Skip to content

Commit 728edc8

Browse files
ArkatufusArkatufus
authored
Version 0.11.1 Release
Version 0.11.1 Release
2 parents 1f40195 + 63cb41e commit 728edc8

18 files changed

+255
-70
lines changed

‎RELEASE_NOTES.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,33 @@
1+
### 0.11.1 August 17 2021 ####
2+
* Add [unsafe deserialization type blacklist](https://github.com/akkadotnet/Hyperion/pull/242)
3+
* Bump [Akka version from 1.4.21 to 1.4.23](https://github.com/akkadotnet/Hyperion/pull/246)
4+
5+
We've added a deserialization safety check to block dangerous types from being deserialized.
6+
This is done to add a layer of security from possible code injection and code execution attack.
7+
Currently it is an all or nothing feature that can be turned on and off by using the new `DisallowUnsafeTypes` flag inside `SerializerOptions` (defaults to true).
8+
9+
The unsafe types that are currently blocked are:
10+
- System.Security.Claims.ClaimsIdentity
11+
- System.Windows.Forms.AxHost.State
12+
- System.Windows.Data.ObjectDataProvider
13+
- System.Management.Automation.PSObject
14+
- System.Web.Security.RolePrincipal
15+
- System.IdentityModel.Tokens.SessionSecurityToken
16+
- SessionViewStateHistoryItem
17+
- TextFormattingRunProperties
18+
- ToolboxItemContainer
19+
- System.Security.Principal.WindowsClaimsIdentity
20+
- System.Security.Principal.WindowsIdentity
21+
- System.Security.Principal.WindowsPrincipal
22+
- System.CodeDom.Compiler.TempFileCollection
23+
- System.IO.FileSystemInfo
24+
- System.Activities.Presentation.WorkflowDesigner
25+
- System.Windows.ResourceDictionary
26+
- System.Windows.Forms.BindingSource
27+
- Microsoft.Exchange.Management.SystemManager.WinForms.ExchangeSettingsProvider
28+
- System.Diagnostics.Process
29+
- System.Management.IWbemClassObjectFreeThreaded
30+
131
### 0.11.0 July 8 2021 ####
232
* [Fix array of user defined structs serialization failure](https://github.com/akkadotnet/Hyperion/pull/235)
333
* [Remove dynamic keyword usage from array serializer](https://github.com/akkadotnet/Hyperion/pull/139)

‎build-system/linux-pr-validation.yaml‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎build-system/windows-pr-validation.yaml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,11 @@ jobs:
1919
name: Windows
2020
vmImage: 'windows-2019'
2121
scriptFileName: build.cmd
22-
scriptArgs: all
22+
scriptArgs: all
23+
- template: azure-pipeline.template.yaml
24+
parameters:
25+
name: 'linux_pr'
26+
displayName: 'Linux PR Validation'
27+
vmImage: 'ubuntu-18.04'
28+
scriptFileName: ./build.sh
29+
scriptArgs: all

‎build.fsx‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ let output = __SOURCE_DIRECTORY__ @@ "bin"
2525
let outputTests = __SOURCE_DIRECTORY__ @@ "TestResults"
2626
let outputPerfTests = __SOURCE_DIRECTORY__ @@ "PerfResults"
2727
let outputBinaries = output @@ "binaries"
28-
let outputBinariesNet461 = outputBinaries @@ "net461"
28+
let outputBinariesNet461 = outputBinaries @@ "net471"
2929
let outputBinariesNetStandard = outputBinaries @@ "netstandard2.0"
3030
let outputBinariesNet = outputBinaries @@ "net5.0"
3131
let outputNuGet = output @@ "nuget"
@@ -52,7 +52,7 @@ let versionSuffix =
5252
| str -> str
5353

5454
// Configuration values for tests
55-
let testNetFrameworkVersion = "net461"
55+
let testNetFrameworkVersion = "net471"
5656
let testNetCoreVersion = "netcoreapp3.1"
5757
let testNetVersion = "net5.0"
5858

@@ -115,7 +115,8 @@ Target "RunTests" (fun _ ->
115115
let projects =
116116
match (isWindows) with
117117
| true -> !! "./src/**/*.Tests.csproj"
118-
| _ -> !! "./src/**/*.Tests.csproj" // if you need to filter specs for Linux vs. Windows, do it here
118+
| _ -> !! "./src/**/*.Tests.csproj"
119+
-- "./src/**/*.API.Tests.csproj" // if you need to filter specs for Linux vs. Windows, do it here
119120

120121
let runSingleProject project =
121122
let arguments =

‎src/Hyperion.API.Tests/CoreApiSpec.ApproveApi.approved.txt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,10 @@ namespace Hyperion
9191
public static readonly Hyperion.SerializerOptions Default;
9292
[System.Obsolete]
9393
public SerializerOptions(bool versionTolerance = false, bool preserveObjectReferences = false, System.Collections.Generic.IEnumerable<Hyperion.Surrogate> surrogates = null, System.Collections.Generic.IEnumerable<Hyperion.SerializerFactories.ValueSerializerFactory> serializerFactories = null, System.Collections.Generic.IEnumerable<System.Type> knownTypes = null, bool ignoreISerializable = false) { }
94+
[System.Obsolete]
9495
public SerializerOptions(bool versionTolerance, bool preserveObjectReferences, System.Collections.Generic.IEnumerable<Hyperion.Surrogate> surrogates, System.Collections.Generic.IEnumerable<Hyperion.SerializerFactories.ValueSerializerFactory> serializerFactories, System.Collections.Generic.IEnumerable<System.Type> knownTypes, bool ignoreISerializable, System.Collections.Generic.IEnumerable<System.Func<string, string>> packageNameOverrides) { }
96+
public SerializerOptions(bool versionTolerance, bool preserveObjectReferences, System.Collections.Generic.IEnumerable<Hyperion.Surrogate> surrogates, System.Collections.Generic.IEnumerable<Hyperion.SerializerFactories.ValueSerializerFactory> serializerFactories, System.Collections.Generic.IEnumerable<System.Type> knownTypes, bool ignoreISerializable, System.Collections.Generic.IEnumerable<System.Func<string, string>> packageNameOverrides, bool disallowUnsafeTypes) { }
97+
public Hyperion.SerializerOptions WithDisallowUnsafeType(bool disallowUnsafeType) { }
9598
public Hyperion.SerializerOptions WithIgnoreSerializable(bool ignoreISerializable) { }
9699
public Hyperion.SerializerOptions WithKnownTypes(System.Collections.Generic.IEnumerable<System.Type> knownTypes) { }
97100
public Hyperion.SerializerOptions WithPackageNameOverrides(System.Collections.Generic.IEnumerable<System.Func<string, string>> packageNameOverrides) { }
@@ -350,6 +353,11 @@ namespace Hyperion.Internal
350353
public string Contract { get; }
351354
public bool ForceFullStates { get; }
352355
}
356+
public class EvilDeserializationException : System.Security.SecurityException
357+
{
358+
public EvilDeserializationException(string message, string typeString) { }
359+
public string BadTypeString { get; }
360+
}
353361
[System.AttributeUsage(System.AttributeTargets.Property | System.AttributeTargets.Field | System.AttributeTargets.Parameter | System.AttributeTargets.All)]
354362
public sealed class HtmlAttributeValueAttribute : System.Attribute
355363
{

‎src/Hyperion.API.Tests/Hyperion.API.Tests.csproj‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,23 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22
<Import Project="..\common.props" />
3+
<Import Project="..\xunitSettings.props" />
34

45
<PropertyGroup>
5-
<TargetFrameworks>net461;netcoreapp3.1;net5.0</TargetFrameworks>
6+
<TargetFrameworks>$(NetFrameworkTestVersion);$(NetTestVersion);$(NetCoreTestVersion)</TargetFrameworks>
67

78
<IsPackable>false</IsPackable>
89
</PropertyGroup>
910

1011
<ItemGroup>
11-
<PackageReference Include="ApprovalTests" Version="5.5.0" />
12+
<PackageReference Include="ApprovalTests" Version="5.7.0" />
1213
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(TestSdkVersion)" />
1314
<PackageReference Include="PublicApiGenerator" Version="10.2.0" />
1415
<PackageReference Include="xunit" Version="$(XunitVersion)" />
1516
<PackageReference Include="xunit.runner.visualstudio" Version="$(XunitRunnerVersion)">
1617
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
1718
<PrivateAssets>all</PrivateAssets>
1819
</PackageReference>
19-
<PackageReference Include="coverlet.collector" Version="3.0.3">
20+
<PackageReference Include="coverlet.collector" Version="3.1.0">
2021
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
2122
<PrivateAssets>all</PrivateAssets>
2223
</PackageReference>

