Skip to content

Commit 02bd1da

Browse files
vcsjonesvcsjones
authored
Obsolete X509Certificate{2} constructors and X509Certificate2Collection.Import
1 parent b9673cb commit 02bd1da

File tree

38 files changed

+141
-35
lines changed

38 files changed

+141
-35
lines changed

‎docs/project/list-of-diagnostics.md

+1
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,7 @@ The PR that reveals the implementation of the `<IncludeInternalObsoleteAttribute
110110
| __`SYSLIB0053`__ | AesGcm should indicate the required tag size for encryption and decryption. Use a constructor that accepts the tag size. |
111111
| __`SYSLIB0054`__ | Thread.VolatileRead and Thread.VolatileWrite are obsolete. Use Volatile.Read or Volatile.Write respectively instead. |
112112
| __`SYSLIB0055`__ | The underlying hardware instruction does not perform a signed saturate narrowing operation, and it always returns an unsigned result. Use the unsigned overload instead. |
113+
| __`SYSLIB0057`__ | Loading certificate data through the constructor or Import is obsolete. Use X509CertificateLoader instead to load certificates. |
113114

114115
## Analyzer Warnings
115116

‎src/libraries/Common/src/System/Obsoletions.cs

+3
Original file line numberDiff line numberDiff line change
@@ -180,5 +180,8 @@ internal static class Obsoletions
180180

181181
internal const string LoadFromHashAlgorithmMessage = "LoadFrom with a custom AssemblyHashAlgorithm is obsolete. Use overloads without an AssemblyHashAlgorithm.";
182182
internal const string LoadFromHashAlgorithmDiagId = "SYSLIB0056";
183+
184+
internal const string X509CtorCertDataObsoleteMessage = "Loading certificate data through the constructor or Import is obsolete. Use X509CertificateLoader instead to load certificates.";
185+
internal const string X509CtorCertDataObsoleteDiagId = "SYSLIB0057";
183186
}
184187
}

‎src/libraries/System.DirectoryServices.AccountManagement/src/System.DirectoryServices.AccountManagement.csproj

+4
Original file line numberDiff line numberDiff line change
@@ -213,4 +213,8 @@
213213
<PackageReference Include="System.Security.Principal.Windows" Version="$(SystemSecurityPrincipalWindowsVersion)" />
214214
</ItemGroup>
215215

216+
<ItemGroup Condition="!$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net9.0'))">
217+
<ProjectReference Include="$(LibrariesProjectRoot)Microsoft.Bcl.Cryptography\src\Microsoft.Bcl.Cryptography.csproj" />
218+
</ItemGroup>
219+
216220
</Project>

‎src/libraries/System.DirectoryServices.AccountManagement/src/System/DirectoryServices/AccountManagement/AuthenticablePrincipal.cs

+2-1
Original file line numberDiff line numberDiff line change
@@ -551,7 +551,8 @@ private void LoadCertificateCollection(List<byte[]> certificatesToLoad)
551551
{
552552
try
553553
{
554-
_certificates.Import(rawCert);
554+
X509Certificate2 cert = X509CertificateLoader.LoadCertificate(rawCert);
555+
_certificates.Add(cert);
555556
}
556557
catch (System.Security.Cryptography.CryptographicException)
557558
{

‎src/libraries/System.Net.Http.Json/tests/FunctionalTests/System.Net.Http.Json.Functional.Tests.csproj

+1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
<PropertyGroup>
44
<TargetFrameworks>$(NetCoreAppCurrent);$(NetFrameworkCurrent)</TargetFrameworks>
55
<JsonSerializerIsReflectionEnabledByDefault>true</JsonSerializerIsReflectionEnabledByDefault>
6+
<NoWarn>$(NoWarn);SYSLIB0057</NoWarn>
67
</PropertyGroup>
78

89
<ItemGroup>

‎src/libraries/System.Net.Http.WinHttpHandler/tests/FunctionalTests/System.Net.Http.WinHttpHandler.Functional.Tests.csproj

+1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
<IncludeRemoteExecutor>true</IncludeRemoteExecutor>
55
<DefineConstants>$(DefineConstants);WINHTTPHANDLER_TEST</DefineConstants>
66
<EnablePreviewFeatures>true</EnablePreviewFeatures>
7+
<NoWarn>$(NoWarn);SYSLIB0057</NoWarn>
78
</PropertyGroup>
89
<ItemGroup>
910
<Compile Include="$(CommonTestPath)System\Net\Configuration.cs"

‎src/libraries/System.Net.Http.WinHttpHandler/tests/UnitTests/System.Net.Http.WinHttpHandler.Unit.Tests.csproj

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22
<PropertyGroup>
3-
<NoWarn>$(NoWarn);0436</NoWarn>
3+
<NoWarn>$(NoWarn);0436;SYSLIB0057</NoWarn>
44
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
55
<StringResourcesPath>../../src/Resources/Strings.resx</StringResourcesPath>
66
<TargetFramework>$(NetCoreAppCurrent)-windows</TargetFramework>

‎src/libraries/System.Net.Http/tests/FunctionalTests/System.Net.Http.Functional.Tests.csproj

+1
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
<TargetFrameworks>$(NetCoreAppCurrent)-windows;$(NetCoreAppCurrent)-linux;$(NetCoreAppCurrent)-android;$(NetCoreAppCurrent)-browser;$(NetCoreAppCurrent)-osx</TargetFrameworks>
1010
<EnablePreviewFeatures>true</EnablePreviewFeatures>
1111
<EventSourceSupport Condition="'$(TestNativeAot)' == 'true'">true</EventSourceSupport>
12+
<NoWarn>$(NoWarn);SYSLIB0057</NoWarn>
1213
</PropertyGroup>
1314

1415
<!-- DesignTimeBuild requires all the TargetFramework Derived Properties to not be present in the first property group. -->

‎src/libraries/System.Net.HttpListener/src/System/Net/Managed/HttpConnection.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ public HttpConnection(Socket sock, HttpEndPointListener epl, bool secure, X509Ce
9191
return true;
9292
}
9393

94-
_clientCert = c as X509Certificate2 ?? new X509Certificate2(c.GetRawCertData());
94+
_clientCert = c as X509Certificate2 ?? X509CertificateLoader.LoadCertificate(c.GetRawCertData());
9595
_clientCertErrors = new int[] { (int)e };
9696
return true;
9797
});

‎src/libraries/System.Net.HttpListener/src/System/Net/Windows/HttpListenerRequest.Windows.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -477,7 +477,7 @@ private void GetClientCertificateCore()
477477
{
478478
byte[] certEncoded = new byte[pClientCertInfo->CertEncodedSize];
479479
Marshal.Copy((IntPtr)pClientCertInfo->pCertEncoded, certEncoded, 0, certEncoded.Length);
480-
ClientCertificate = new X509Certificate2(certEncoded);
480+
ClientCertificate = X509CertificateLoader.LoadCertificate(certEncoded);
481481
}
482482
catch (CryptographicException exception)
483483
{

‎src/libraries/System.Net.HttpListener/src/System/Net/Windows/ListenerClientCertAsyncResult.Windows.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ private static unsafe void IOCompleted(ListenerClientCertAsyncResult asyncResult
123123
{
124124
byte[] certEncoded = new byte[pClientCertInfo->CertEncodedSize];
125125
Marshal.Copy((IntPtr)pClientCertInfo->pCertEncoded, certEncoded, 0, certEncoded.Length);
126-
result = httpListenerRequest.ClientCertificate = new X509Certificate2(certEncoded);
126+
result = httpListenerRequest.ClientCertificate = X509CertificateLoader.LoadCertificate(certEncoded);
127127
}
128128
catch (CryptographicException exception)
129129
{

‎src/libraries/System.Net.NetworkInformation/tests/FunctionalTests/System.Net.NetworkInformation.Functional.Tests.csproj

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
<IgnoreForCI Condition="'$(TargetOS)' == 'browser'">true</IgnoreForCI>
77
<DefineConstants>$(DefineConstants);NETWORKINFORMATION_TEST</DefineConstants>
88
<EventSourceSupport Condition="'$(TestNativeAot)' == 'true'">true</EventSourceSupport>
9+
<NoWarn>$(NoWarn);SYSLIB0057</NoWarn>
910
</PropertyGroup>
1011
<ItemGroup>
1112
<Compile Include="AssemblyInfo.cs" />

‎src/libraries/System.Net.Quic/src/System/Net/Quic/QuicConnection.SslConnectionOptions.cs

+4-1
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ internal async Task<bool> StartAsyncCertificateValidation(IntPtr certificatePtr,
129129
if (certData.Length > 0)
130130
{
131131
Debug.Assert(certificate == null);
132-
certificate = new X509Certificate2(certData.Span);
132+
certificate = X509CertificateLoader.LoadCertificate(certData.Span);
133133
}
134134

135135
result = _connection._sslConnectionOptions.ValidateCertificate(certificate, certData.Span, chainData.Span);
@@ -205,8 +205,11 @@ private QUIC_TLS_ALERT_CODES ValidateCertificate(X509Certificate2? certificate,
205205

206206
if (chainData.Length > 0)
207207
{
208+
Debug.Assert(X509Certificate2.GetCertContentType(chainData) is X509ContentType.Pkcs7);
208209
X509Certificate2Collection additionalCertificates = new X509Certificate2Collection();
210+
#pragma warning disable SYSLIB0057
209211
additionalCertificates.Import(chainData);
212+
#pragma warning restore SYSLIB0057
210213
chain.ChainPolicy.ExtraStore.AddRange(additionalCertificates);
211214
}
212215

‎src/libraries/System.Net.Quic/tests/FunctionalTests/System.Net.Quic.Functional.Tests.csproj

+1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
<TargetFrameworks>$(NetCoreAppCurrent)-windows;$(NetCoreAppCurrent)-linux;$(NetCoreAppCurrent)-osx</TargetFrameworks>
66
<EnablePreviewFeatures>true</EnablePreviewFeatures>
77
<StringResourcesPath>../../src/Resources/Strings.resx</StringResourcesPath>
8+
<NoWarn>$(NoWarn);SYSLIB0057</NoWarn>
89
</PropertyGroup>
910
<ItemGroup>
1011
<RdXmlFile Include="default.rd.xml" />

‎src/libraries/System.Net.Requests/tests/System.Net.Requests.Tests.csproj

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<DefineConstants>$(DefineConstants);NETSTANDARD</DefineConstants>
77
<IgnoreForCI Condition="'$(TargetOS)' == 'browser'">true</IgnoreForCI>
88
<!-- SYSLIB0014: WebRequest, HttpWebRequest, ServicePoint, and WebClient are obsolete. Use HttpClient instead. -->
9-
<NoWarn>$(NoWarn);SYSLIB0014</NoWarn>
9+
<NoWarn>$(NoWarn);SYSLIB0014;SYSLIB0057</NoWarn>
1010
<EnablePreviewFeatures>true</EnablePreviewFeatures>
1111
<EventSourceSupport Condition="'$(TestNativeAot)' == 'true'">true</EventSourceSupport>
1212
</PropertyGroup>

‎src/libraries/System.Net.Security/src/System/Net/Security/Pal.OSX/SafeDeleteSslContext.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -384,7 +384,7 @@ internal static void SetCertificate(SafeSslHandle sslContext, SslStreamCertifica
384384
// The current value of intermediateCert is still in elements, which will
385385
// get Disposed at the end of this method. The new value will be
386386
// in the intermediate certs array, which also gets serially Disposed.
387-
intermediateCert = new X509Certificate2(intermediateCert.RawDataMemory.Span);
387+
intermediateCert = X509CertificateLoader.LoadCertificate(intermediateCert.RawDataMemory.Span);
388388
}
389389

390390
ptrs[i + 1] = intermediateCert.Handle;

‎src/libraries/System.Net.Security/tests/FunctionalTests/System.Net.Security.Tests.csproj

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
<IgnoreForCI Condition="'$(TargetOS)' == 'browser'">true</IgnoreForCI>
77
<EnablePreviewFeatures>true</EnablePreviewFeatures>
88
<EventSourceSupport Condition="'$(TestNativeAot)' == 'true'">true</EventSourceSupport>
9+
<NoWarn>$(NoWarn);SYSLIB0057</NoWarn>
910
</PropertyGroup>
1011
<ItemGroup>
1112
<Compile Include="AssemblyInfo.cs" />

‎src/libraries/System.Net.Security/tests/UnitTests/System.Net.Security.Unit.Tests.csproj

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
-->
1010
<NoWarn>436</NoWarn>
1111
<!-- Disable: CLSCompliant attribute is not needed -->
12-
<NoWarn>$(NoWarn);3021</NoWarn>
12+
<NoWarn>$(NoWarn);3021;SYSLIB0057</NoWarn>
1313
<TargetFrameworks>$(NetCoreAppCurrent)-windows;$(NetCoreAppCurrent)-unix;$(NetCoreAppCurrent)-browser;$(NetCoreAppCurrent)-osx;$(NetCoreAppCurrent)-ios;$(NetCoreAppCurrent)-android</TargetFrameworks>
1414
<IgnoreForCI Condition="'$(TargetOS)' == 'browser'">true</IgnoreForCI>
1515
</PropertyGroup>

‎src/libraries/System.Net.WebClient/tests/System.Net.WebClient.Tests.csproj

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<TargetFramework>$(NetCoreAppCurrent)</TargetFramework>
44
<DefineConstants>$(DefineConstants);NETSTANDARD</DefineConstants>
55
<!-- SYSLIB0014: WebRequest, HttpWebRequest, ServicePoint, and WebClient are obsolete. Use HttpClient instead. -->
6-
<NoWarn>$(NoWarn);SYSLIB0014</NoWarn>
6+
<NoWarn>$(NoWarn);SYSLIB0014;SYSLIB0057</NoWarn>
77
<IgnoreForCI Condition="'$(TargetOS)' == 'browser'">true</IgnoreForCI>
88
</PropertyGroup>
99
<ItemGroup>

‎src/libraries/System.Net.WebSockets.Client/tests/System.Net.WebSockets.Client.Tests.csproj

+1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
<StringResourcesPath>../src/Resources/Strings.resx</StringResourcesPath>
66
<TargetFrameworks>$(NetCoreAppCurrent);$(NetCoreAppCurrent)-browser</TargetFrameworks>
77
<DefineConstants>$(DefineConstants);NETSTANDARD</DefineConstants>
8+
<NoWarn>$(NoWarn);SYSLIB0057</NoWarn>
89
</PropertyGroup>
910

1011
<PropertyGroup Condition="'$(TargetOS)' == 'browser'">

‎src/libraries/System.Security.Cryptography.Pkcs/src/Internal/Cryptography/Pal/AnyOS/ManagedPal.Decode.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ public override DecryptorPal Decode(
4545
{
4646
if (certChoice.Certificate != null)
4747
{
48-
originatorCerts.Add(new X509Certificate2(certChoice.Certificate.Value.ToArray()));
48+
originatorCerts.Add(X509CertificateLoader.LoadCertificate(certChoice.Certificate.Value.Span));
4949
}
5050
}
5151
}

‎src/libraries/System.Security.Cryptography.Pkcs/src/Internal/Cryptography/Pal/Windows/HelpersWindows.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ public static X509Certificate2Collection GetOriginatorCerts(this SafeCryptMsgHan
131131
for (int index = 0; index < numCertificates; index++)
132132
{
133133
byte[] encodedCertificate = hCryptMsg.GetMsgParamAsByteArray(CryptMsgParamType.CMSG_CERT_PARAM, index);
134-
X509Certificate2 cert = new X509Certificate2(encodedCertificate);
134+
X509Certificate2 cert = X509CertificateLoader.LoadCertificate(encodedCertificate);
135135
certs.Add(cert);
136136
}
137137
return certs;

‎src/libraries/System.Security.Cryptography.Pkcs/src/System.Security.Cryptography.Pkcs.csproj

+4
Original file line numberDiff line numberDiff line change
@@ -663,6 +663,10 @@ System.Security.Cryptography.Pkcs.EnvelopedCms</PackageDescription>
663663
<PackageReference Include="System.Memory" Version="$(SystemMemoryVersion)" />
664664
</ItemGroup>
665665

666+
<ItemGroup Condition="!$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net9.0'))">
667+
<ProjectReference Include="$(LibrariesProjectRoot)Microsoft.Bcl.Cryptography\src\Microsoft.Bcl.Cryptography.csproj" />
668+
</ItemGroup>
669+
666670
<ItemGroup Condition="'$(TargetFrameworkIdentifier)' == '.NETFramework'">
667671
<Reference Include="System.Security" />
668672
</ItemGroup>

‎src/libraries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/Pkcs12CertBag.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ public X509Certificate2 GetCertificate()
7676
throw new InvalidOperationException(SR.Cryptography_Pkcs12_CertBagNotX509);
7777
}
7878

79-
return new X509Certificate2(PkcsHelpers.DecodeOctetString(_decoded.CertValue));
79+
return X509CertificateLoader.LoadCertificate(PkcsHelpers.DecodeOctetString(_decoded.CertValue));
8080
}
8181

8282
private static byte[] EncodeBagValue(Oid certificateType, ReadOnlyMemory<byte> encodedCertificate)

‎src/libraries/System.Security.Cryptography.Pkcs/src/System/Security/Cryptography/Pkcs/SignedCms.cs

+1-7
Original file line numberDiff line numberDiff line change
@@ -95,13 +95,7 @@ public X509Certificate2Collection Certificates
9595
{
9696
if (choice.Certificate.HasValue)
9797
{
98-
coll.Add(new X509Certificate2(choice.Certificate.Value
99-
#if NET
100-
.Span
101-
#else
102-
.ToArray()
103-
#endif
104-
));
98+
coll.Add(X509CertificateLoader.LoadCertificate(choice.Certificate.Value.Span));
10599
}
106100
}
107101

‎src/libraries/System.Security.Cryptography.Pkcs/tests/System.Security.Cryptography.Pkcs.Tests.csproj

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
<PropertyGroup>
33
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
44
<TargetFrameworks>$(NetCoreAppCurrent)-windows;$(NetCoreAppCurrent);$(NetFrameworkCurrent)</TargetFrameworks>
5+
<NoWarn>$(NoWarn);SYSLIB0057</NoWarn>
56
</PropertyGroup>
67
<ItemGroup>
78
<Compile Include="$(CommonTestPath)System\Security\Cryptography\ByteUtils.cs"

‎src/libraries/System.Security.Cryptography.Xml/src/System.Security.Cryptography.Xml.csproj

+4
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,10 @@ System.Security.Cryptography.Xml.XmlLicenseTransform</PackageDescription>
154154
<PackageReference Include="System.Memory" Version="$(SystemMemoryVersion)" />
155155
</ItemGroup>
156156

157+
<ItemGroup Condition="!$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net9.0'))">
158+
<ProjectReference Include="$(LibrariesProjectRoot)Microsoft.Bcl.Cryptography\src\Microsoft.Bcl.Cryptography.csproj" />
159+
</ItemGroup>
160+
157161
<ItemGroup Condition="'$(IsPartialFacadeAssembly)' == 'true'">
158162
<Reference Include="System.Security" />
159163
</ItemGroup>

‎src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/KeyInfoX509Data.cs

+12-2
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,15 @@ public KeyInfoX509Data() { }
3030

3131
public KeyInfoX509Data(byte[] rgbCert)
3232
{
33-
X509Certificate2 certificate = new X509Certificate2(rgbCert);
33+
// Compat: this accepts null arrays for certificate data and would not throw. X509CertificateLoader throws
34+
// for a null input. This uses the X509Certificate2 constructor for null inputs to preserve the existing
35+
// behavior. Since the input is null and there is nothing to decode, the input is safe for the constructor.
36+
#pragma warning disable SYSLIB0057
37+
X509Certificate2 certificate = rgbCert is null ?
38+
new X509Certificate2((byte[])null!) :
39+
X509CertificateLoader.LoadCertificate(rgbCert);
40+
#pragma warning restore SYSLIB0057
41+
3442
AddCertificate(certificate);
3543
}
3644

@@ -316,7 +324,9 @@ public override void LoadXml(XmlElement element)
316324

317325
foreach (XmlNode node in x509CertificateNodes)
318326
{
319-
AddCertificate(new X509Certificate2(Convert.FromBase64String(Utils.DiscardWhiteSpaces(node.InnerText))));
327+
AddCertificate(
328+
X509CertificateLoader.LoadCertificate(
329+
Convert.FromBase64String(Utils.DiscardWhiteSpaces(node.InnerText))));
320330
}
321331
}
322332
}

‎src/libraries/System.Security.Cryptography.Xml/tests/System.Security.Cryptography.Xml.Tests.csproj

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
<PropertyGroup>
33
<TargetFrameworks>$(NetCoreAppCurrent);$(NetFrameworkMinimum)</TargetFrameworks>
44
<Nullable>disable</Nullable>
5+
<NoWarn>$(NoWarn);SYSLIB0057</NoWarn>
56
</PropertyGroup>
67
<ItemGroup>
78
<Compile Include="$(CommonTestPath)System\Security\Cryptography\PlatformSupport.cs"

0 commit comments

Comments
 (0)