Skip to content

Commit 25d99a5

Browse files
CodeBlanchCodeBlanch
authored
[repo] Mitigate vulnerabilities in System.Text.Json 8.0.0 packages (open-telemetry#5874)
1 parent 19e1663 commit 25d99a5

File tree

23 files changed

+94
-77
lines changed

23 files changed

+94
-77
lines changed

‎Directory.Packages.props‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
<Project>
2+
23
<PropertyGroup>
34
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
45
<OTelLatestStableVer>1.9.0</OTelLatestStableVer>
6+
<SystemTextEncodingsWebOutOfBandMinimumCoreAppVer>8.0.0</SystemTextEncodingsWebOutOfBandMinimumCoreAppVer>
7+
<SystemTextJsonOutOfBandMinimumCoreAppVer>8.0.4</SystemTextJsonOutOfBandMinimumCoreAppVer>
58
</PropertyGroup>
69

710
<!--
@@ -53,22 +56,26 @@
5356
even during major version bumps, so compatibility is not a concern here.
5457
-->
5558
<PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="9.0.0-rc.1.24431.7" />
59+
</ItemGroup>
5660

57-
<!-- A conservative version of System.Text.Encodings.Web must be used here since there is no backward compatibility guarantee during major version bumps. -->
61+
<ItemGroup>
62+
<!--
63+
We use conservative versions of these packages for older runtimes where
64+
an upgrade might introduce breaking changes. For example see:
65+
https://devblogs.microsoft.com/dotnet/system-text-json-in-dotnet-7/#breaking-changes.
66+
-->
5867
<PackageVersion Include="System.Text.Encodings.Web" Version="4.7.2" />
59-
60-
<!-- A conservative version of System.Text.Json must be used here since there is no backward compatibility guarantee during major version bumps. -->
6168
<PackageVersion Include="System.Text.Json" Version="4.7.2" />
6269

63-
<!-- A conservative version of System.Threading.Tasks.Extensions must be used here since there is no backward compatibility guarantee during major version bumps. -->
64-
<PackageVersion Include="System.Threading.Tasks.Extensions" Version="4.5.4" />
70+
<!-- Bump System.Text.Json on NETCoreApp targets to mitigate https://github.com/advisories/GHSA-hh2w-p6rv-4g7w. -->
71+
<PackageVersion Update="System.Text.Encodings.Web" Version="$(SystemTextEncodingsWebOutOfBandMinimumCoreAppVer)" Condition="'$(TargetFrameworkIdentifier)' == '.NETCoreApp'" />
72+
<PackageVersion Update="System.Text.Json" Version="$(SystemTextJsonOutOfBandMinimumCoreAppVer)" Condition="'$(TargetFrameworkIdentifier)' == '.NETCoreApp'" />
6573
</ItemGroup>
6674

6775
<!--
6876
This section covers packages that are **not** directly referenced by the NuGet packages published from this repository.
69-
For example, these packages are used in the tests, examples or referenced as "PrivateAssets", but not in the NuGet packages themselves.
77+
These packages are referenced as "PrivateAssets" or used in tests/examples.
7078
-->
71-
<!-- 'net9.0' is the default `TargetFramework`. Use `VersionOverride` in the project to override the package versions from a different `TargetFramework` -->
7279
<ItemGroup>
7380
<PackageVersion Include="BenchmarkDotNet" Version="[0.13.12,0.14)" />
7481
<PackageVersion Include="CommandLineParser" Version="[2.9.1,3.0)" />
@@ -77,6 +84,7 @@
7784
<PackageVersion Include="Grpc.Tools" Version="[2.59.0,3.0)" />
7885
<PackageVersion Include="Microsoft.CSharp" Version="[4.7.0]" />
7986
<PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="[3.11.0-beta1.23525.2]" />
87+
<PackageVersion Include="Microsoft.Coyote" Version="1.7.11" />
8088
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="[9.0.0-rc.1.24431.7,)" />
8189
<PackageVersion Include="Microsoft.Extensions.Hosting" Version="[9.0.0-rc.1.24431.7,)" />
8290
<PackageVersion Include="Microsoft.Extensions.Http" Version="[9.0.0-rc.1.24431.7,)" />
@@ -86,21 +94,25 @@
8694
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="[17.11.0,18.0.0)" />
8795
<PackageVersion Include="Microsoft.SourceLink.GitHub" Version="[8.0.0,9.0)" />
8896
<PackageVersion Include="MinVer" Version="[5.0.0,6.0)" />
97+
<PackageVersion Include="NuGet.Versioning" Version="6.11.0" />
8998
<PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="[1.9.0,2.0)" />
9099
<PackageVersion Include="OpenTelemetry.Instrumentation.GrpcNetClient" Version="[1.9.0-beta.1,2.0)" />
91100
<PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="[1.9.0,2.0)" />
92101
<PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="[1.9.0,2.0)" />
93102
<PackageVersion Include="RabbitMQ.Client" Version="[6.8.1,7.0)" />
94103
<PackageVersion Include="StyleCop.Analyzers" Version="[1.2.0-beta.556,2.0)" />
95104
<PackageVersion Include="Swashbuckle.AspNetCore" Version="[6.7.3,)" />
105+
<PackageVersion Include="System.Runtime.InteropServices.RuntimeInformation" Version="4.3.0" />
96106
<PackageVersion Include="xunit" Version="[2.9.0,3.0)" />
97107
<PackageVersion Include="xunit.runner.visualstudio" Version="[2.8.2,3.0)" />
98108
</ItemGroup>
99109

