Skip to content

修正一些包的风险,提取一些包特性到公共文件中(不同于Directory.Build.props) #275

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion App/App.csproj
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
<PropertyGroup>
<OutputType>Exe</OutputType>
<Nullable>enable</Nullable>
<TargetFrameworks>netcoreapp3.0;netcoreapp3.1;net5.0;net6.0;net7.0;net8.0</TargetFrameworks>
<TargetFrameworks>netcoreapp3.0;netcoreapp3.1;net5.0;net6.0;net7.0;net8.0;net9.0</TargetFrameworks>
<PackageRequireLicenseAcceptance>false</PackageRequireLicenseAcceptance>
<GeneratePackageOnBuild>false</GeneratePackageOnBuild>
</PropertyGroup>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,9 +1,8 @@
<Project Sdk="Microsoft.NET.Sdk">

<Import Project="../props/WebApiClientCore.Common.props" />
<PropertyGroup>
<Nullable>enable</Nullable>
<TargetFrameworks>netstandard2.1;net5.0;net8.0</TargetFrameworks>
<IsAotCompatible Condition="'$(TargetFramework)' == 'net8.0'">true</IsAotCompatible>
<IsAotCompatible>$(WebApiClientCoreIsAotCompatible)</IsAotCompatible>

<RootNamespace>WebApiClientCore</RootNamespace>
<AssemblyName>WebApiClientCore.Abstractions</AssemblyName>
Expand All @@ -19,5 +18,6 @@
<ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.1'">
<PackageReference Include="System.Text.Json" Version="4.6.0" />
<PackageReference Include="System.ComponentModel.Annotations" Version="4.6.0" />
<PackageReference Include="System.Text.Encodings.Web" Version="4.7.2" />
</ItemGroup>
Comment on lines +21 to 22
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Verify new package reference version.
Ensure that System.Text.Encodings.Web version 4.7.2 is intended for your netstandard2.1 target and that no known vulnerabilities affect it. If this dependency is not part of your public API surface, consider adding <PrivateAssets>all</PrivateAssets>.


🌐 Web query:

What is the latest stable version of the NuGet package System.Text.Encodings.Web, and are there any known security advisories for version 4.7.2?

💡 Result:

Latest Stable Version of System.Text.Encodings.Web

The latest stable version of the NuGet package System.Text.Encodings.Web as of April 2025 is 9.0.4[1]. This version provides important types for securely encoding and escaping strings for use in JavaScript, HTML, and URLs.

Security Advisories for Version 4.7.2

Yes, there are known security advisories affecting System.Text.Encodings.Web version 4.7.2. Specifically, this version is vulnerable to a remote code execution vulnerability (CVE-2021-26701), which affects several versions of the package, including 4.6.0 through 4.7.2 and some in the 5.x series[6]. The vulnerability concerns how text encoding is performed and can impact any .NET 5, .NET Core, or .NET Framework application using these versions of the package.

Details:

  • Vulnerability: Remote code execution
  • CVE: CVE-2021-26701
  • Affected Versions: 4.6.0 – 4.7.2, 5.0.0, 5.0.1
  • Mitigation: Upgrade to a newer, patched version. Microsoft recommends updating the package and redeploying your application to ensure security[6].
  • No further vulnerabilities are listed specifically against version 4.7.2 in some other vulnerability databases, but CVE-2021-26701 is confirmed and relevant[4][6].

Summary Table

Version Latest Stable Known Security Advisory for 4.7.2?
System.Text.Encodings.Web 9.0.4 Yes, CVE-2021-26701 (Remote Code Execution)[6]

Recommendation:
If you are using System.Text.Encodings.Web version 4.7.2, you should upgrade to the latest stable version (currently 9.0.4) to address security concerns[1][6].


For further details or to verify the latest version, consult the official NuGet package page for System.Text.Encodings.Web[1].

Citations:


Upgrade System.Text.Encodings.Web to a patched version

Version 4.7.2 is affected by CVE-2021-26701 (remote code execution). The latest stable release is 9.0.4. Please update and, if this dependency isn’t exposed in your public API, mark it as private.

