-
Notifications
You must be signed in to change notification settings - Fork 447
修正一些包的风险,提取一些包特性到公共文件中(不同于Directory.Build.props) #275
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,18 +1,18 @@ | ||
<Project Sdk="Microsoft.NET.Sdk"> | ||
|
||
<Import Project="../props/WebApiClientCore.Common.props"/> | ||
<PropertyGroup> | ||
<Nullable>enable</Nullable> | ||
<TargetFramework>netstandard2.0</TargetFramework> | ||
<GenerateDocumentationFile>True</GenerateDocumentationFile> | ||
<GeneratePackageOnBuild>false</GeneratePackageOnBuild> | ||
<PackageRequireLicenseAcceptance>false</PackageRequireLicenseAcceptance> | ||
<SignAssembly>true</SignAssembly> | ||
<AssemblyOriginatorKeyFile>Sign.snk</AssemblyOriginatorKeyFile> | ||
</PropertyGroup> | ||
|
||
<ItemGroup> | ||
<PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="3.8.0" PrivateAssets="all" /> | ||
<PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.2" PrivateAssets="all" /> | ||
<PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="3.8.0" | ||
PrivateAssets="all" /> | ||
<PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.2" | ||
PrivateAssets="all" /> | ||
</ItemGroup> | ||
|
||
<ItemGroup> | ||
|
@@ -24,13 +24,16 @@ | |
</ItemGroup> | ||
|
||
<ItemGroup> | ||
<EmbeddedResource Update="Resx.en-US.resx"> | ||
<Generator></Generator> | ||
</EmbeddedResource> | ||
|
||
<EmbeddedResource Update="Resx.resx"> | ||
<Generator>ResXFileCodeGenerator</Generator> | ||
<LastGenOutput>Resx.Designer.cs</LastGenOutput> | ||
</EmbeddedResource> | ||
<EmbeddedResource Update="Resx.en-US.resx"> | ||
<Generator>ResXFileCodeGenerator</Generator> | ||
<LastGenOutput>Resx.Designer.cs</LastGenOutput> | ||
<DependentUpon>Resx.resx</DependentUpon> | ||
</EmbeddedResource> | ||
Comment on lines
+32
to
+36
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 Verification agent 🧩 Analysis chainVerify en-US resource embedding. 🏁 Script executed: #!/bin/bash
# Verify the localized resource file exists alongside Resx.resx
test -f "$(dirname "$0")/Resx.en-US.resx" && echo "Resx.en-US.resx found." || echo "ERROR: Resx.en-US.resx missing." Length of output: 173 Missing Resx.en-US.resx resource file • File to update:
• Actions:
- <EmbeddedResource Update="Resx.en-US.resx">
+ <EmbeddedResource Include="Resx.en-US.resx">
<Generator>ResXFileCodeGenerator</Generator>
<LastGenOutput>Resx.Designer.cs</LastGenOutput>
<DependentUpon>Resx.resx</DependentUpon>
</EmbeddedResource>
|
||
</ItemGroup> | ||
|
||
</Project> | ||
</Project> |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -21,8 +21,8 @@ internal static void NamedHttpApiType(this IServiceCollection services, string n | |
services.TryAddSingleton(new NameTypeRegistration()); | ||
var descriptor = services.Single(item => item.ServiceType == typeof(NameTypeRegistration)); | ||
|
||
var registration = (NameTypeRegistration)descriptor.ImplementationInstance; | ||
registration[name] = httpApiType; | ||
var registration = (NameTypeRegistration?)descriptor.ImplementationInstance; | ||
registration![name] = httpApiType; | ||
Comment on lines
+24
to
+25
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Consider replacing null-forgiving operator with explicit null check The null-forgiving operator ( -var registration = (NameTypeRegistration?)descriptor.ImplementationInstance;
-registration![name] = httpApiType;
+var registration = (NameTypeRegistration?)descriptor.ImplementationInstance;
+if (registration == null)
+{
+ throw new InvalidOperationException($"The {nameof(NameTypeRegistration)} instance was not properly initialized.");
+}
+registration[name] = httpApiType; |
