Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix potential security vulnerabilities. #1612

Closed
AraHaan opened this issue May 12, 2022 · 3 comments
Closed

Fix potential security vulnerabilities. #1612

AraHaan opened this issue May 12, 2022 · 3 comments

Comments

@AraHaan
Copy link
Member

AraHaan commented May 12, 2022

Describe the bug

In my pr #1536 I have discovered that a few obsolete apis are used which in .NET Core is ignored which can result in some security vulnerabilities.

Of which include:

  • the usage of WebClient, WebRequest, etc that were obsoleted for HttpClient.
  • CER
  • CAS

To reproduce

Currently the PR #1536 shows that to reproduce it, all you have to do is add net5.0 or net6.0 as shown in the PR to the SqlClient projects and then hit compile to get compile errors related to the deprecated apis and it saying not to use them as they can pose as an security issue.

Expected behavior

For the obsoleted apis to not be used as per Microsoft's recommendations from the documentations to each compile error that is the result from each of their usage.

Further technical details

Microsoft.Data.SqlClient version: version from repo in #1536
.NET target: .NET 6 (6.0.5)
SQL Server version: SQL Server 2019
Operating system: Windows 11

Additional context

I have made temporary changes to these in #1536, however I would like to split them out of that PR so they do not get blocked until .NET 6 is added to the CI.

@JRahnama
Copy link
Contributor

@AraHaan are we talking about obsolete methods in net6? We know there are couple of them inside the driver, but since netcoreapp3.1 is still supported we cannot take them out or replace them. some of the replacements are not supported in the mentioned TFM.

@AraHaan
Copy link
Member Author

AraHaan commented May 13, 2022

In the PR I mentioned, I do currently special case .NET Core 3.1 (for now), however I do not know for sure if it uses an empty implementation for CAS and CER or if it uses the one from the .NET Framework in .NET Core 3.1.

@JRahnama
Copy link
Contributor

JRahnama commented Sep 7, 2022

@AraHaan These concerns are addressed in net 6 PR #1704. The obsolete values are only related to net6 and are still good in netcoreapp3.1. Closing the issue as the PR is under review.

@JRahnama JRahnama closed this as completed Sep 7, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants