Address CodeQL findings: PKCS#1 padding (SM03799) and weak hash (SM02196)

[cheenamalhotra]

Summary

Addresses two CodeQL/SDL findings.

SM03799 — RSA PKCS#1 v1.5 signature padding (Always Encrypted)

CodeQL flags RSASignaturePadding.Pkcs1 in the Always Encrypted signing/verification paths, recommending PSS instead.

These are false positives. The encrypted CEK blob and column master key metadata signatures are defined by an external standard — they are produced and verified by SQL Server tooling and other client drivers. Switching to PSS would produce blobs no other client could verify. Suppression comments are added, matching the existing SM03796 suppressions already present for RSA-OAEP(SHA1) in the same file.

• EncryptedColumnEncryptionKeyParameters.cs — SignHash/SignData (both NET and NETFRAMEWORK paths) and VerifyHash/VerifyData
• ColumnMasterKeyMetadata.cs — Sign() and Verify()

SM02196 — weak hash algorithm (PackageValidator)

• PortablePdb.CreateHashAlgorithm — SHA1 removed from the PDB checksum algorithm map. Modern compilers record SHA-2 checksums, and an unrecognized algorithm already degrades to an inconclusive result rather than a failure, so this is a no-op in practice while removing an SDL-banned hash.
• AssemblyInspector.ComputePublicKeyToken — suppressed. SHA-1 is mandated by ECMA-335 for strong-name public key tokens and is used purely as an identity computation, not a security boundary.

Validation

• Microsoft.Data.SqlClient.csproj (net9.0) builds clean — 0 warnings, 0 errors
• PackageValidator tests: 61/61 passing

Checklist

• Tests added or updated — N/A, no behavioral change requiring new tests
• Public API changes documented — N/A, no API changes
• Verified against customer repro (if applicable) — N/A
• Ensure no breaking changes introduced

[Copilot]

Pull request overview

This PR suppresses CodeQL rule SM03799 at Always Encrypted RSA signature call sites where RSASignaturePadding.Pkcs1 is required for interoperability with the Always Encrypted external specification, aligning with existing SM03796 suppressions in the same area.

Changes:

• Add // CodeQL [SM03799] suppressions for RSA PKCS#1 v1.5 signing/verification used by encrypted CEK blobs (NET + NETFRAMEWORK paths).
• Add // CodeQL [SM03799] suppressions for column master key metadata signing/verification.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/AlwaysEncrypted/EncryptedColumnEncryptionKeyParameters.cs	Adds CodeQL suppressions for PKCS#1 v1.5 signature generation/verification in encrypted CEK handling.
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/AlwaysEncrypted/ColumnMasterKeyMetadata.cs	Adds CodeQL suppressions for PKCS#1 v1.5 signature generation/verification for CMK metadata.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/AlwaysEncrypted/ColumnMasterKeyMetadata.cs:150

• XML doc comment has a stray trailing quote after the closing tag, which makes the documentation XML malformed and can surface as CS1570/CS1587 warnings (and potentially fail the build with TreatWarningsAsErrors).

    /// <exception cref="ArgumentNullException">Thrown when <paramref name="signature"/> is <see langword="null"/>.</exception>"

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.74%. Comparing base (9b20e5e) to head (882f759).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4517      +/-   ##
==========================================
- Coverage   64.63%   62.74%   -1.90%     
==========================================
  Files         288      283       -5     
  Lines       44088    67045   +22957     
==========================================
+ Hits        28497    42066   +13569     
- Misses      15591    24979    +9388     

Flag	Coverage Δ
CI-SqlClient	?
PR-SqlClient-Project	62.74% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.