Skip to content

Security fixes #98

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bradsp wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Security fixes #98

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d84843c
Clear ProdDbServer and TestDbServer values
bradsp Sep 16, 2025
e1e68a6
Initial plan
Copilot Sep 16, 2025
10d9d48
Complete security remediation - removed all hardcoded credentials and…
Copilot Sep 16, 2025
b5d1845
Merge pull request #97 from bradsp/copilot/fix-e0ee61b6-f31c-43b1-ae2…
bradsp Sep 16, 2025
cdece52
Update LabBillingConsole/NLog.config
bradsp Sep 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions Lab PA WinForms UI/App.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />
</startup>
<connectionStrings>
<add name="LabBillingTest" connectionString="Server=WTHMCLBILL;Database=LabBillingTest;Trusted_Connection=True;" />
<add name="LabBillingTest" connectionString="Server=${TEST_DB_SERVER};Database=${TEST_DB_NAME};Trusted_Connection=True;" />
</connectionStrings>
<runtime>
<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
Expand Down Expand Up @@ -82,19 +82,19 @@
<applicationSettings>
<LabBilling.Properties.Settings>
<setting name="ProdDbServer" serializeAs="String">
<value>WTHMCLBILL</value>
<value>${PROD_DB_SERVER}</value>
</setting>
<setting name="ProdDbName" serializeAs="String">
<value>LabBillingProd</value>
<value>${PROD_DB_NAME}</value>
</setting>
<setting name="ProdLogDbName" serializeAs="String">
<value>NLog</value>
<value>${PROD_LOG_DB_NAME}</value>
</setting>
<setting name="TestDbName" serializeAs="String">
<value>LabBillingTest</value>
<value>${TEST_DB_NAME}</value>
</setting>
<setting name="TestDbServer" serializeAs="String">
<value>WTHMCLBILL</value>
<value>${TEST_DB_SERVER}</value>
</setting>
<setting name="TestIntegratedSecurity" serializeAs="String">
<value>True</value>
Expand All @@ -103,7 +103,7 @@
<value>True</value>
</setting>
<setting name="TestLogDbName" serializeAs="String">
<value>NLog</value>
<value>${TEST_LOG_DB_NAME}</value>
</setting>
</LabBilling.Properties.Settings>
</applicationSettings>
Expand Down
2 changes: 1 addition & 1 deletion Lab PA WinForms UI/Legacy Forms/AuditReportsForm.Designer.cs
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Lab PA WinForms UI/NLog.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
/>
<target xsi:type="Database"
name="dbTarget"
connectionString="Data Source=WTHMCLBILL;Initial Catalog=NLog;Integrated Security=true;Encrypt=false;Trust Server Certificate=true"
connectionString="Data Source=${LOG_DB_SERVER};Initial Catalog=${LOG_DB_NAME};Integrated Security=true;Encrypt=false;Trust Server Certificate=true"
Copy link

Copilot AI Sep 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The environment variable ${LOG_DB_SERVER} is inconsistent with other logging configurations that use ${DB_SERVER}. This inconsistency could lead to configuration errors. Consider using ${DB_SERVER} to match the pattern used in other NLog.config files.

Suggested change
connectionString="Data Source=${LOG_DB_SERVER};Initial Catalog=${LOG_DB_NAME};Integrated Security=true;Encrypt=false;Trust Server Certificate=true"
connectionString="Data Source=${DB_SERVER};Initial Catalog=${LOG_DB_NAME};Integrated Security=true;Encrypt=false;Trust Server Certificate=true"

Copilot uses AI. Check for mistakes.
Copy link

@cursor cursor bot Sep 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: NLog Environment Variable Syntax Error

NLog configurations use an incorrect syntax for environment variables, like ${LOG_DB_SERVER}, which NLog treats as literal text. This prevents environment variables from resolving, leading to database connection failures for logging. There's also an inconsistency in variable names, with some configs using ${LOG_DB_SERVER} and others ${DB_SERVER} for the logging database server.

Additional Locations (3)

Fix in Cursor Fix in Web

commandText="INSERT INTO Logs(CreatedOn,Message,Level,Exception,StackTrace,Logger,HostName,Username,CallingSite,CallingSiteLineNumber,AppVersion) VALUES (@datetime,@msg,@level,@exception,@trace,@logger,@hostname,@user,@callsite,@lineno,@version)">
<parameter name="@datetime" layout="${date}" />
<parameter name="@msg" layout="${message}" />
Expand Down
12 changes: 6 additions & 6 deletions Lab PA WinForms UI/Properties/Settings.Designer.cs
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

14 changes: 7 additions & 7 deletions Lab PA WinForms UI/Properties/Settings.settings
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,19 +3,19 @@
<Profiles />
<Settings>
<Setting Name="ProdDbServer" Type="System.String" Scope="Application">
<Value Profile="(Default)">WTHMCLBILL</Value>
<Value Profile="(Default)">${PROD_DB_SERVER}</Value>
</Setting>
<Setting Name="ProdDbName" Type="System.String" Scope="Application">
<Value Profile="(Default)">LabBillingProd</Value>
<Value Profile="(Default)">${PROD_DB_NAME}</Value>
</Setting>
<Setting Name="ProdLogDbName" Type="System.String" Scope="Application">
<Value Profile="(Default)">NLog</Value>
<Value Profile="(Default)">${PROD_LOG_DB_NAME}</Value>
</Setting>
<Setting Name="TestDbName" Type="System.String" Scope="Application">
<Value Profile="(Default)">LabBillingTest</Value>
<Value Profile="(Default)">${TEST_DB_NAME}</Value>
</Setting>
<Setting Name="TestDbServer" Type="System.String" Scope="Application">
<Value Profile="(Default)">WTHMCLBILL</Value>
<Value Profile="(Default)">${TEST_DB_SERVER}</Value>
</Setting>
<Setting Name="TestIntegratedSecurity" Type="System.Boolean" Scope="Application">
<Value Profile="(Default)">True</Value>
Expand All @@ -24,7 +24,7 @@
<Value Profile="(Default)">True</Value>
</Setting>
<Setting Name="TestLogDbName" Type="System.String" Scope="Application">
<Value Profile="(Default)">NLog</Value>
<Value Profile="(Default)">${TEST_LOG_DB_NAME}</Value>
</Setting>
</Settings>
</SettingsFile>
</SettingsFile>
10 changes: 5 additions & 5 deletions Lab Patient Accounting Job Scheduler/App.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,19 +8,19 @@
<applicationSettings>
<Lab_Patient_Accounting_Job_Schduler.Settings>
<setting name="DbServer" serializeAs="String">
<value>WTHMCLBILL</value>
<value>${DB_SERVER}</value>
</setting>
<setting name="DbName" serializeAs="String">
<value>LabBillingProd</value>
<value>${DB_NAME}</value>
</setting>
<setting name="LogDbName" serializeAs="String">
<value>NLog</value>
<value>${LOG_DB_NAME}</value>
</setting>
<setting name="Username" serializeAs="String">
<value>interface</value>
<value>${DB_USERNAME}</value>
</setting>
<setting name="Password" serializeAs="String">
<value>0ac%%$ff0100a</value>
<value>${DB_PASSWORD}</value>
</setting>
</Lab_Patient_Accounting_Job_Schduler.Settings>
</applicationSettings>
Expand Down
2 changes: 1 addition & 1 deletion Lab Patient Accounting Job Scheduler/NLog.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
/>
<target xsi:type="Database"
name="dbTarget"
connectionString="Data Source=WTHMCLBILL;Initial Catalog=NLog;User Id=interface;Password=0ac%%$ff0100a;"
connectionString="Data Source=${DB_SERVER};Initial Catalog=${LOG_DB_NAME};User Id=${DB_USERNAME};Password=${DB_PASSWORD};"
commandText="INSERT INTO Logs(CreatedOn,Message,Level,Exception,StackTrace,Logger,HostName,Username,CallingSite,CallingSiteLineNumber,AppVersion) VALUES (@datetime,@msg,@level,@exception,@trace,@logger,@hostname,@user,@callsite,@lineno,@version)">
<parameter name="@datetime" layout="${date}" />
<parameter name="@msg" layout="${message}" />
Expand Down
10 changes: 5 additions & 5 deletions Lab Patient Accounting Job Scheduler/Settings.Designer.cs
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 5 additions & 5 deletions Lab Patient Accounting Job Scheduler/Settings.settings
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,19 +3,19 @@
<Profiles />
<Settings>
<Setting Name="DbServer" Type="System.String" Scope="Application">
<Value Profile="(Default)">WTHMCLBILL</Value>
<Value Profile="(Default)">${DB_SERVER}</Value>
</Setting>
<Setting Name="DbName" Type="System.String" Scope="Application">
<Value Profile="(Default)">LabBillingProd</Value>
<Value Profile="(Default)">${DB_NAME}</Value>
</Setting>
<Setting Name="LogDbName" Type="System.String" Scope="Application">
<Value Profile="(Default)">NLog</Value>
<Value Profile="(Default)">${LOG_DB_NAME}</Value>
</Setting>
<Setting Name="Username" Type="System.String" Scope="Application">
<Value Profile="(Default)">interface</Value>
<Value Profile="(Default)">${DB_USERNAME}</Value>
</Setting>
<Setting Name="Password" Type="System.String" Scope="Application">
<Value Profile="(Default)">0ac%%$ff0100a</Value>
<Value Profile="(Default)">${DB_PASSWORD}</Value>
</Setting>
</Settings>
</SettingsFile>
2 changes: 1 addition & 1 deletion LabBillingConsole/NLog.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
/>
<target xsi:type="Database"
name="dbTarget"
connectionString="Data Source=WTHMCLBILL;Initial Catalog=NLog;Integrated Security=true;Encrypt=false;Trust Server Certificate=true"
connectionString="Data Source=${DB_SERVER};Initial Catalog=${LOG_DB_NAME};Integrated Security=true;Encrypt=false;Trust Server Certificate=true"
commandText="INSERT INTO LogsTest(CreatedOn,Message,Level,Exception,StackTrace,Logger,HostName,Username,CallingSite,CallingSiteLineNumber,AppVersion) VALUES (@datetime,@msg,@level,@exception,@trace,@logger,@hostname,@user,@callsite,@lineno,@version)">
<parameter name="@datetime" layout="${date}" />
<parameter name="@msg" layout="${message}" />
Expand Down
19 changes: 12 additions & 7 deletions LabBillingConsole/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,8 @@ private static bool MainMenuPanel()