100110
<ItemGroup Condition="'$(TargetFramework)' == 'net8.0'">
101111
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="8.0.8" />
102112
</ItemGroup>
113+
103114
<ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
104115
<PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="9.0.0-rc.1.24452.1" />
105116
</ItemGroup>
117+
106118
</Project>

‎OpenTelemetry.sln‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "build", "build", "{7CB2F02E
2828
build\Common.nonprod.props = build\Common.nonprod.props
2929
build\Common.prod.props = build\Common.prod.props
3030
build\Common.props = build\Common.props
31+
build\Common.targets = build\Common.targets
3132
build\debug.snk = build\debug.snk
3233
Directory.Packages.props = Directory.Packages.props
3334
build\docfx.cmd = build\docfx.cmd
@@ -112,7 +113,6 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "test", "test", "{D2E73927-5
112113
ProjectSection(SolutionItems) = preProject
113114
test\Directory.Build.props = test\Directory.Build.props
114115
test\Directory.Build.targets = test\Directory.Build.targets
115-
test\Directory.Packages.props = test\Directory.Packages.props
116116
EndProjectSection
117117
EndProject
118118
Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Examples.Console", "examples\Console\Examples.Console.csproj", "{FF3E6E08-E8E4-4523-B526-847CD989279F}"
@@ -129,7 +129,7 @@ EndProject
129129
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "examples", "examples", "{2C7DD1DA-C229-4D9E-9AF0-BCD5CD3E4948}"
130130
ProjectSection(SolutionItems) = preProject
131131
examples\Directory.Build.props = examples\Directory.Build.props
132-
examples\Directory.Packages.props = examples\Directory.Packages.props
132+
examples\Directory.Build.targets = examples\Directory.Build.targets
133133
EndProjectSection
134134
EndProject
135135
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "trace", "trace", "{5B7FB835-3FFF-4BC2-99C5-A5B5FAE3C818}"

‎build/Common.props‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
<TargetFrameworksForLibraries>net9.0;net8.0;netstandard2.0;$(NetFrameworkMinimumSupportedVersion)</TargetFrameworksForLibraries>
3232
<TargetFrameworksForLibrariesExtended>net9.0;net8.0;netstandard2.1;netstandard2.0;$(NetFrameworkMinimumSupportedVersion)</TargetFrameworksForLibrariesExtended>
3333
<TargetFrameworksForPrometheusAspNetCore>net9.0;net8.0</TargetFrameworksForPrometheusAspNetCore>
34+
<TargetFrameworksRequiringSystemTextJsonDirectReference>net8.0;netstandard2.1;netstandard2.0;$(NetFrameworkMinimumSupportedVersion)</TargetFrameworksRequiringSystemTextJsonDirectReference>
3435

3536
<!-- non-production TFMs -->
3637
<TargetFrameworksForAspNetCoreTests>net9.0;net8.0</TargetFrameworksForAspNetCoreTests>

