codeql/csharp/ql/test/query-tests/Security Features/CWE-327/InsecureSQLConnectionInitializer/InsecureSQLConnectionInitializer.cs

namespace System.Data.SqlClient
{
    public sealed class SqlConnectionStringBuilder
    {
        public bool Encrypt { get; set; }
        public SqlConnectionStringBuilder(string connectionString) { }
    }

}

namespace InsecureSQLConnection
{
    public class Class1
    {
        void Test6()
        {
            string connectString = "Server=1.2.3.4;Database=Anything;UID=ab;Pwd=cd;Encrypt=false";
            var conn = new System.Data.SqlClient.SqlConnectionStringBuilder(connectString) { Encrypt = false };    // Bug - cs/insecure-sql-connection-initializer
        }

        void Test72ndPhase(bool encrypt)
        {
            string connectString = "Server=1.2.3.4;Database=Anything;UID=ab;Pwd=cd;Encrypt=false";
            var conn = new System.Data.SqlClient.SqlConnectionStringBuilder(connectString) { Encrypt = encrypt };    // Bug - cs/insecure-sql-connection-initializer (sink)
        }

        void Test7()
        {
            Test72ndPhase(false);    // Bug - cs/insecure-sql-connection-initializer (source)
        }

        void Test7FP()
        {
            Test72ndPhase(true);    // Not a bug source
        }

        void Test8FP()
        {
            string connectString = "Server=1.2.3.4;Database=Anything;UID=ab;Pwd=cd;Encrypt=false";
            var conn = new System.Data.SqlClient.SqlConnectionStringBuilder(connectString) { Encrypt = true };
        }
    }
}