||
} | ||
|
||
/// <summary> | ||
|
@@ -38,7 +38,11 @@ internal static void NamedHttpApiType(this IServiceCollection services, string n | |
return null; | ||
} | ||
|
||
var registration = (NameTypeRegistration)descriptor.ImplementationInstance; | ||
var registration = (NameTypeRegistration?)descriptor.ImplementationInstance; | ||
if (registration == null) | ||
{ | ||
return null; | ||
} | ||
registration.TryGetValue(builder.Name, out var type); | ||
return type; | ||
} | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,15 @@ | ||
<Project> | ||
<PropertyGroup> | ||
<Nullable>enable</Nullable> | ||
<GenerateDocumentationFile>True</GenerateDocumentationFile> | ||
<TargetFrameworks>netstandard2.1;net5.0;net8.0;net9.0</TargetFrameworks> | ||
<LangVersion>latest</LangVersion> | ||
</PropertyGroup> | ||
<PropertyGroup> | ||
<WebApiClientCoreIsAotCompatible>false</WebApiClientCoreIsAotCompatible> | ||
<WebApiClientCoreIsAotCompatible Condition="'$(TargetFramework)' == 'netstandard2.1'">false</WebApiClientCoreIsAotCompatible> | ||
<WebApiClientCoreIsAotCompatible Condition="'$(TargetFramework)' == 'net5.0'">false</WebApiClientCoreIsAotCompatible> | ||
<WebApiClientCoreIsAotCompatible Condition="'$(TargetFramework)' == 'net8.0'">true</WebApiClientCoreIsAotCompatible> | ||
<WebApiClientCoreIsAotCompatible Condition="'$(TargetFramework)' == 'net9.0'">true</WebApiClientCoreIsAotCompatible> | ||
</PropertyGroup> | ||
</Project> |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
<Project> | ||
<PropertyGroup> | ||
<Nullable>enable</Nullable> | ||
<TargetFramework>netstandard2.1</TargetFramework> | ||
<GenerateDocumentationFile>True</GenerateDocumentationFile> | ||
</PropertyGroup> | ||
</Project> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Verification agent
🧩 Analysis chain
Verify new package reference version.
Ensure that
System.Text.Encodings.Web
version4.7.2
is intended for yournetstandard2.1
target and that no known vulnerabilities affect it. If this dependency is not part of your public API surface, consider adding<PrivateAssets>all</PrivateAssets>
.🌐 Web query:
💡 Result:
Latest Stable Version of System.Text.Encodings.Web
The latest stable version of the NuGet package System.Text.Encodings.Web as of April 2025 is 9.0.4[1]. This version provides important types for securely encoding and escaping strings for use in JavaScript, HTML, and URLs.
Security Advisories for Version 4.7.2
Yes, there are known security advisories affecting System.Text.Encodings.Web version 4.7.2. Specifically, this version is vulnerable to a remote code execution vulnerability (CVE-2021-26701), which affects several versions of the package, including 4.6.0 through 4.7.2 and some in the 5.x series[6]. The vulnerability concerns how text encoding is performed and can impact any .NET 5, .NET Core, or .NET Framework application using these versions of the package.
Details:
Summary Table
Recommendation:
If you are using System.Text.Encodings.Web version 4.7.2, you should upgrade to the latest stable version (currently 9.0.4) to address security concerns[1][6].
For further details or to verify the latest version, consult the official NuGet package page for System.Text.Encodings.Web[1].
Citations:
Upgrade System.Text.Encodings.Web to a patched version
Version 4.7.2 is affected by CVE-2021-26701 (remote code execution). The latest stable release is 9.0.4. Please update and, if this dependency isn’t exposed in your public API, mark it as private.
• In WebApiClientCore.Abstractions/WebApiClientCore.Abstractions.csproj, change:
📝 Committable suggestion