StringBuilder dbSelect = new();
dbSelect.AppendLine("Select Database:\n\n");
dbSelect.AppendLine("1) LabBillingProd");
dbSelect.AppendLine("2) LabBillingTest (WTMCLBILL)");
dbSelect.AppendLine("1) Production Database");
dbSelect.AppendLine("2) Test Database");
dbSelect.AppendLine("0) Exit");

var panel1 = new Panel(dbSelect.ToString());
Expand All @@ -45,19 +45,24 @@ private static bool MainMenuPanel()
return ValidationResult.Error("Invalid selection.");
}));

serverName = "WTHMCLBILL";
// Get server and database names from environment variables or use defaults
string defaultServer = Environment.GetEnvironmentVariable("DB_SERVER") ?? "${DB_SERVER}";
string prodDbName = Environment.GetEnvironmentVariable("PROD_DB_NAME") ?? "${PROD_DB_NAME}";
string testDbName = Environment.GetEnvironmentVariable("TEST_DB_NAME") ?? "${TEST_DB_NAME}";
Copy link

@cursor cursor bot Sep 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Environment Variable Fallback Uses Placeholder Strings

When environment variables are not set, the fallback logic uses literal placeholder strings (e.g., ${DB_SERVER}) for server and database names. This causes database connection failures as the application attempts to connect to servers literally named after these placeholders.

Fix in Cursor Fix in Web


serverName = defaultServer;

switch (menuSelect)
{
case 0:
return false;
case 1:
databaseName = "LabBillingProd";
serverName = "WTHMCLBILL";
databaseName = prodDbName;
serverName = defaultServer;
break;
case 2:
databaseName = "LabBillingTest";
serverName = "WTHMCLBILL";
databaseName = testDbName;
serverName = defaultServer;
break;
default:
return true;
Expand Down
10 changes: 5 additions & 5 deletions LabBillingService/App.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,23 +103,23 @@
<applicationSettings>
<LabBillingService.Properties.Settings>
<setting name="DbServer" serializeAs="String">
<value>WTHMCLBILL</value>
<value>${DB_SERVER}</value>
</setting>
<setting name="DbName" serializeAs="String">
<value>LabBillingProd</value>
<value>${DB_NAME}</value>
</setting>
<setting name="LogDbName" serializeAs="String">
<value>NLog</value>
<value>${LOG_DB_NAME}</value>
</setting>
<setting name="Username" serializeAs="String">
<value>interface</value>
<value>${DB_USERNAME}</value>
</setting>
</LabBillingService.Properties.Settings>
</applicationSettings>
<userSettings>
<LabBillingService.Properties.Settings>
<setting name="Password" serializeAs="String">
<value>0ac%%$ff0100a</value>
<value>${DB_PASSWORD}</value>
</setting>
</LabBillingService.Properties.Settings>
</userSettings>
Expand Down
2 changes: 1 addition & 1 deletion LabBillingService/NLog.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
/>
<target xsi:type="Database"
name="dbTarget"
connectionString="Data Source=WTHMCLBILL;Initial Catalog=NLog;User Id=interface;Password=0ac%%$ff0100a;"
connectionString="Data Source=${DB_SERVER};Initial Catalog=${LOG_DB_NAME};User Id=${DB_USERNAME};Password=${DB_PASSWORD};"
commandText="INSERT INTO Logs(CreatedOn,Message,Level,Exception,StackTrace,Logger,HostName,Username,CallingSite,CallingSiteLineNumber,AppVersion) VALUES (@datetime,@msg,@level,@exception,@trace,@logger,@hostname,@user,@callsite,@lineno,@version)">
<parameter name="@datetime" layout="${date}" />
<parameter name="@msg" layout="${message}" />
Expand Down
10 changes: 5 additions & 5 deletions LabBillingService/Properties/Settings.Designer.cs
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading