in all connection strings, and in some cases, using environment variables for server and database names. This prevents the exposure of credentials and avoids related security warnings.

Test connection string improvements:

• Replaced all hardcoded UID and PWD parameters in connection strings with Trusted_Connection=yes in tests/test_002_types.py, tests/test_013_sqlwchar_conversions.py, and tests/test_014_ddbc_bindings_coverage.py, enhancing security and aligning with best practices. [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20][21][22][23][24][25][26][27][28][29][30]

• Updated some tests in tests/test_002_types.py to use os.getenv for TEST_SERVER and TEST_DATABASE, allowing for configurable test environments and reducing hardcoded values. [1][2][3]

These changes make the test suite safer to run in different environments and prevent accidental credential leaks.

[github-actions]

📊 Code Coverage Report

🔥 Diff Coverage 100%

🎯 Overall Coverage 74%

📈 Total Lines Covered:5265 out of 7029 📁 Project:mssql-python

---

Diff Coverage

Diff: main...HEAD, staged and unstaged changes

No lines with coverage information in this diff.

---

📋 Files Needing Attention

📉 Files with overall lowest coverage (click to expand)

mssql_python.pybind.logger_bridge.hpp: 58.8%
mssql_python.pybind.logger_bridge.cpp: 59.2%
mssql_python.pybind.ddbc_bindings.cpp: 66.2%
mssql_python.row.py: 66.2%
mssql_python.helpers.py: 67.5%
mssql_python.pybind.connection.connection.cpp: 73.6%
mssql_python.ddbc_bindings.py: 79.6%
mssql_python.connection.py: 83.5%
mssql_python.cursor.py: 84.3%
mssql_python.__init__.py: 84.9%

---

🔗 Quick Links

⚙️ Build Summary	📋 Coverage Details
View Azure DevOps Build	Browse Full Coverage Report

[Copilot]

Pull request overview

This PR addresses a security issue (SEC101/037: SQLLegacyCredentials) by removing hardcoded credentials from test connection strings. The fix replaces UID and PWD parameters with Trusted_Connection=yes across multiple test files and introduces environment variable usage for server and database names in select tests.

Key changes:

• Removed all hardcoded username/password credentials from test connection strings
• Replaced credential parameters with Trusted_Connection=yes for Windows authentication
• Added environment variable support (TEST_SERVER, TEST_DATABASE) in one test function to enable configurable test environments

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
tests/test_002_types.py	Updated three connection strings in test_invalid_surrogate_handling() to use Trusted_Connection=yes and added environment variable support for server/database names with os.getenv()
tests/test_013_sqlwchar_conversions.py	Systematically replaced all hardcoded UID=user;PWD=pass with Trusted_Connection=yes across 21 connection strings in various test methods
tests/test_014_ddbc_bindings_coverage.py	Replaced all hardcoded UID=u;PWD=p with Trusted_Connection=yes across 12 connection strings in various test methods

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.