Fix vulnerability (#1874)

* Fix vulnerability
Azure · Dec 1, 2023 · 4db043d · 4db043d
1 parent 4e76ffd
commit 4db043d
Show file tree

Hide file tree

Showing 6 changed files with 73 additions and 51 deletions.
diff --git a/.github/workflows/osx.yml b/.github/workflows/osx.yml
@@ -11,9 +11,12 @@ on:
 jobs:
   build_osx:
     runs-on: macOS-latest
+    strategy:
+      matrix:
+        dotnet-version: [ '7.0.x', '6.0.x' ]
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v2.2.0
+    - uses: dorny/paths-filter@v2
       id: filter
       with:
         filters: |
@@ -29,19 +32,24 @@ jobs:
           - '**.targets'
           - '*.sh'
           - '*.sln'
-
     - name: Update SubModules
       if: steps.filter.outputs.src == 'true'
       run: git submodule update --init --recursive
-    - name: Setup .NET
-      uses: actions/setup-dotnet@v2
+    - name: Setup dotnet ${{ matrix.dotnet-version }}
+      uses: actions/setup-dotnet@v3
       with:
-        dotnet-version: |
-          7.0.x
-          6.0.x
+        dotnet-version: ${{ matrix.dotnet-version }}
+    - name: Display dotnet version
+      run: dotnet --version
     - name: Build with dotnet
       run:  "dotnet build AzureSignalR.sln /p:DisableNet461Tests=true"
       if: steps.filter.outputs.src == 'true'
     - name: Test
-      run:  "dotnet test --no-build"
-      if: steps.filter.outputs.src == 'true'
+      run: dotnet test --no-build --logger trx --results-directory "TestResults-ubuntu-${{ matrix.dotnet-version }}"
+    - name: Upload dotnet test results
+      uses: actions/upload-artifact@v3
+      with:
+        name: dotnet-results-${{ matrix.dotnet-version }}
+        path: TestResults-ubuntu-${{ matrix.dotnet-version }}
+      # Use always() to always run this step to publish test results when there are test failures
+      if: ${{ always() }}
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
@@ -11,9 +11,12 @@ on:
 jobs:
   build_ubuntu:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        dotnet-version: [ '7.0.x', '6.0.x' ]
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v2.2.0
+    - uses: dorny/paths-filter@v2
       id: filter
       with:
         filters: |
@@ -32,25 +35,21 @@ jobs:
     - name: Update SubModules
       run: git submodule update --init --recursive
       if: steps.filter.outputs.src == 'true'
-    - name: Setup dotnet
+    - name: Setup dotnet ${{ matrix.dotnet-version }}
       uses: actions/setup-dotnet@v3
       with:
-        dotnet-version: |
-          7.0.x
-          6.0.x
-
-    - name: Set Dotnet Version
-      run: echo "DOTNET_VERSION=${{ steps.dotnet-setup.outputs.dotnet-version }}" >> $GITHUB_ENV
-
+        dotnet-version: ${{ matrix.dotnet-version }}
+    - name: Display dotnet version
+      run: dotnet --version
     - name: Build with dotnet
       run:  "dotnet build AzureSignalR.sln /p:DisableNet461Tests=true"
       if: steps.filter.outputs.src == 'true'
     - name: Test
-      run: dotnet test --no-build --logger trx --results-directory "TestResults-ubuntu-$DOTNET_VERSION"
+      run: dotnet test --no-build --logger trx --results-directory "TestResults-ubuntu-${{ matrix.dotnet-version }}"
     - name: Upload dotnet test results
       uses: actions/upload-artifact@v3
       with:
-        name: dotnet-results-$DOTNET_VERSION
-        path: TestResults-ubuntu-$DOTNET_VERSION
+        name: dotnet-results-${{ matrix.dotnet-version }}
+        path: TestResults-ubuntu-${{ matrix.dotnet-version }}
       # Use always() to always run this step to publish test results when there are test failures
       if: ${{ always() }}
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
@@ -11,9 +11,12 @@ on:
 jobs:
   build_windows:
     runs-on: [windows-latest]
+    strategy:
+      matrix:
+        dotnet-version: [ '7.0.x', '6.0.x' ]
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v2.2.0
+    - uses: dorny/paths-filter@v2
       id: filter
       with:
         filters: |
@@ -32,16 +35,21 @@ jobs:
     - name: Update SubModules
       run: git submodule update --init --recursive
       if: steps.filter.outputs.src == 'true'
-
-    - name: Setup .NET
-      uses: actions/setup-dotnet@v2
+    - name: Setup dotnet ${{ matrix.dotnet-version }}
+      uses: actions/setup-dotnet@v3
       with:
-        dotnet-version: |
-          7.0.x
-          6.0.x
-          5.0.x
-        include-prerelease: true
-
-    - name: Test
-      run: dotnet test
+        dotnet-version: ${{ matrix.dotnet-version }}
+    - name: Display dotnet version
+      run: dotnet --version
+    - name: Build with dotnet
+      run:  "dotnet build AzureSignalR.sln"
       if: steps.filter.outputs.src == 'true'
+    - name: Test
+      run: dotnet test --no-build --logger trx --results-directory "TestResults-ubuntu-${{ matrix.dotnet-version }}"
+    - name: Upload dotnet test results
+      uses: actions/upload-artifact@v3
+      with:
+        name: dotnet-results-${{ matrix.dotnet-version }}
+        path: TestResults-ubuntu-${{ matrix.dotnet-version }}
+      # Use always() to always run this step to publish test results when there are test failures
+      if: ${{ always() }}
diff --git a/build/dependencies.props b/build/dependencies.props
@@ -79,7 +79,7 @@
     <MoqPackageVersion>4.14.5</MoqPackageVersion>
     <XunitPackageVersion>2.4.2</XunitPackageVersion>
     <XunitRunnerVisualStudioPackageVersion>2.4.2</XunitRunnerVisualStudioPackageVersion>
-    <MicrosoftOwinTestingPackageVersion>4.0.0</MicrosoftOwinTestingPackageVersion>
+    <MicrosoftOwinTestingPackageVersion>4.2.2</MicrosoftOwinTestingPackageVersion>
     <MicrosoftAspNetCoreTestingVersion>2.1.0</MicrosoftAspNetCoreTestingVersion>
     <SystemThreadingTasksExtensionsVersion>4.5.4</SystemThreadingTasksExtensionsVersion>
     <MicrosoftAspNetCoreTestHostPackageVersion>6.0.24</MicrosoftAspNetCoreTestHostPackageVersion>