‎build/Common.targets‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<Project>
2+
3+
<ItemGroup Condition="'$(ReferenceSystemTextJsonPackages)' == 'true' AND $(TargetFrameworksRequiringSystemTextJsonDirectReference.Contains('$(TargetFramework)'))">
4+
<!-- Note: System.Text.Encodings.Web is referenced on NET Framework & NET
5+
Standard targets because System.Text.Json v4.7.2 uses
6+
System.Text.Encodings.Web >= v4.7.1 but System.Text.Encodings.Web needs to
7+
be at v4.7.2 to be safe. -->
8+
<PackageReference Include="System.Text.Encodings.Web" Condition="'$(TargetFrameworkIdentifier)' != '.NETCoreApp'" />
9+
<PackageReference Include="System.Text.Json" />
10+
</ItemGroup>
11+
12+
</Project>

‎examples/Directory.Build.targets‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<Project>
2+
3+
<Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), 'OpenTelemetry.sln'))\build\Common.targets" />
4+
5+
</Project>

‎examples/Directory.Packages.props‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎examples/MicroserviceExample/WorkerService/WorkerService.csproj‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@
66
<ItemGroup>
77
<PackageReference Include="Microsoft.Extensions.Hosting" />
88
<PackageReference Include="RabbitMQ.Client" />
9-
<!-- System.Text.Json is indirect reference. It is needed to upgrade it directly to avoid https://github.com/advisories/GHSA-hh2w-p6rv-4g7w -->
10-
<PackageReference Include="System.Text.Json" />
119
</ItemGroup>
1210

1311
<ItemGroup>

‎src/Directory.Build.targets‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
<Project>
22

3+
<Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), 'OpenTelemetry.sln'))\build\Common.targets" />
4+
35
<PropertyGroup>
46
<!-- Note: PackageValidationBaselineVersion and IsPackable are defined in
57
targets because $(MinVerTagPrefix) is not available in props files as they

‎src/OpenTelemetry.Exporter.Console/CHANGELOG.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@ Notes](../../RELEASENOTES.md).
66

77
## Unreleased
88

9+
* Added direct reference to `System.Text.Json` for the `net8.0` target with
10+
minimum version of `8.0.4` in response to
11+
[CVE-2024-30105](https://github.com/advisories/GHSA-hh2w-p6rv-4g7w).
12+
([#5874](https://github.com/open-telemetry/opentelemetry-dotnet/pull/5874))
13+
914
## 1.10.0-beta.1
1015

1116
Released 2024-Sep-30
@@ -114,7 +119,8 @@ Released 2023-May-25
114119
([#4507](https://github.com/open-telemetry/opentelemetry-dotnet/pull/4507))
115120

116121
* Added direct reference to `System.Text.Encodings.Web` with minimum version of
117-
`4.7.2` in response to [CVE-2021-26701](https://github.com/dotnet/runtime/issues/49377).
122+
`4.7.2` in response to
123+
[CVE-2021-26701](https://github.com/dotnet/runtime/issues/49377).
118124
([#4390](https://github.com/open-telemetry/opentelemetry-dotnet/pull/4390))
119125

120126
* Updated `LogRecord` console output: `Body` is now shown (if set),

‎src/OpenTelemetry.Exporter.Console/OpenTelemetry.Exporter.Console.csproj‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,13 @@
55
<Description>Console exporter for OpenTelemetry .NET</Description>
66
<PackageTags>$(PackageTags);Console;distributed-tracing</PackageTags>
77
<MinVerTagPrefix>core-</MinVerTagPrefix>
8+
<ReferenceSystemTextJsonPackages>true</ReferenceSystemTextJsonPackages>
89
</PropertyGroup>
910

1011
<PropertyGroup>
1112
<NoWarn>$(NoWarn),1591</NoWarn>
1213
</PropertyGroup>
1314

14-
<ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.0' or '$(TargetFramework)' == '$(NetFrameworkMinimumSupportedVersion)'">
15-
<PackageReference Include="System.Text.Encodings.Web" />
16-
<PackageReference Include="System.Text.Json" />
17-
</ItemGroup>
18-
1915
<ItemGroup>
2016
<ProjectReference Include="$(RepoRoot)\src\OpenTelemetry\OpenTelemetry.csproj" />
2117
</ItemGroup>

0 commit comments

Comments
 (0)