Skip to content

Conversation

BrennanConroy
Copy link
Member

@BrennanConroy BrennanConroy commented May 20, 2025

Backport of #61894

[IIS] Manually parse exe bitness

Description

In the AspNetCoreModule for IIS we have a check that dotnet.exe is the same architecture as the worker process (w3wp.exe). We used the windows function GetBinaryTypeW to determine this information, which while correct has raised some concerns since it loads the exe into executable space.

This PR changes the code to manually parse the exe file headers which is a well known format and use that information for the bitness check. This avoids loading the exe in executable space and still lets us check that the bitness matches.

Customer Impact

We unnecessarily load the specified exe into executable space.

Regression?

  • Yes
  • No

Risk

  • High
  • Medium
  • Low

Updating a non-critical check, so if it checks incorrectly it will only result in slightly worse program diagnosability on app run failure. Also did a bunch of testing on the code to make sure it shouldn't be possible to throw which would be problematic.

Verification

  • Manual (required)
  • Automated

Packaging changes reviewed?

  • Yes
  • No
  • N/A

@BrennanConroy BrennanConroy added this to the 8.0.x milestone May 20, 2025
@BrennanConroy BrennanConroy added the Servicing-consider Shiproom approval is required for the issue label May 20, 2025
@BrennanConroy BrennanConroy added the feature-iis Includes: IIS, ANCM label May 20, 2025
@BrennanConroy BrennanConroy requested a review from mgravell as a code owner May 20, 2025 23:20
@BrennanConroy BrennanConroy added area-networking Includes servers, yarp, json patch, bedrock, websockets, http client factory, and http abstractions Servicing-approved Shiproom has approved the issue and removed Servicing-consider Shiproom approval is required for the issue labels May 20, 2025
@dotnet-policy-service dotnet-policy-service bot added the pending-ci-rerun When assigned to a PR indicates that the CI checks should be rerun label May 28, 2025
@wtgodbe
Copy link
Member

wtgodbe commented Jun 4, 2025

/azp run

@wtgodbe wtgodbe removed the pending-ci-rerun When assigned to a PR indicates that the CI checks should be rerun label Jun 4, 2025
Copy link

Azure Pipelines successfully started running 3 pipeline(s).

This was referenced Oct 1, 2025
microsoft-github-policy-service bot pushed a commit to Azure/bicep that referenced this pull request Oct 5, 2025
#18209)

[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Updated
[Microsoft.AspNetCore.Components.WebAssembly](https://github.com/dotnet/aspnetcore)
from 8.0.15 to 8.0.20.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.AspNetCore.Components.WebAssembly's
releases](https://github.com/dotnet/aspnetcore/releases)._

## 8.0.20

[Release](https://github.com/dotnet/core/releases/tag/v8.0.20)

## What's Changed
* Update branding to 8.0.20 by @​vseanreesermsft in
dotnet/aspnetcore#63106
* [release/8.0] (deps): Bump src/submodules/googletest from `c67de11` to
`373af2e` by @​dependabot[bot] in
dotnet/aspnetcore#63038
* [release/8.0] Dispose the certificate chain elements with the chain by
@​MackinnonBuck in dotnet/aspnetcore#62994
* [release/8.0] Update SignalR Redis tests to use internal Docker Hub
mirror by @​github-actions[bot] in
dotnet/aspnetcore#63117
* [release/8.0] [SignalR] Don't throw for message headers in Java client
by @​github-actions[bot] in
dotnet/aspnetcore#62784
* Merging internal commits for release/8.0 by @​vseanreesermsft in
dotnet/aspnetcore#63152
* [release/8.0] Update dependencies from dotnet/extensions by
@​dotnet-maestro[bot] in dotnet/aspnetcore#63188
* [release/8.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in dotnet/aspnetcore#63189


**Full Changelog**:
dotnet/aspnetcore@v8.0.19...v8.0.20

## 8.0.18

[Release](https://github.com/dotnet/core/releases/tag/v8.0.18)

## What's Changed
* Update branding to 8.0.18 by @​vseanreesermsft in
dotnet/aspnetcore#62241
* [release/8.0] Update Alpine helix references by @​github-actions in
dotnet/aspnetcore#62243
* [release/8.0] (deps): Bump src/submodules/googletest from `04ee1b4` to
`e9092b1` by @​dependabot in
dotnet/aspnetcore#62201
* [8.0] Delete src/arcade directory by @​akoeplinger in
dotnet/aspnetcore#61994
* [Backport 8.0] [IIS] Manually parse exe bitness (#​61894) by
@​BrennanConroy in dotnet/aspnetcore#62037
* [release/8.0] Update dependencies from
dotnet/source-build-reference-packages by @​dotnet-maestro in
dotnet/aspnetcore#62006
* [release/8.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro in dotnet/aspnetcore#61944
* [release/8.0] Associate tagged keys with entries so replacements are
not evicted by @​github-actions in
dotnet/aspnetcore#62247
* [release/8.0] Block test that is failing after switching to
latest-chrome by @​github-actions in
dotnet/aspnetcore#62284
* backport(net8.0): http.sys on-demand TLS client hello retrieval by
@​DeagleGross in dotnet/aspnetcore#62290
* Merging internal commits for release/8.0 by @​vseanreesermsft in
dotnet/aspnetcore#62302


**Full Changelog**:
dotnet/aspnetcore@v8.0.17...v8.0.18

## 8.0.17

## Bug Fixes

- **Forwarded Headers Middleware: Ignore X-Forwarded-Headers from
Unknown Proxy**
([#​61623](dotnet/aspnetcore#61623))
The Forwarded Headers Middleware now ignores `X-Forwarded-Headers` sent
from unknown proxies. This change improves security by ensuring that
only trusted proxies can influence the forwarded headers, preventing
potential spoofing or misrouting of requests.

## Dependency Updates

- **Update dependencies from dotnet/arcade**
([#​61832](dotnet/aspnetcore#61832))
This update brings in the latest changes from the dotnet/arcade
repository, ensuring that ASP.NET Core benefits from recent
improvements, bug fixes, and security patches in the shared build
infrastructure.

- **Bump src/submodules/googletest from `52204f7` to `04ee1b4`**
([#​61761](dotnet/aspnetcore#61761))
The GoogleTest submodule has been updated to a newer commit, providing
the latest testing features, bug fixes, and performance improvements for
the project's C++ test components.

## Miscellaneous

- **Update branding to 8.0.17**
([#​61830](dotnet/aspnetcore#61830))
The project version branding has been updated to reflect the new 8.0.17
release, ensuring consistency across build outputs and documentation.

- **Merging internal commits for release/8.0**
([#​61924](dotnet/aspnetcore#61924))
This change merges various internal commits into the release/8.0 branch,
incorporating minor fixes, documentation updates, and other
non-user-facing improvements to keep the release branch up to date.

---

This summary is generated and may contain inaccuracies. For complete
details, please review the linked pull requests.

**Full Changelog**:
dotnet/aspnetcore@v8.0.16...v8.0.17

## 8.0.16

[Release](https://github.com/dotnet/core/releases/tag/v8.0.16)

## What's Changed
* Update branding to 8.0.16 by @​vseanreesermsft in
dotnet/aspnetcore#61283
* [release/8.0] (deps): Bump src/submodules/googletest from `24a9e94` to
`52204f7` by @​dependabot in
dotnet/aspnetcore#61260
* [release/8.0] Update dependencies from dotnet/source-build-externals
by @​dotnet-maestro in dotnet/aspnetcore#61281
* [release/8.0] Upgrade to Ubuntu 22 by @​wtgodbe in
dotnet/aspnetcore#61216
* [release/8.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro in dotnet/aspnetcore#60901
* [release/8.0] Update dependencies from
dotnet/source-build-reference-packages by @​dotnet-maestro in
dotnet/aspnetcore#60926
* [release/8.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro in dotnet/aspnetcore#61404
* Merging internal commits for release/8.0 by @​vseanreesermsft in
dotnet/aspnetcore#61398
* [release/8.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro in dotnet/aspnetcore#61411
* Revert "Revert "[release/8.0] Update remnants of azureedge.net"" by
@​wtgodbe in dotnet/aspnetcore#60352
* [release/8.0] Fix preserving messages for stateful reconnect with
backplane by @​BrennanConroy in
dotnet/aspnetcore#61375
* [release/8.0] Update dependencies from
dotnet/source-build-reference-packages by @​dotnet-maestro in
dotnet/aspnetcore#61442
* fetch TLS client hello message from HTTP.SYS by @​BrennanConroy in
dotnet/aspnetcore#61494


**Full Changelog**:
dotnet/aspnetcore@v8.0.15...v8.0.16

Commits viewable in [compare
view](dotnet/aspnetcore@v8.0.15...v8.0.20).
</details>

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Microsoft.AspNetCore.Components.WebAssembly&package-manager=nuget&previous-version=8.0.15&new-version=8.0.20)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/Azure/bicep/pull/18209)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area-networking Includes servers, yarp, json patch, bedrock, websockets, http client factory, and http abstractions feature-iis Includes: IIS, ANCM Servicing-approved Shiproom has approved the issue
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants