Enhancement: Harden getReference() to omit sensitive connection properties from JNDI Reference

[Muskan Gupta (muskan124947)]

Enhancement

SQLServerDataSource.getReference() now uses an explicit denylist and suffix-based matching to ensure credential-bearing connection properties are never serialized into the JNDI Reference object.

Problem

The previous implementation relied on a single propertyName.contains("password") check (case-sensitive substring match) to filter properties. This missed several sensitive properties that were added over time:

• accessToken
• keyStoreSecret
• keyVaultProviderClientKey
• clientKeyPassword (capital P — not caught by substring "password")
• AADSecurePrincipalSecret

Changes

• SQLServerDataSource.java — Replaced the fragile substring check with:

  • A static SENSITIVE_REFERENCE_PROPERTIES set containing all known credential property names (case-insensitive lookup)
  • A isSensitiveReferenceProperty() helper that also applies suffix matching (*password, *secret) as defense-in-depth for future properties

• SQLServerDataSourceReferenceSecurityTest.java (new) — Unit tests (no SQL Server required) verifying:

  • All sensitive properties are excluded from the Reference
  • Non-sensitive properties (serverName, databaseName, user) are preserved
  • Suffix-based matching works correctly

Testing

• mvn clean test -P jre21 -Dtest=SQLServerDataSourceReferenceSecurityTest — 2 tests pass
• Full compilation verified across jre21 profile

[Copilot]

Pull request overview

This PR hardens SQLServerDataSource#getReference() so that sensitive credential-bearing connection properties are omitted from the returned JNDI Reference, reducing the risk of information exposure (CWE-200) when JNDI references are persisted or inspected.

Changes:

• Add a sensitive-property filter (isSensitiveReferenceProperty) that omits known credential properties and any property names ending with password/secret from getReferenceInternal.
• Add unit tests asserting that sensitive properties are not serialized into the JNDI Reference.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/main/java/com/microsoft/sqlserver/jdbc/SQLServerDataSource.java	Adds denylist + suffix-based filtering to prevent credential properties from being added to the JNDI Reference.
src/test/java/com/microsoft/sqlserver/jdbc/unit/SQLServerDataSourceReferenceSecurityTest.java	Adds regression/unit tests to validate sensitive property omission behavior.

[codecov]

Codecov Report

❌ Patch coverage is 73.33333% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.35%. Comparing base (613e728) to head (04c5043).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
.../microsoft/sqlserver/jdbc/SQLServerDataSource.java	73.33%	1 Missing and 3 partials ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #2992      +/-   ##
============================================
+ Coverage     59.25%   59.35%   +0.10%     
- Complexity     5046     5079      +33     
============================================
  Files           153      153              
  Lines         36350    36368      +18     
  Branches       6650     6654       +4     
============================================
+ Hits          21538    21588      +50     
+ Misses        11053    11046       -7     
+ Partials       3759     3734      -25     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.