#9360 Harden SFTP Client module (security review phase 1)
The SFTP Client module hardens security by removing MD5 fingerprint support, adding a 25 MB file-size limit, disabling debugging, and applying NonDebuggable attributes to sensitive code paths. The SFTP Connector now only accepts SHA256 fingerprints.
- 10files
- 7AL files
- 7objects
Pull request · merged into main (BC30) on 2026-08-12 by JesperSchulz · 10 files (+153 -38), 7 AL · fix · tier official · reviewed (checked by Opus)
What changed
- MD5 host-key fingerprints are no longer supported; only SHA256 prefixes accepted
- File upload and download operations are capped at 25 MB with a typed File Too Large exception
- Debugging is disabled and sensitive code paths marked NonDebuggable to protect customer data
- Generic exception branch no longer exposes raw server or .NET exception text
- Telemetry event SFTP-0001 added to track file transfer sizes
- Breaking: existing extensions can stop compiling or working.
AL objects touched
- Table 4621 “Ext. SFTP Account”, External File Storage - SFTP Connector: modified
- Codeunit 4621 “Ext. SFTP Connector Impl”, External File Storage - SFTP Connector: modified
- Codeunit 9760 “Dotnet SFTP Client”, System Application: modified
- Interface “ISFTP Client”, System Application: modified
- Codeunit 9762 “SFTP Client”, System Application: modified
- Codeunit 9763 “SFTP Client Implementation”, System Application: modified
- Enum 9760 “SFTP Exception Type”, System Application: modified
Context
- Work items: AB#632215
- Labels: AL: Apps (W1), AL: System Application, Team: Integrations
- Systems: development
- From the description: “Remove MD5 host-key fingerprint support end-to-end.”
Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).