Login failure with caret (^) in password

[halioris]

Software versions

• Tedious: 15.1.0
• SQL Server: 16.0.4065.3
• Node.js: 16.14.2

Additional Libraries Used and Versions

Table schema

Connection configuration
{ server: myservername, authentication: { type: 'default', options: { userName: myuser, password: mypwd } }, options: { database: mydb } }

Problem description

Everything works fine when connecting to various accounts until I get to one whose password has some special characters in it and I believe the caret is causing the problem. I change nothing but the userid and password and the connection fails when attempting to use the password:
F25^6jf&5j&110rgt6g^
I can go straight to SSMS and connect with it I am 100% sure the userid and password work. I have other passwords with the ampersand (&) and asterisk () so I believe the issue is the caret(^). I was reading this from a store but to debug literally just set the username and password directly in the config as a string and it fails.

Expected behavior

Connection should succeed.

Actual behavior

Uncaught ConnectionError Error: Login failed for user 'myuser'.

Error message/stack trace

Connection failed!
Uncaught ConnectionError Error: Login failed for user 'myuser'.
at ConnectionError (c:\Users\blah\node_modules\tedious\src\errors.ts:7:5)
at onErrorMessage (c:\Users\blah\node_modules\tedious\src\token\handler.ts:268:19)
at (c:\Users\blah\node_modules\tedious\src\token\token-stream-parser.ts:22:7)
at emit (events:526:28)
at addChunk (internal/streams/readable:315:12)
at readableAddChunk (internal/streams/readable:289:9)
at Readable.push (internal/streams/readable:228:10)
at next (internal/streams/from:98:31)
at processTicksAndRejections (internal/process/task_queues:96:5)
--- TickObject ---
at init (internal/inspector_async_hook:25:19)
at emitInitNative (internal/async_hooks:201:43)
at emitInitScript (internal/async_hooks:506:3)
at nextTick (internal/process/task_queues:133:5)
at (c:\Users\blah\node_modules\tedious\src\connection.ts:3299:17)
at processTicksAndRejections (internal/process/task_queues:96:5)
--- Promise.catch ---
at enter (c:\Users\blah\node_modules\tedious\src\connection.ts:3266:7)
at transitionTo (c:\Users\blah\node_modules\tedious\src\connection.ts:2158:24)
at (c:\Users\blah\node_modules\tedious\src\connection.ts:3195:18)
at processTicksAndRejections (internal/process/task_queues:96:5)
--- async function ---
at enter (c:\Users\blah\node_modules\tedious\src\connection.ts:3142:7)
at transitionTo (c:\Users\blah\node_modules\tedious\src\connection.ts:2158:24)
at (c:\Users\blah\node_modules\tedious\src\connection.ts:1991:14)
at processTicksAndRejections (internal/process/task_queues:78:11)
--- TickObject ---
at init (internal/inspector_async_hook:25:19)
at emitInitNative (internal/async_hooks:201:43)
at emitInitScript (internal/async_hooks:506:3)
at nextTick (internal/process/task_queues:133:5)
at (c:\Users\blah\node_modules\tedious\src\connection.ts:1976:15)
--- Promise.then ---
at connectOnPort (c:\Users\blah\node_modules\tedious\src\connection.ts:1975:46)
at initialiseConnection (c:\Users\blah\node_modules\tedious\src\connection.ts:1895:19)
at enter (c:\Users\blah\node_modules\tedious\src\connection.ts:3128:12)
at transitionTo (c:\Users\blah\node_modules\tedious\src\connection.ts:2158:24)
at connect (c:\Users\blah\node_modules\tedious\src\connection.ts:1745:10)
at exports.bagdefs_get (c:\Users\blah\controllers\bagdefController.js:16:16)
at processTicksAndRejections (internal/process/task_queues:96:5)
--- async function ---
at handle (c:\Users\blah\node_modules\express\lib\router\layer.js:95:5)
at next (c:\Users\blah\node_modules\express\lib\router\route.js:144:13)
at dispatch (c:\Users\blah\node_modules\express\lib\router\route.js:114:3)
at handle (c:\Users\blah\node_modules\express\lib\router\layer.js:95:5)
at (c:\Users\blah\node_modules\express\lib\router\index.js:284:15)
at process_params (c:\Users\blah\node_modules\express\lib\router\index.js:346:12)
at next (c:\Users\blah\node_modules\express\lib\router\index.js:280:10)
at handle (c:\Users\blah\node_modules\express\lib\router\index.js:175:3)
at router (c:\Users\blah\node_modules\express\lib\router\index.js:47:12)
at handle (c:\Users\blah\node_modules\express\lib\router\layer.js:95:5)
at trim_prefix (c:\Users\blah\node_modules\express\lib\router\index.js:328:13)
at (c:\Users\blah\node_modules\express\lib\router\index.js:286:9)
at process_params (c:\Users\blah\node_modules\express\lib\router\index.js:346:12)
at next (c:\Users\blah\node_modules\express\lib\router\index.js:280:10)
at error (c:\Users\blah\node_modules\serve-static\index.js:121:7)
at emit (events:526:28)
at error (c:\Users\blah\node_modules\send\index.js:270:17)
at onStatError (c:\Users\blah\node_modules\send\index.js:417:12)
at next (c:\Users\blah\node_modules\send\index.js:731:16)
at onstat (c:\Users\blah\node_modules\send\index.js:720:14)
at (fs:198:21)
at callbackTrampoline (internal/async_hooks:130:17)
--- FSREQCALLBACK ---
at init (internal/inspector_async_hook:25:19)
at emitInitNative (internal/async_hooks:201:43)
at stat (fs:1462:15)
at sendFile (c:\Users\blah\node_modules\send\index.js:717:6)
at pipe (c:\Users\blah\node_modules\send\index.js:591:8)
at serveStatic (c:\Users\blah\node_modules\serve-static\index.js:125:12)
at handle (c:\Users\blah\node_modules\express\lib\router\layer.js:95:5)