• In WebApiClientCore.Abstractions/WebApiClientCore.Abstractions.csproj, change:

-   <PackageReference Include="System.Text.Encodings.Web" Version="4.7.2" />
+   <PackageReference Include="System.Text.Encodings.Web" Version="9.0.4">
+     <PrivateAssets>all</PrivateAssets>
+   </PackageReference>
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
<PackageReference Include="System.Text.Encodings.Web" Version="4.7.2" />
</ItemGroup>
<PackageReference Include="System.Text.Encodings.Web" Version="9.0.4">
<PrivateAssets>all</PrivateAssets>
</PackageReference>
</ItemGroup>

</Project>
</Project>
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ public override IEnumerable<Diagnostic> CreateDiagnostics()
if (declaringSyntax is ParameterSyntax parameterSyntax)
{
var modifier = parameterSyntax.Modifiers.FirstOrDefault();
if (modifier != null)
if (modifier != default)
{
var location = modifier.GetLocation();
yield return this.CreateDiagnostic(location);
Expand Down
15 changes: 14 additions & 1 deletion WebApiClientCore.Analyzers/SourceGenerator/HttpApiProxyClass.cs
Original file line number Diff line number Diff line change
Expand Up @@ -166,8 +166,21 @@ private class MethodEqualityComparer : IEqualityComparer<IMethodSymbol>
{
public static MethodEqualityComparer Default { get; } = new MethodEqualityComparer();

public bool Equals(IMethodSymbol x, IMethodSymbol y)
public bool Equals(IMethodSymbol? x, IMethodSymbol? y)
{
#if NET8_0_OR_GREATER
ArgumentNullException.ThrowIfNull(x);
ArgumentNullException.ThrowIfNull(y);
#else
if (x is null)
{
throw new ArgumentNullException(nameof(x));
}
if (y is null)
{
throw new ArgumentNullException(nameof(y));
}
#endif
if (x.Name != y.Name || !x.ReturnType.Equals(y.ReturnType, SymbolEqualityComparer.Default))
{
return false;
Expand Down
21 changes: 12 additions & 9 deletions WebApiClientCore.Analyzers/WebApiClientCore.Analyzers.csproj
Original file line number Diff line number Diff line change
@@ -1,18 +1,18 @@
<Project Sdk="Microsoft.NET.Sdk">

<Import Project="../props/WebApiClientCore.Common.props"/>
<PropertyGroup>
<Nullable>enable</Nullable>
<TargetFramework>netstandard2.0</TargetFramework>
<GenerateDocumentationFile>True</GenerateDocumentationFile>
<GeneratePackageOnBuild>false</GeneratePackageOnBuild>
<PackageRequireLicenseAcceptance>false</PackageRequireLicenseAcceptance>
<SignAssembly>true</SignAssembly>
<AssemblyOriginatorKeyFile>Sign.snk</AssemblyOriginatorKeyFile>
</PropertyGroup>

<ItemGroup>
<PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="3.8.0" PrivateAssets="all" />
<PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.2" PrivateAssets="all" />
<PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="3.8.0"
PrivateAssets="all" />
<PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.2"
PrivateAssets="all" />
</ItemGroup>

<ItemGroup>
Expand All @@ -24,13 +24,16 @@
</ItemGroup>

<ItemGroup>
<EmbeddedResource Update="Resx.en-US.resx">
<Generator></Generator>
</EmbeddedResource>

<EmbeddedResource Update="Resx.resx">
<Generator>ResXFileCodeGenerator</Generator>
<LastGenOutput>Resx.Designer.cs</LastGenOutput>
</EmbeddedResource>
<EmbeddedResource Update="Resx.en-US.resx">
<Generator>ResXFileCodeGenerator</Generator>
<LastGenOutput>Resx.Designer.cs</LastGenOutput>
<DependentUpon>Resx.resx</DependentUpon>
</EmbeddedResource>
Comment on lines +32 to +36
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Verify en-US resource embedding.
A new <EmbeddedResource> entry for Resx.en-US.resx was added. Please confirm that Resx.en-US.resx exists in the project directory and that the <DependentUpon> relationship correctly ties it to Resx.resx so the designer file is generated as expected.


🏁 Script executed:

#!/bin/bash
# Verify the localized resource file exists alongside Resx.resx
test -f "$(dirname "$0")/Resx.en-US.resx" && echo "Resx.en-US.resx found." || echo "ERROR: Resx.en-US.resx missing."

Length of output: 173


Missing Resx.en-US.resx resource file
The <EmbeddedResource> entry for Resx.en-US.resx isn’t resolvable—no such file exists alongside Resx.resx. Please add Resx.en-US.resx to the project directory or remove/update this entry if the localized resource isn’t needed.

• File to update:

  • WebApiClientCore.Analyzers/WebApiClientCore.Analyzers.csproj (lines 32–36)

• Actions:

  • Add WebApiClientCore.Analyzers/Resx.en-US.resx next to Resx.resx
  • OR remove or adjust the <EmbeddedResource> block if you don’t intend to embed an en-US resource
-   <EmbeddedResource Update="Resx.en-US.resx">
+   <EmbeddedResource Include="Resx.en-US.resx">
      <Generator>ResXFileCodeGenerator</Generator>
      <LastGenOutput>Resx.Designer.cs</LastGenOutput>
      <DependentUpon>Resx.resx</DependentUpon>
    </EmbeddedResource>

Committable suggestion skipped: line range outside the PR's diff.

</ItemGroup>

</Project>
</Project>
Original file line number Diff line number Diff line change
@@ -1,9 +1,7 @@
<Project Sdk="Microsoft.NET.Sdk">

<Import Project="../props/WebApiClientCore.Extensions.Common.props"/>
<PropertyGroup>
<Nullable>enable</Nullable>
<TargetFramework>netstandard2.1</TargetFramework>
<GenerateDocumentationFile>True</GenerateDocumentationFile>

<SignAssembly>true</SignAssembly>
<AssemblyOriginatorKeyFile>Sign.snk</AssemblyOriginatorKeyFile>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,9 +1,7 @@
<Project Sdk="Microsoft.NET.Sdk">

<Import Project="../props/WebApiClientCore.Extensions.Common.props"/>
<PropertyGroup>
<Nullable>enable</Nullable>
<TargetFramework>netstandard2.1</TargetFramework>
<GenerateDocumentationFile>True</GenerateDocumentationFile>

<SignAssembly>true</SignAssembly>
<AssemblyOriginatorKeyFile>Sign.snk</AssemblyOriginatorKeyFile>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,10 +1,8 @@
<Project Sdk="Microsoft.NET.Sdk">

<Import Project="../props/WebApiClientCore.Common.props" />
<PropertyGroup>
<Nullable>enable</Nullable>
<GenerateDocumentationFile>True</GenerateDocumentationFile>
<TargetFrameworks>netstandard2.1;net5.0;net8.0</TargetFrameworks>
<IsAotCompatible Condition="'$(TargetFramework)' == 'net8.0'">true</IsAotCompatible>
<IsAotCompatible>$(WebApiClientCoreIsAotCompatible)</IsAotCompatible>

<SignAssembly>true</SignAssembly>
<AssemblyOriginatorKeyFile>Sign.snk</AssemblyOriginatorKeyFile>
Expand All @@ -16,4 +14,4 @@
<ItemGroup>
<ProjectReference Include="..\WebApiClientCore\WebApiClientCore.csproj" />
</ItemGroup>
</Project>
</Project>
Original file line number Diff line number Diff line change
@@ -1,8 +1,7 @@
<Project Sdk="Microsoft.NET.Sdk">

<Import Project="../props/WebApiClientCore.Extensions.Common.props"/>
<PropertyGroup>
<Nullable>enable</Nullable>
<IncludeBuildOutput>false</IncludeBuildOutput>
<TargetFramework>netstandard2.1</TargetFramework>
<SignAssembly>true</SignAssembly>
<AssemblyOriginatorKeyFile>Sign.snk</AssemblyOriginatorKeyFile>
<Summary>此扩展包的实现已合并到WebApiClientCore包,无任何功能</Summary>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
<PropertyGroup>
<OutputType>Exe</OutputType>
<Nullable>enable</Nullable>
<TargetFrameworks>netcoreapp3.1;net6.0;net8.0</TargetFrameworks>
<TargetFrameworks>netcoreapp3.1;net6.0;net8.0;net9.0</TargetFrameworks>

