Fix XML parameter encoding for SQL Server#38462
Open
Copilot wants to merge 9 commits into
Open
Conversation
Co-authored-by: AndriySvyryd <6539701+AndriySvyryd@users.noreply.github.com>
Co-authored-by: AndriySvyryd <6539701+AndriySvyryd@users.noreply.github.com>
…mlReader Co-authored-by: AndriySvyryd <6539701+AndriySvyryd@users.noreply.github.com>
Co-authored-by: AndriySvyryd <6539701+AndriySvyryd@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
AndriySvyryd
June 19, 2026 01:36
View session
…rateNonNullSqlLiteral test Co-authored-by: AndriySvyryd <6539701+AndriySvyryd@users.noreply.github.com>
…xml literal unit test Co-authored-by: AndriySvyryd <6539701+AndriySvyryd@users.noreply.github.com>
AndriySvyryd
changed the title
There was a problem hiding this comment.
Pull request overview
This PR improves SQL Server xml handling in EF Core by ensuring XML values are sent as SqlDbType.Xml (using SqlXml) and by hardening the XML parsing path against DTD/XXE-style payloads, with accompanying unit/functional test coverage.
Changes:
- Update SQL Server string type mapping to treat
xmlas Unicode for SQL literal generation and to convert XML string parameters intoSqlXmlusing secureXmlReaderSettings. - Update the SQL Server type mapping source so the
xmlmapping is explicitly configured withSqlDbType.Xml. - Add/extend tests to validate
SqlXmlparameterization, round-tripping behavior, and rejection of DTD payloads.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| test/EFCore.SqlServer.Tests/Storage/SqlServerTypeMappingTest.cs | Adds unit tests asserting xml parameters are sent as SqlDbType.Xml and values are SqlXml. |
| test/EFCore.SqlServer.FunctionalTests/BuiltInDataTypesSqlServerTest.cs | Adds functional round-trip/query coverage for xml values and a negative test for DTD payload rejection; configures an xml-typed entity property in the fixture model. |
| src/EFCore.SqlServer/Storage/Internal/SqlServerTypeMappingSource.cs | Configures the xml mapping with sqlDbType: SqlDbType.Xml so parameters can be sent correctly as XML. |
| src/EFCore.SqlServer/Storage/Internal/SqlServerStringTypeMapping.cs | Adds secure XML reader settings and converts XML string parameters to SqlXml; adjusts Unicode literal handling for xml. |
Co-authored-by: AndriySvyryd <6539701+AndriySvyryd@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Comment on lines
124
to
+126
| _sqlDbType = sqlDbType; | ||
| _isUtf16 = parameters.Unicode | ||
| && (parameters.StoreType.StartsWith("n", StringComparison.OrdinalIgnoreCase) || _sqlDbType == SqlDbType.Xml); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #38429
Unicode xml SQL literal:
SqlServerStringTypeMappingnow treats thexmlstore type as Unicode (_isUtf16 = true), soGenerateNonNullSqlLiteralemits anN-prefixed literal. It also setsDbType = Xmlon the parameter and sends the value asSqlXml. Previously a non-Unicode (varchar) literal was generated forxml, silently losing non-ASCII content.