diff --git a/src/Microsoft.Azure.SignalR.AspNet/Microsoft.Azure.SignalR.AspNet.csproj b/src/Microsoft.Azure.SignalR.AspNet/Microsoft.Azure.SignalR.AspNet.csproj
@@ -7,7 +7,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNet.SignalR" Version="$(MicrosoftAspNetSignalRPackageVersion)" />
+	<!-- Directly reference Microsoft.Owin 4.x for security fix -->
+	<PackageReference Include="Microsoft.Owin" Version="$(MicrosoftOwinPackageVersion)" />
+	<PackageReference Include="Microsoft.AspNet.SignalR" Version="$(MicrosoftAspNetSignalRPackageVersion)" />
     <PackageReference Include="Microsoft.AspNetCore.Connections.Abstractions" Version="$(MicrosoftAspNetCoreConnectionsAbstractionsPackageVersion)" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="$(MicrosoftExtensionsDependencyInjectionPackageVersion)" />
     <PackageReference Include="Microsoft.Extensions.Logging.EventSource" Version="$(MicrosoftExtensionsLoggingEventSourcePackageVersion)" />

diff --git a/test/Microsoft.Azure.SignalR.Tests/ServiceConnectionTests.cs b/test/Microsoft.Azure.SignalR.Tests/ServiceConnectionTests.cs
@@ -56,10 +56,11 @@ public async Task TestServiceConnectionWithNormalApplicationTask()
                 Assert.Equal(ServiceConnectionStatus.Connected, connection.Status);
                 var clientConnectionId = Guid.NewGuid().ToString();
 