<Summary>将本地或远程OpenApi文档解析生成WebApiClientCore的接口定义代码文件的工具</Summary>
<SatelliteResourceLanguages>zh-Hans</SatelliteResourceLanguages>
Expand All @@ -18,6 +18,9 @@
<PackageReference Include="CommandLineParser" Version="2.9.1" />
<PackageReference Include="RazorEngineCore" Version="2020.6.1" />
<PackageReference Include="NSwag.CodeGeneration.CSharp" Version="13.19.0" />
<PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
<PackageReference Include="System.Net.Http" Version="4.3.4" />
<PackageReference Include="System.Text.RegularExpressions" Version="4.3.1" />
</ItemGroup>

<ItemGroup>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,11 @@ namespace WebApiClientCore.Test.Implementations.Tasks
{
public class ActionRetryTaskTest
{
class ResultApiTask<T> : TaskBase<T>
class ResultApiTask<T> : TaskBase<T?>
{
public T? Result { get; set; }

protected override Task<T> InvokeAsync()
protected override Task<T?> InvokeAsync()
{
return Task.FromResult(Result);
}
Expand Down
2 changes: 1 addition & 1 deletion WebApiClientCore.Test/WebApiClientCore.Test.csproj
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<Project Sdk="Microsoft.NET.Sdk">

<PropertyGroup>
<TargetFrameworks>net6.0;net8.0</TargetFrameworks>
<TargetFrameworks>net6.0;net8.0;net9.0</TargetFrameworks>
<Nullable>enable</Nullable>
<SignAssembly>true</SignAssembly>
<AssemblyOriginatorKeyFile>Test.snk</AssemblyOriginatorKeyFile>
Expand Down
10 changes: 7 additions & 3 deletions WebApiClientCore/DependencyInjection/NamedHttpApiExtensions.cs
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,8 @@ internal static void NamedHttpApiType(this IServiceCollection services, string n
services.TryAddSingleton(new NameTypeRegistration());
var descriptor = services.Single(item => item.ServiceType == typeof(NameTypeRegistration));

var registration = (NameTypeRegistration)descriptor.ImplementationInstance;
registration[name] = httpApiType;
var registration = (NameTypeRegistration?)descriptor.ImplementationInstance;
registration![name] = httpApiType;
Comment on lines +24 to +25
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Consider replacing null-forgiving operator with explicit null check

The null-forgiving operator (!) on line 25 suppresses the nullable warning without actually verifying if registration is null. If registration is null at runtime, this will cause a NullReferenceException.

-var registration = (NameTypeRegistration?)descriptor.ImplementationInstance;
-registration![name] = httpApiType;
+var registration = (NameTypeRegistration?)descriptor.ImplementationInstance;
+if (registration == null)
+{
+    throw new InvalidOperationException($"The {nameof(NameTypeRegistration)} instance was not properly initialized.");
+}
+registration[name] = httpApiType;

}

/// <summary>
Expand All @@ -38,7 +38,11 @@ internal static void NamedHttpApiType(this IServiceCollection services, string n
return null;
}

var registration = (NameTypeRegistration)descriptor.ImplementationInstance;
var registration = (NameTypeRegistration?)descriptor.ImplementationInstance;
if (registration == null)
{
return null;
}
registration.TryGetValue(builder.Name, out var type);
return type;
}
Expand Down
39 changes: 25 additions & 14 deletions WebApiClientCore/WebApiClientCore.csproj
Original file line number Diff line number Diff line change
@@ -1,40 +1,49 @@
<Project Sdk="Microsoft.NET.Sdk">

<Import Project="../props/WebApiClientCore.Common.props" />
<PropertyGroup>
<Nullable>enable</Nullable>
<GenerateDocumentationFile>True</GenerateDocumentationFile>
<TargetFrameworks>netstandard2.1;net5.0;net8.0</TargetFrameworks>
<IsAotCompatible Condition="'$(TargetFramework)' == 'net8.0'">true</IsAotCompatible>
<IsAotCompatible>$(WebApiClientCoreIsAotCompatible)</IsAotCompatible>