‎src/Hyperion.Akka.Integration.Tests/Hyperion.Akka.Integration.Tests.csproj‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22
<Import Project="..\common.props" />
3+
<Import Project="..\xunitSettings.props" />
34

45
<PropertyGroup>
5-
<TargetFrameworks>net461;netcoreapp3.1;net5.0</TargetFrameworks>
6+
<TargetFrameworks>$(NetFrameworkTestVersion);$(NetTestVersion);$(NetCoreTestVersion)</TargetFrameworks>
67

78
<IsPackable>false</IsPackable>
89
</PropertyGroup>
@@ -18,7 +19,7 @@
1819
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
1920
<PrivateAssets>all</PrivateAssets>
2021
</PackageReference>
21-
<PackageReference Include="coverlet.collector" Version="3.0.3">
22+
<PackageReference Include="coverlet.collector" Version="3.1.0">
2223
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
2324
<PrivateAssets>all</PrivateAssets>
2425
</PackageReference>

‎src/Hyperion.Benchmarks/Hyperion.Benchmarks.csproj‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
<Project Sdk="Microsoft.NET.Sdk">
2-
2+
<Import Project="..\common.props" />
33
<PropertyGroup>
44
<OutputType>Exe</OutputType>
5-
<TargetFramework>netcoreapp2.0</TargetFramework>
5+
<TargetFrameworks>$(NetFrameworkTestVersion);$(NetTestVersion);$(NetCoreTestVersion)</TargetFrameworks>
66
<IsPackable>false</IsPackable> <!-- prevents it from being published as NuGet package -->
77
</PropertyGroup>
88

99
<ItemGroup>
10-
<PackageReference Include="BenchmarkDotNet" Version="0.13.0" />
10+
<PackageReference Include="BenchmarkDotNet" Version="0.13.1" />
1111
</ItemGroup>
1212

1313
<ItemGroup>

‎src/Hyperion.Tests/ExpressionTests.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99

1010
using System;
1111
using System.Collections.Generic;
12+
using System.Diagnostics;
1213
using System.IO;
1314
using System.Linq;
1415
using System.Linq.Expressions;

‎src/Hyperion.Tests/Hyperion.Tests.csproj‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,30 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22
<Import Project="..\common.props" />
3+
<Import Project="..\xunitSettings.props" />
34

45
<PropertyGroup>
56
<OutputType>Exe</OutputType>
6-
<TargetFrameworks>net461;netcoreapp3.1;net5.0</TargetFrameworks>
7+
<TargetFrameworks>$(NetFrameworkTestVersion);$(NetTestVersion);$(NetCoreTestVersion)</TargetFrameworks>
78
<TargetLatestRuntimePatch>true</TargetLatestRuntimePatch>
89
<LangVersion>latest</LangVersion>
910
<StartupObject>Hyperion.Tests.Generator.Program</StartupObject>
1011
</PropertyGroup>
1112

12-
<PropertyGroup Condition=" '$(TargetFramework)' == 'netcoreapp3.1' or '$(TargetFramework)' == 'net5.0' ">
13+
<PropertyGroup Condition=" '$(TargetFramework)' == '$(NetCoreTestVersion)' or '$(TargetFramework)' == '$(NetTestVersion)' ">
1314
<DefineConstants>$(DefineConstants);NETCOREAPP</DefineConstants>
1415
</PropertyGroup>
1516

16-
<PropertyGroup Condition=" '$(TargetFramework)' == 'net461' ">
17+
<PropertyGroup Condition=" '$(TargetFramework)' == '$(NetFrameworkTestVersion)' ">
1718
<DefineConstants>$(DefineConstants);NETFX</DefineConstants>
1819
</PropertyGroup>
1920

21+
22+
<ItemGroup Condition="'$(TargetFramework)' == '$(NetFrameworkTestVersion)'">
23+
<Reference Include="System.Drawing">
24+
<Private>true</Private>
25+
</Reference>
26+
</ItemGroup>
27+
2028
<ItemGroup>
2129
<PackageReference Include="FluentAssertions" Version="$(FluentAssertionsVersion)" />
2230
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(TestSdkVersion)" />
@@ -30,9 +38,4 @@
3038
<ProjectReference Include="..\Hyperion\Hyperion.csproj" />
3139
</ItemGroup>
3240

33-
<ItemGroup Condition="'$(TargetFramework)' == 'net461'">
34-
<Reference Include="System.Drawing">
35-
<Private>true</Private>
36-
</Reference>
37-
</ItemGroup>
3841
</Project>

0 commit comments

Comments
 (0)