Repository navigation
[browser][WBT] SignalRPassMessageWasmBrowser - NU1903 - System.Text.Json 8.0.0 #104737
Description
Wasm.Build.Tests.AspNetCore.SignalRClientTests.SignalRPassMessageWasmBrowser(config: "Debug", transport: "LongPolling") [FAIL]
[] Restored C:\helix\work\workitem\e\wbt artifacts\SignalRClientTests_s1zeg3lf_gag\AspNetCoreServer\AspNetCoreServer.csproj (in 9.91 sec).
[] C:\helix\work\workitem\e\wbt artifacts\SignalRClientTests_s1zeg3lf_gag\WasmBrowserClient\WasmBrowserClient.csproj : error NU1903: Package 'System.Text.Json' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-hh2w-p6rv-4g7w [C:\helix\work\workitem\e\wbt artifacts\SignalRClientTests_s1zeg3lf_gag\AspNetCoreServer\AspNetCoreServer.csproj]
[] Restored C:\helix\work\workitem\e\wbt artifacts\SignalRClientTests_s1zeg3lf_gag\BlazorClient\BlazorClient.csproj (in 10.45 sec).
[] Restored C:\helix\work\workitem\e\wbt artifacts\SignalRClientTests_s1zeg3lf_gag\WasmBrowserClient\WasmBrowserClient.csproj (in 493 ms).
[] C:\helix\work\workitem\e\wbt artifacts\SignalRClientTests_s1zeg3lf_gag\Shared\Shared.csproj : error NU1903: Package 'System.Text.Json' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-hh2w-p6rv-4g7w [C:\helix\work\workitem\e\wbt artifacts\SignalRClientTests_s1zeg3lf_gag\AspNetCoreServer\AspNetCoreServer.csproj]
[] Restored C:\helix\work\workitem\e\wbt artifacts\SignalRClientTests_s1zeg3lf_gag\Shared\Shared.csproj (in 5 ms).
Build Information
Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=737345
Build error leg or test failing:
Error Message
Fill the error message using step by step known issues guidance.
{
"ErrorMessage": "NU1903: Package 'System.Text.Json' 8.0.0 has a known high severity vulnerability",
"BuildRetry": false,
"ExcludeConsoleLog": false
}Known issue validation
Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=737345
Error message validated: [NU1903: Package 'System.Text.Json' 8.0.0 has a known high severity vulnerability]
Result validation: ✅ Known issue matched with the provided build.
Validation performed at: 7/11/2024 4:23:34 PM UTC
Report
Summary
| 24-Hour Hit Count | 7-Day Hit Count | 1-Month Count |
|---|---|---|
| 0 | 27 | 28 |
Activity
dotnet-policy-service commentedon Jul 11, 2024
Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.
[-][browser][WBT] NU1903 - System.Text.Json 8.0.0[/-][+][browser][WBT] SignalRPassMessageWasmBrowser - NU1903 - System.Text.Json 8.0.0[/+]ViktorHofer commentedon Jul 11, 2024
Note that this means that you are using the nuget.org feed somewhere which is unrelated but should be fixed as well. NU1903 is part of the NuGet Audit feature which only works with the nuget.org feed atm.
ViktorHofer commentedon Jul 11, 2024
cc @lewing
ViktorHofer commentedon Jul 12, 2024
Unfortunately, I don't know how these tests work. Can someone please file an issue for the nuget.org issue?
ilonatommy commentedon Jul 12, 2024
In wbt we're populating nuget config here:
runtime/src/mono/wasm/Wasm.Build.Tests/Blazor/BlazorWasmTestBase.cs
Line 35 in f9eda07
that produces:
Do you mean we should remove
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />?ViktorHofer commentedon Jul 12, 2024
Yes. AFAIK using the nuget.org feed in our builds is disallowed for security reasons. cc @mmitche
ajtruckle commentedon Jul 16, 2024
I can confirm that this package is using version 8.0.0:
When will this be fixed?
ViktorHofer commentedon Jul 16, 2024
Copied from a mail conversation:
.NET's policy is that we do not publish new intermediate packages for the sole purpose of updating a leaf dependency. This is instead an application-level concern. We rely on NuGet functionality to make updating leaf dependencies simple and painless.
We don't yet have that documented but we will follow-up on it.
ajtruckle commentedon Jul 16, 2024
@ViktorHofer
I am not knowledgeable with this ..but let me get this in my head?
VS is telling me that this particular NuGet package is using a vulnerable assembly. So why do I have to fix this? Why do I have to manually download another top level dependency for what is currently translative? I don't understand the logic. Surely, something, somewhere is responsible for using a vulnerable version and it should be rectified. No? Otherwise the headache is put on our shoulders and technically, the issue is not with out code but the NuGet packages concerned.