From d8aaf00c1ec4d82526dd713ac7559e2e36a1c9ae Mon Sep 17 00:00:00 2001 From: Martijn Verbraak Date: Fri, 16 Oct 2026 17:00:48 +0200 Subject: [PATCH 1/3] Fix: Reject null, empty, or whitespace-only attribute values in create.ps1 and update.ps1 to prevent invalid entries in the blocklist --- CHANGELOG.md | 7 +++++++ UniquenessCheck/uniquenessCheckAdChecksSql.ps1 | 16 ++++++++-------- create.ps1 | 5 +++++ update.ps1 | 5 +++++ 4 files changed, 25 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 085d61b..830f86c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,13 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/). + +## [2.2.1] - 2026-10-16 + +### Fixed + +- Reject null, empty, or whitespace-only attribute values in `create.ps1` and `update.ps1` with an attribute-specific audit error, preventing empty values from being stored in the blocklist. + ## [2.2.0] - 2026-08-03 ### Added diff --git a/UniquenessCheck/uniquenessCheckAdChecksSql.ps1 b/UniquenessCheck/uniquenessCheckAdChecksSql.ps1 index 7e8fd0a..061fc34 100644 --- a/UniquenessCheck/uniquenessCheckAdChecksSql.ps1 +++ b/UniquenessCheck/uniquenessCheckAdChecksSql.ps1 @@ -1,5 +1,5 @@ ######################################################################### -# HelloID-Conn-Prov-Target-Blocklist-Check-On-External-Systems-AD-SQL +# HelloID-Conn-Prov-Target-Blocklist-Check-On-External-Systems-SQL ######################################################################### # Initialize default properties @@ -81,15 +81,15 @@ $fieldsToCheck = [PSCustomObject]@{ "sAMAccountName" = [PSCustomObject]@{ systemFieldName = 'sAMAccountName' accountValue = $a.sAMAccountName - keepInSyncWith = @("commonName") - crossCheckOn = $null - } - "commonName" = [PSCustomObject]@{ - systemFieldName = 'cn' - accountValue = $a.commonName - keepInSyncWith = @("sAMAccountName") + keepInSyncWith = $null crossCheckOn = $null } + # "commonName" = [PSCustomObject]@{ + # systemFieldName = 'cn' + # accountValue = $a.commonName + # keepInSyncWith = @("sAMAccountName") + # crossCheckOn = $null + # } } #endregion Change mapping here diff --git a/create.ps1 b/create.ps1 index 3cf8131..0e394b2 100644 --- a/create.ps1 +++ b/create.ps1 @@ -200,6 +200,11 @@ try { } foreach ($attributeName in $attributeNames) { + if ([string]::IsNullOrWhiteSpace($actionContext.Data.$attributeName)) { + $actionMessage = "validating attribute [$attributeName]" + throw "Attribute [$attributeName] must not be null, empty or whitespace." + } + # Check if attribute is in table $actionMessage = "querying row in table [$table] where [$($attributeName)] = [$($actionContext.Data.$attributeName)]" diff --git a/update.ps1 b/update.ps1 index a208605..51952aa 100644 --- a/update.ps1 +++ b/update.ps1 @@ -203,6 +203,11 @@ try { } foreach ($attributeName in $attributeNames) { + if ([string]::IsNullOrWhiteSpace($actionContext.Data.$attributeName)) { + $actionMessage = "validating attribute [$attributeName]" + throw "Attribute [$attributeName] must not be null, empty or whitespace." + } + # Check if attribute is in table $actionMessage = "querying row in table [$table] where [$($attributeName)] = [$($actionContext.Data.$attributeName)]" From 462abc99e7de9f9eccc736f7f5da089a43c1611a Mon Sep 17 00:00:00 2001 From: Martijn Verbraak Date: Fri, 16 Oct 2026 17:00:48 +0200 Subject: [PATCH 2/3] Fix: Reject null, empty, or whitespace-only attribute values in create.ps1 and update.ps1 to prevent invalid entries in the blocklist --- CHANGELOG.md | 7 +++++++ UniquenessCheck/uniquenessCheckAdChecksSql.ps1 | 2 +- create.ps1 | 5 +++++ update.ps1 | 5 +++++ 4 files changed, 18 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 085d61b..830f86c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,13 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/). + +## [2.2.1] - 2026-10-16 + +### Fixed + +- Reject null, empty, or whitespace-only attribute values in `create.ps1` and `update.ps1` with an attribute-specific audit error, preventing empty values from being stored in the blocklist. + ## [2.2.0] - 2026-08-03 ### Added diff --git a/UniquenessCheck/uniquenessCheckAdChecksSql.ps1 b/UniquenessCheck/uniquenessCheckAdChecksSql.ps1 