Cherry Pick OData filter format in JWT string claims (#3510)#3528
Merged
RubenCerna2079 merged 3 commits intorelease/2.0from May 7, 2026
Merged
Cherry Pick OData filter format in JWT string claims (#3510)#3528RubenCerna2079 merged 3 commits intorelease/2.0from
RubenCerna2079 merged 3 commits intorelease/2.0from
Conversation
## Why make this change?
Fixes the format of the OData filter in JWT string claims.
## What is this change?
In `AuthorizationResolver` we now escape embedded single quotes in claim
values by doubling them, before we wrap the value in single quotes for
OData substitution. This conforms to the OData 4.01 ABNF rule for string
literals (Section 7: Literal Data Values).
Policy: `@item.col1 eq @claims.userId`
Claim `userId` value: `alice' or 1 eq 1 or '`
| | Resulting OData predicate |
| --- | --- |
| Before | `col1 eq 'alice' or 1 eq 1 or ''` <- injects `or 1 eq 1`,
bypassing row-level auth |
| After | `col1 eq 'alice'' or 1 eq 1 or '''` <- attacker payload
contained inside a single string literal |
## How was this tested?
New parameterized test
`DbPolicy_StringClaim_SingleQuotesEscaped_PreventsODataInjection` in
`src/Service.Tests/Authorization/AuthorizationResolverUnitTests.cs`
covers:
- Active OR-predicate injection attempt is neutralized.
- Legitimate apostrophe-bearing value (e.g. `O'Brien`) is safely
escaped.
- Value composed solely of single quotes is fully escaped.
- Value with no single quotes is unchanged aside from the enclosing
quotes (no regression).
## Sample Request(s)
```json
{
"entities": {
"Note": {
"source": "dbo.Notes",
"permissions": [
{
"role": "authenticated",
"actions": [
{
"action": "read",
"policy": { "database": "@item.ownerId eq @claims.userId" }
}
]
}
]
}
}
}
```
Reproduction - `userId` claim value of `alice' or 1 eq 1 or '`:
```http
GET /api/Note HTTP/1.1
Authorization: Bearer <jwt-with-crafted-userId-claim>
X-MS-API-ROLE: authenticated
```
- Before fix: the engine emitted `WHERE ownerId = 'alice' or 1 eq 1 or
''`, returning rows owned by other users.
- After fix: the engine emits `WHERE ownerId = 'alice'' or 1 eq 1 or
'''`, which compares against the literal string `alice' or 1 eq 1 or '`
and returns no unauthorized rows.
Co-authored-by: Souvik Ghosh <souvikofficial04@gmail.com>
Co-authored-by: Aniruddh Munde <anmunde@microsoft.com>
(cherry picked from commit 0512b00)
aaronburtle
requested review from
Alekhya-Polavarapu,
Aniruddh25,
JerryNixon,
RubenCerna2079,
anushakolan,
rusamant,
sourabh1007,
souvikghosh04,
stuartpa and
vadeveka
as code owners
Contributor
There was a problem hiding this comment.
Pull request overview
This PR cherry-picks a security fix to ensure JWT string-typed claim values are safely substituted into database authorization (OData) policies by escaping embedded single quotes, preventing OData filter injection via claim contents.
Changes:
- Escape single quotes in
ClaimValueTypes.Stringclaim values by doubling them per OData 4.01 string literal rules. - Add unit tests covering injection-like and legitimate single-quote-containing claim values to validate safe policy substitution.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| src/Core/Authorization/AuthorizationResolver.cs | Escapes embedded single quotes in string claim literals before substituting into DB policies. |
| src/Service.Tests/Authorization/AuthorizationResolverUnitTests.cs | Adds unit tests verifying single-quote escaping prevents OData predicate injection and preserves valid values. |
RubenCerna2079
approved these changes
May 7, 2026
souvikghosh04
approved these changes
May 7, 2026
github-project-automation
Bot
moved this from Review In Progress
to Done
in Data API builder
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why make this change?
Closes #3527
What is this change?
Cherry pick #3510
How was this tested?
New tests run against main, and the current test suite.