+                var waitClientTask = ccm.WaitForClientConnectionAsync(clientConnectionId);
                 await transportConnection.Application.Output.WriteAsync(
                     protocol.GetMessageBytes(new OpenConnectionMessage(clientConnectionId, new Claim[] { })));
 
-                var clientConnection = await ccm.WaitForClientConnectionAsync(clientConnectionId).OrTimeout();
+                var clientConnection = await waitClientTask.OrTimeout();
 
                 await transportConnection.Application.Output.WriteAsync(
                     protocol.GetMessageBytes(new CloseConnectionMessage(clientConnectionId)));
@@ -70,10 +71,11 @@ await transportConnection.Application.Output.WriteAsync(
                 // another connection comes in
                 clientConnectionId = Guid.NewGuid().ToString();
 
+                waitClientTask = ccm.WaitForClientConnectionAsync(clientConnectionId);
                 await transportConnection.Application.Output.WriteAsync(
                     protocol.GetMessageBytes(new OpenConnectionMessage(clientConnectionId, new Claim[] { })));
 
-                clientConnection = await ccm.WaitForClientConnectionAsync(clientConnectionId).OrTimeout();
+                clientConnection = await waitClientTask.OrTimeout();
 
                 // complete reading to end the connection
                 transportConnection.Application.Output.Complete();
@@ -111,11 +113,11 @@ public async Task TestServiceConnectionErrorCleansAllClients()
                 await connection.ConnectionInitializedTask.OrTimeout();
                 Assert.Equal(ServiceConnectionStatus.Connected, connection.Status);
                 var clientConnectionId = Guid.NewGuid().ToString();
-
+                var waitClientTask = ccm.WaitForClientConnectionAsync(clientConnectionId);
                 await transportConnection.Application.Output.WriteAsync(
                     protocol.GetMessageBytes(new OpenConnectionMessage(clientConnectionId, new Claim[] { })));
 
-                var clientConnection = await ccm.WaitForClientConnectionAsync(clientConnectionId).OrTimeout();
+                var clientConnection = await waitClientTask.OrTimeout();
                 // Cancel pending read to end the server connection
                 transportConnection.Transport.Input.CancelPendingRead();
 
@@ -167,11 +169,11 @@ public async Task TestServiceConnectionWithErrorApplicationTask()
                 await connection.ConnectionInitializedTask.OrTimeout();
                 Assert.Equal(ServiceConnectionStatus.Connected, connection.Status);
                 var clientConnectionId = Guid.NewGuid().ToString();
-
+                var waitClientTask = ccm.WaitForClientConnectionAsync(clientConnectionId);
                 await transportConnection.Application.Output.WriteAsync(
                     protocol.GetMessageBytes(new OpenConnectionMessage(clientConnectionId, new Claim[] { })));
 
-                var clientConnection = await ccm.WaitForClientConnectionAsync(clientConnectionId).OrTimeout();
+                var clientConnection = await waitClientTask.OrTimeout();
 
                 errorTcs.SetException(new InvalidOperationException("error operation"));
 
@@ -229,11 +231,11 @@ public async Task TestServiceConnectionWithEndlessApplicationTaskNeverEnds()
                 // completed handshake
                 await connection.ConnectionInitializedTask.OrTimeout();
                 Assert.Equal(ServiceConnectionStatus.Connected, connection.Status);
-
+                var waitClientTask = ccm.WaitForClientConnectionAsync(clientConnectionId);
                 await transportConnection.Application.Output.WriteAsync(
                     protocol.GetMessageBytes(new OpenConnectionMessage(clientConnectionId, new Claim[] { })));
 
-                var clientConnection = await ccm.WaitForClientConnectionAsync(clientConnectionId).OrTimeout();
+                var clientConnection = await waitClientTask.OrTimeout();
 