<Description>.NetCore声明式的Http客户端库</Description>
<Summary>一款基于HttpClient封装,只需要定义c#接口并修饰相关特性,即可异步调用远程http接口的客户端库</Summary>

<SignAssembly>true</SignAssembly>
<AssemblyOriginatorKeyFile>Sign.snk</AssemblyOriginatorKeyFile>
</PropertyGroup>
</PropertyGroup>

<ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.1'">
<PackageReference Include="System.Net.Http.Json" Version="3.2.0" />
<PackageReference Include="Microsoft.Extensions.Http" Version="3.0.0" />
<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="3.0.0" />
<PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="3.0.0" />
<PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions"
Version="3.0.0" />
</ItemGroup>

<ItemGroup Condition="'$(TargetFramework)' == 'net5.0'">
<PackageReference Include="Microsoft.Extensions.Http" Version="5.0.0" />
<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="5.0.0" />
<PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="5.0.0" />
<PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions"
Version="5.0.0" />
</ItemGroup>

<ItemGroup Condition="'$(TargetFramework)' == 'net8.0'">
<PackageReference Include="Microsoft.Extensions.Http" Version="8.0.0" />
<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
<PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="8.0.0" />
<PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions"
Version="8.0.0" />
</ItemGroup>

<ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
<PackageReference Include="Microsoft.Extensions.Http" Version="9.0.0" />
<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="9.0.0" />
<PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions"
Version="9.0.0" />
</ItemGroup>

<ItemGroup>
<ProjectReference Include="..\WebApiClientCore.Abstractions\WebApiClientCore.Abstractions.csproj" />
<ProjectReference Include="..\WebApiClientCore.Analyzers\WebApiClientCore.Analyzers.csproj" ReferenceOutputAssembly="false" />
<ProjectReference
Include="..\WebApiClientCore.Abstractions\WebApiClientCore.Abstractions.csproj" />
<ProjectReference Include="..\WebApiClientCore.Analyzers\WebApiClientCore.Analyzers.csproj"
ReferenceOutputAssembly="false" />
</ItemGroup>

<ItemGroup>
Expand All @@ -51,8 +60,10 @@
</EmbeddedResource>
</ItemGroup>

<!--nuget analyzers目录-->
<!--nuget
analyzers目录-->
<ItemGroup>
<None Include="$(OutputPath)\..\..\WebApiClientCore.Analyzers\$(Configuration)\**" PackagePath="analyzers\dotnet\cs" Pack="true" Visible="false" />
<None Include="$(OutputPath)\..\..\WebApiClientCore.Analyzers\$(Configuration)\**"
PackagePath="analyzers\dotnet\cs" Pack="true" Visible="false" />
</ItemGroup>
</Project>
</Project>
15 changes: 15 additions & 0 deletions props/WebApiClientCore.Common.props
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
<Project>
<PropertyGroup>
<Nullable>enable</Nullable>
<GenerateDocumentationFile>True</GenerateDocumentationFile>
<TargetFrameworks>netstandard2.1;net5.0;net8.0;net9.0</TargetFrameworks>
<LangVersion>latest</LangVersion>
</PropertyGroup>
<PropertyGroup>
<WebApiClientCoreIsAotCompatible>false</WebApiClientCoreIsAotCompatible>
<WebApiClientCoreIsAotCompatible Condition="'$(TargetFramework)' == 'netstandard2.1'">false</WebApiClientCoreIsAotCompatible>
<WebApiClientCoreIsAotCompatible Condition="'$(TargetFramework)' == 'net5.0'">false</WebApiClientCoreIsAotCompatible>
<WebApiClientCoreIsAotCompatible Condition="'$(TargetFramework)' == 'net8.0'">true</WebApiClientCoreIsAotCompatible>
<WebApiClientCoreIsAotCompatible Condition="'$(TargetFramework)' == 'net9.0'">true</WebApiClientCoreIsAotCompatible>
</PropertyGroup>
</Project>
7 changes: 7 additions & 0 deletions props/WebApiClientCore.Extensions.Common.props
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
<Project>
<PropertyGroup>
<Nullable>enable</Nullable>
<TargetFramework>netstandard2.1</TargetFramework>
<GenerateDocumentationFile>True</GenerateDocumentationFile>
</PropertyGroup>
</Project>