at trim_prefix (c:\Users\blah\node_modules\express\lib\router\index.js:328:13)
at (c:\Users\blah\node_modules\express\lib\router\index.js:286:9)
at process_params (c:\Users\blah\node_modules\express\lib\router\index.js:346:12)
at next (c:\Users\blah\node_modules\express\lib\router\index.js:280:10)
at error (c:\Users\blah\node_modules\serve-static\index.js:121:7)
at emit (events:526:28)
at error (c:\Users\blah\node_modules\send\index.js:270:17)
at onStatError (c:\Users\blah\node_modules\send\index.js:417:12)
at next (c:\Users\blah\node_modules\send\index.js:731:16)
at onstat (c:\Users\blah\node_modules\send\index.js:720:14)
at (fs:198:21)
at callbackTrampoline (internal/async_hooks:130:17)
--- FSREQCALLBACK ---
at init (internal/inspector_async_hook:25:19)
at emitInitNative (internal/async_hooks:201:43)
at stat (fs:1462:15)
at sendFile (c:\Users\blah\node_modules\send\index.js:717:6)
at pipe (c:\Users\blah\node_modules\send\index.js:591:8)
at serveStatic (c:\Users\blah\node_modules\serve-static\index.js:125:12)
at handle (c:\Users\blah\node_modules\express\lib\router\layer.js:95:5)
at trim_prefix (c:\Users\blah\node_modules\express\lib\router\index.js:328:13)
at (c:\Users\blah\node_modules\express\lib\router\index.js:286:9)
at process_params (c:\Users\blah\node_modules\express\lib\router\index.js:346:12)
at next (c:\Users\blah\node_modules\express\lib\router\index.js:280:10)
at cookieParser (c:\Users\blah\node_modules\cookie-parser\index.js:57:14)
at handle (c:\Users\blah\node_modules\express\lib\router\layer.js:95:5)
at trim_prefix (c:\Users\blah\node_modules\express\lib\router\index.js:328:13)
at (c:\Users\blah\node_modules\express\lib\router\index.js:286:9)
at process_params (c:\Users\blah\node_modules\express\lib\router\index.js:346:12)
at next (c:\Users\blah\node_modules\express\lib\router\index.js:280:10)
at urlencodedParser (c:\Users\blah\node_modules\body-parser\lib\types\urlencoded.js:91:7)
at handle (c:\Users\blah\node_modules\express\lib\router\layer.js:95:5)
at trim_prefix (c:\Users\blah\node_modules\express\lib\router\index.js:328:13)
at (c:\Users\blah\node_modules\express\lib\router\index.js:286:9)
at process_params (c:\Users\blah\node_modules\express\lib\router\index.js:346:12)
at next (c:\Users\blah\node_modules\express\lib\router\index.js:280:10)
at jsonParser (c:\Users\blah\node_modules\body-parser\lib\types\json.js:113:7)
at handle (c:\Users\blah\node_modules\express\lib\router\layer.js:95:5)
at trim_prefix (c:\Users\blah\node_modules\express\lib\router\index.js:328:13)
at (c:\Users\blah\node_modules\express\lib\router\index.js:286:9)
at process_params (c:\Users\blah\node_modules\express\lib\router\index.js:346:12)
at next (c:\Users\blah\node_modules\express\lib\router\index.js:280:10)
at logger (c:\Users\blah\node_modules\morgan\index.js:144:5)
at handle (c:\Users\blah\node_modules\express\lib\router\layer.js:95:5)
at trim_prefix (c:\Users\blah\node_modules\express\lib\router\index.js:328:13)
at (c:\Users\blah\node_modules\express\lib\router\index.js:286:9)
at process_params (c:\Users\blah\node_modules\express\lib\router\index.js:346:12)
at next (c:\Users\blah\node_modules\express\lib\router\index.js:280:10)
at expressInit (c:\Users\blah\node_modules\express\lib\middleware\init.js:40:5)
at handle (c:\Users\blah\node_modules\express\lib\router\layer.js:95:5)
at trim_prefix (c:\Users\blah\node_modules\express\lib\router\index.js:328:13)
at (c:\Users\blah\node_modules\express\lib\router\index.js:286:9)
at process_params (c:\Users\blah\node_modules\express\lib\router\index.js:346:12)
at next (c:\Users\blah\node_modules\express\lib\router\index.js:280:10)
at query (c:\Users\blah\node_modules\express\lib\middleware\query.js:45:5)
at handle (c:\Users\blah\node_modules\express\lib\router\layer.js:95:5)
at trim_prefix (c:\Users\blah\node_modules\express\lib\router\index.js:328:13)
at (c:\Users\blah\node_modules\express\lib\router\index.js:286:9)
at process_params (c:\Users\blah\node_modules\express\lib\router\index.js:346:12)
at next (c:\Users\blah\node_modules\express\lib\router\index.js:280:10)
at handle (c:\Users\blah\node_modules\express\lib\router\index.js:175:3)
at handle (c:\Users\blah\node_modules\express\lib\application.js:181:10)
at app (c:\Users\blah\node_modules\express\lib\express.js:39:9)
at emit (events:526:28)
at parserOnIncoming (_http_server:951:12)
at parserOnHeadersComplete (_http_common:128:17)
--- HTTPINCOMINGMESSAGE ---
at init (internal/inspector_async_hook:25:19)
at emitInitNative (internal/async_hooks:201:43)
at connectionListenerInternal (_http_server:465:10)
at defaultTriggerAsyncIdScope (internal/async_hooks:465:18)
at connectionListener (_http_server:438:3)
at emit (events:526:28)
at onconnection (net:1573:8)
at callbackTrampoline (internal/async_hooks:130:17)
--- TCPSERVERWRAP ---
at init (internal/inspector_async_hook:25:19)
at emitInitNative (internal/async_hooks:201:43)
at createServerHandle (net:1254:14)
at setupListenHandle (net:1297:14)
at listenInCluster (net:1378:12)
at Server.listen (net:1465:7)
at listen (c:\Users\blah\node_modules\express\lib\application.js:635:24)
at (c:\Users\blah\app.js:64:18)
at Module._compile (internal/modules/cjs/loader:1103:14)
at Module._extensions..js (internal/modules/cjs/loader:1157:10)
at Module.load (internal/modules/cjs/loader:981:32)
at Module._load (internal/modules/cjs/loader:822:12)
at executeUserEntryPoint (internal/modules/run_main:77:12)
at (internal/main/run_main_module:17:47)