                 // complete reading to end the connection
                 transportConnection.Application.Output.Complete();
@@ -286,11 +288,11 @@ public async Task ClientConnectionOutgoingAbortCanEndLifeTime()
                 await connection.ConnectionInitializedTask.OrTimeout();
                 Assert.Equal(ServiceConnectionStatus.Connected, connection.Status);
                 var clientConnectionId = Guid.NewGuid().ToString();
-
+                var waitClientTask = ccm.WaitForClientConnectionAsync(clientConnectionId);
                 await transportConnection.Application.Output.WriteAsync(
                     protocol.GetMessageBytes(new OpenConnectionMessage(clientConnectionId, new Claim[] { })));
 
-                var clientConnection = await ccm.WaitForClientConnectionAsync(clientConnectionId).OrTimeout();
+                var clientConnection = await waitClientTask.OrTimeout();
 
                 clientConnection.CancelOutgoing();
 
@@ -344,10 +346,12 @@ public async Task ClientConnectionContextAbortCanSendOutCloseMessage()
                 Assert.Equal(ServiceConnectionStatus.Connected, connection.Status);
                 var clientConnectionId = Guid.NewGuid().ToString();
 
+                // make sure to register for wait first
+                var waitClientTask = ccm.WaitForClientConnectionAsync(clientConnectionId);
+
                 await transportConnection.Application.Output.WriteAsync(
                     protocol.GetMessageBytes(new OpenConnectionMessage(clientConnectionId, new Claim[] { })));
-
-                var clientConnection = await ccm.WaitForClientConnectionAsync(clientConnectionId).OrTimeout();
+                var clientConnection = await waitClientTask.OrTimeout();
 
                 await clientConnection.LifetimeTask.OrTimeout();
 
@@ -405,7 +409,8 @@ public async Task ClientConnectionWithDiagnosticClientTagTest()
                 // completed handshake
                 await connection.ConnectionInitializedTask.OrTimeout();
                 Assert.Equal(ServiceConnectionStatus.Connected, connection.Status);
-
+                var waitClientTask = Task.WhenAll(ccm.WaitForClientConnectionAsync(normalClientConnectionId),
+                    ccm.WaitForClientConnectionAsync(diagnosticClientConnectionId));
                 await transportConnection.Application.Output.WriteAsync(
                         protocol.GetMessageBytes(new OpenConnectionMessage(diagnosticClientConnectionId, null, new Dictionary<string, StringValues>
                         {
@@ -415,8 +420,7 @@ await transportConnection.Application.Output.WriteAsync(
                 await transportConnection.Application.Output.WriteAsync(
                     protocol.GetMessageBytes(new OpenConnectionMessage(normalClientConnectionId, null)));
 
-                var connections = await Task.WhenAll(ccm.WaitForClientConnectionAsync(normalClientConnectionId).OrTimeout(),
-                    ccm.WaitForClientConnectionAsync(diagnosticClientConnectionId).OrTimeout());
+                var connections = await waitClientTask.OrTimeout();
                 await Task.WhenAll(from c in connections select c.LifetimeTask.OrTimeout());
 
                 // complete reading to end the connection
@@ -465,10 +469,11 @@ public async Task ClientConnectionLastWillCanSendOut()
                 Assert.Equal(ServiceConnectionStatus.Connected, connection.Status);
                 var clientConnectionId = Guid.NewGuid().ToString();
 
+                var waitClientTask = ccm.WaitForClientConnectionAsync(clientConnectionId);
                 await transportConnection.Application.Output.WriteAsync(
                     protocol.GetMessageBytes(new OpenConnectionMessage(clientConnectionId, new Claim[] { })));
 
-                var clientConnection = await ccm.WaitForClientConnectionAsync(clientConnectionId).OrTimeout();
+                var clientConnection = await waitClientTask.OrTimeout();
 
                 // complete reading to end the connection
                 transportConnection.Application.Output.Complete();