Dave Burke : Freelance .NET Web Developer specializing in Online Communities

CodeSmith Project .csp ConnectionStrings Security Tip

I'm working on a CodeSmith template package for distribution that includes a Project .CSP file.  It will be important to set as many property defaults as possible to help people get up to speed with the templates, so I made an effort to set defaults across the board.

I noticed an aspect of how the CSP stores default values that may be something to watch out for if you ever distribute CodeSmith CSPs.  The CSP project properties are stored in XML.  Works great, but if your project uses a SQL object from a data source, that data source connection info will be stored in the CSP as XML.  You share that CSP and you share your connection string.  You would never see the connection string in the CodeSmith UI, but it's viewable when opening the CSP in a text editor.

I noticed this on a machine running CodeSmith 4.1.3, so for completeness I checked on a machine running CodeSmith 5.0.  The connection strings are stored differently in 4.x and 5.x, but they're present in both.

<property name="SourceTable">
    <connectionString>server=(local);uid=some_user;pwd=some_password;
        Trusted_Connection=yes;database=some_database</connectionString>
               <providerType>SchemaExplorer.SqlSchemaProvider,
                   SchemaExplorer.SqlSchemaProvider</providerType>
     <table>
      <owner>dbo</owner>
      <name>dbvt_sometable</name>
    </table>
</property>


Retaining property settings was added in CodeSmith 4.0 and it made life so much better. I'm cool with the connectionString being stored this way personally, since I know how much time I save by not having to re-establish connections. This is something to keep in mind, however, when distributing CodeSmith Project CSPs.

Comments (2) | Post RSS RSS comment feed

Posted on 10/8/2008 7:36:56 PM by Dave Burke
Categories: CodeSmith
Tags: No tags for this post

Related posts

Comments

10/9/2008 9:28:23 AM Permalink

Yeah, I think we should be encrypting the connection string.  This is something we have on our backlog to investigate.

Eric J. Smith United States |

10/9/2008 10:04:15 AM Permalink

Thanks for your comment, Eric.  Like I said, as long as people know about it I think we're good.  Encryption wouldn't hurt, of course.

Dave Burke United States |

Comments are closed

This site was built with the Sueetie .NET Online Community Framework. Learn more about Sueetie at Sueetie.com.