Any other details that can be helpful

[arthurschreiber]

I'm not sure what's wrong here. From the TDS specification:

Before submitting a password from the client to the server, for every byte in the password buffer starting with the position pointed to by ibPassword or ibChangePassword, the client SHOULD first swap the four high bits with the four low bits and then do a bit-XOR with 0xA5 (10100101). After reading a submitted password, for every byte in the password buffer starting with the position pointed to by ibPassword or ibChangePassword, the server SHOULD first do a bit-XOR with 0xA5 (10100101) and then swap the four high bits with the four low bits.

I believe this matches exactly what we're doing here:

tedious/src/login7-payload.ts

Lines 456 to 464 in 78a4530

	for (let b = 0, len = password.length; b < len; b++) {
	let byte = password[b];
	const lowNibble = byte & 0x0f;
	const highNibble = byte >> 4;
	byte = (lowNibble << 4) | highNibble;
	byte = byte ^ 0xa5;
	password[b] = byte;
	}
	return password;

There is no special treatment for the ^ symbol. 🤔

[halioris]

well it looks like my best bet is to just change the password but I think I have to have my trusty DBA around. I may try a few iterations with and without the caret to see if it truly seems to be that or something else like the length or the position of the caret (and hopefully not some dumb user error that I tried to make 100% sure 5 times that all was correct).