7f640e74e5
Some checks are pending
CI / Build og unit tests (push) Waiting to run
CI / Integration (mcr.microsoft.com/mssql/server:2017-latest) (push) Blocked by required conditions
CI / Integration (mcr.microsoft.com/mssql/server:2019-latest) (push) Blocked by required conditions
CI / Integration (mcr.microsoft.com/mssql/server:2022-latest) (push) Blocked by required conditions
CI / Integration (mcr.microsoft.com/mssql/server:2025-latest) (push) Blocked by required conditions
Rules can now be data: a JSON file with one read-only SELECT where every
row is a finding, with {column} templates, server or per-database scope,
minimum version, sensitive columns and references. Community rules live
in rules/community (reviewed via pull request), ship with every build
and with the signed rule pack; local rules are read from the agent's
data folder every five minutes. Queries are checked for anything that
could write, run with the least-privilege login, and a missing
permission makes the rule not measurable rather than failing. The
rule engine picks up catalog changes without a restart. Authors get
'rules validate' and 'rules test --instance'. Four example community
rules (sa active, orphaned database owners, default trace off,
untrusted foreign keys).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E3EExwndy8Z22EK2Qpt6BK
19 lines
1.3 KiB
JSON
19 lines
1.3 KiB
JSON
[
|
|
{
|
|
// Example of a database-scoped rule: the query runs in every online user database, and the column
|
|
// "database" is added to each row automatically.
|
|
"id": "COM-DB-001",
|
|
"title": "Fremmednøgler, som SQL Server ikke stoler på",
|
|
"severity": "Low",
|
|
"scope": "Database",
|
|
"query": "SELECT OBJECT_SCHEMA_NAME(parent_object_id) + '.' + OBJECT_NAME(parent_object_id) AS [table], name AS [constraint] FROM sys.foreign_keys WHERE is_not_trusted = 1 AND is_disabled = 0",
|
|
"subject": "constraint: {database}/{constraint}",
|
|
"findingTitle": "{database}: fremmednøglen {constraint} på {table} er ikke betroet",
|
|
"explanation": "Nøglen er blevet slået til igen uden WITH CHECK, fx efter en dataindlæsning. Den håndhæves for nye rækker, men SQL Server kan ikke stole på eksisterende data, så optimizeren udnytter den ikke til at fjerne joins, og der kan ligge ugyldige data.",
|
|
"recommendation": "Kontrollér og betro nøglen: ALTER TABLE {table} WITH CHECK CHECK CONSTRAINT [{constraint}]; Fejler det, findes der rækker, som bryder nøglen, og de skal rettes først. Kør det uden for spidsbelastning på store tabeller.",
|
|
"references": [
|
|
{ "title": "ALTER TABLE ... WITH CHECK", "url": "https://learn.microsoft.com/sql/t-sql/statements/alter-table-transact-sql" }
|
|
],
|
|
"author": "SQLInsight Pro"
|
|
}
|
|
]
|