index 7e8fd0a..43683e1 100644 --- a/UniquenessCheck/uniquenessCheckAdChecksSql.ps1 +++ b/UniquenessCheck/uniquenessCheckAdChecksSql.ps1 @@ -1,5 +1,5 @@ ######################################################################### -# HelloID-Conn-Prov-Target-Blocklist-Check-On-External-Systems-AD-SQL +# HelloID-Conn-Prov-Target-Blocklist-Check-On-External-Systems-SQL ######################################################################### # Initialize default properties diff --git a/create.ps1 b/create.ps1 index 3cf8131..0e394b2 100644 --- a/create.ps1 +++ b/create.ps1 @@ -200,6 +200,11 @@ try { } foreach ($attributeName in $attributeNames) { + if ([string]::IsNullOrWhiteSpace($actionContext.Data.$attributeName)) { + $actionMessage = "validating attribute [$attributeName]" + throw "Attribute [$attributeName] must not be null, empty or whitespace." + } + # Check if attribute is in table $actionMessage = "querying row in table [$table] where [$($attributeName)] = [$($actionContext.Data.$attributeName)]" diff --git a/update.ps1 b/update.ps1 index a208605..51952aa 100644 --- a/update.ps1 +++ b/update.ps1 @@ -203,6 +203,11 @@ try { } foreach ($attributeName in $attributeNames) { + if ([string]::IsNullOrWhiteSpace($actionContext.Data.$attributeName)) { + $actionMessage = "validating attribute [$attributeName]" + throw "Attribute [$attributeName] must not be null, empty or whitespace." + } + # Check if attribute is in table $actionMessage = "querying row in table [$table] where [$($attributeName)] = [$($actionContext.Data.$attributeName)]" From 7c47c44824a6044f7b48992f9e6e3080a3c06f67 Mon Sep 17 00:00:00 2001 From: Martijn Verbraak Date: Mon, 26 Oct 2026 13:48:23 +0100 Subject: [PATCH 3/3] Move validation after sql connect --- create.ps1 | 10 +++++----- update.ps1 | 10 +++++----- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/create.ps1 b/create.ps1 index 0e394b2..8a890f1 100644 --- a/create.ps1 +++ b/create.ps1 @@ -200,11 +200,6 @@ try { } foreach ($attributeName in $attributeNames) { - if ([string]::IsNullOrWhiteSpace($actionContext.Data.$attributeName)) { - $actionMessage = "validating attribute [$attributeName]" - throw "Attribute [$attributeName] must not be null, empty or whitespace." - } - # Check if attribute is in table $actionMessage = "querying row in table [$table] where [$($attributeName)] = [$($actionContext.Data.$attributeName)]" @@ -224,6 +219,11 @@ try { $querySelectResult = [System.Collections.ArrayList]::new() Invoke-SQLQuery @querySelectSplatParams -Data ([ref]$querySelectResult) -verbose:$false + if ([string]::IsNullOrWhiteSpace($actionContext.Data.$attributeName)) { + $actionMessage = "validating attribute [$attributeName]" + throw "Attribute [$attributeName] must not be null, empty or whitespace." + } + $selectRowCount = ($querySelectResult | Measure-Object).count Write-Information "Queried data FROM [$table] WHERE [attributeName] = '$attributeName' AND [attributeValue] = '$attributeValue'. Result count: $selectRowCount" diff --git a/update.ps1 b/update.ps1 index 51952aa..ba073d1 100644 --- a/update.ps1 +++ b/update.ps1 @@ -203,11 +203,6 @@ try { } foreach ($attributeName in $attributeNames) { - if ([string]::IsNullOrWhiteSpace($actionContext.Data.$attributeName)) { - $actionMessage = "validating attribute [$attributeName]" - throw "Attribute [$attributeName] must not be null, empty or whitespace." - } - # Check if attribute is in table $actionMessage = "querying row in table [$table] where [$($attributeName)] = [$($actionContext.Data.$attributeName)]" @@ -227,6 +222,11 @@ try { $querySelectResult = [System.Collections.ArrayList]::new() Invoke-SQLQuery @querySelectSplatParams -Data ([ref]$querySelectResult) -verbose:$false + if ([string]::IsNullOrWhiteSpace($actionContext.Data.$attributeName)) { + $actionMessage = "validating attribute [$attributeName]" + throw "Attribute [$attributeName] must not be null, empty or whitespace." + } + $selectRowCount = ($querySelectResult | measure-object).count Write-Verbose "Queried data FROM [$table] WHERE [attributeName] = '$attributeName' AND [attributeValue] = '$attributeValue'. Result count: $selectRowCount"