Skip to content

Commit 413542d

Browse files
ckadlubackadluba
authored
Merge pull request #553 from ckadluba/544-enable-nugetaudit
Enabled NuGet audit
2 parents 11415c6 + eda0786 commit 413542d

File tree

10 files changed

+65
-59
lines changed

10 files changed

+65
-59
lines changed

‎CHANGES.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,11 @@
1+
# 6.7.1
2+
* Fixed issue #552 by downgrading SqlClient dependency to 5.1.6 which is LTS and fixed the vulnerabilities referenced in issue #544
3+
* Fixed vulnerabilities by removing all System.* 4 versions as recommended by Microsoft (https://devblogs.microsoft.com/nuget/nugetaudit-2-0-elevating-security-and-trust-in-package-management/#system-net-http-and-system-text-regularexpressions, issue #544)
4+
* Fixed vulnerability by updating xunit to 2.9.0 (issue #544)
5+
* Fixed vulnerability by directly referencing transitive dependency System.Formats.Asn1 (https://github.com/advisories/GHSA-447r-wph3-92pm, issue #544)
6+
* Fixed vulnerability by directly referencing transitive dependency System.Private.Uri (https://github.com/advisories/GHSA-xhfc-gr8f-ffwc, issue #544)
7+
* Activated NuGet Audit for high and critical vulnerabilities in direct and transitive dependencies for all projects (https://devblogs.microsoft.com/nuget/nugetaudit-2-0-elevating-security-and-trust-in-package-management/)
8+
19
# 6.7.0
210
* Fixed some of the vulnerabilities referenced in issue #544 by updating SqlClient dependency to 5.2.1
311
* Update codeql-action to v3 before deprecation

‎Directory.Build.props

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<Project>
2+
<PropertyGroup>
3+
<NuGetAuditMode>all</NuGetAuditMode>
4+
<NuGetAuditLevel>high</NuGetAuditLevel>
5+
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
6+
</PropertyGroup>
7+
</Project>

‎Directory.Packages.props

Lines changed: 26 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,27 @@
11
<Project>
2-
<PropertyGroup>
3-
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
4-
</PropertyGroup>
5-
<ItemGroup>
6-
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
7-
<PackageVersion Include="System.Configuration.ConfigurationManager" Version="6.0.1" />
8-
<PackageVersion Include="System.Collections" Version="4.3.0" />
9-
<PackageVersion Include="System.IO.FileSystem.Primitives" Version="4.3.0" />
10-
<PackageVersion Include="System.Resources.ResourceManager" Version="4.3.0" />
11-
<PackageVersion Include="System.Runtime.Extensions" Version="4.3.1" />
12-
<PackageVersion Include="System.Runtime.InteropServices" Version="4.3.0" />
13-
<PackageVersion Include="System.Text.Encoding.Extensions" Version="4.3.0" />
14-
<PackageVersion Include="Microsoft.Data.SqlClient" Version="5.2.1" />
15-
<PackageVersion Include="Microsoft.Extensions.Configuration" Version="6.0.1" />
16-
<PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="6.0.0" />
17-
<PackageVersion Include="Microsoft.Extensions.Hosting" Version="6.0.1" />
18-
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="6.0.0" />
19-
<PackageVersion Include="Microsoft.SourceLink.GitHub" Version="1.1.1" />
20-
<PackageVersion Include="coverlet.collector" Version="3.2.0" />
21-
<PackageVersion Include="FluentAssertions" Version="6.7.0" />
22-
<PackageVersion Include="Dapper.StrongName" Version="2.0.123" />
23-
<PackageVersion Include="Moq" Version="4.18.2" />
24-
<PackageVersion Include="xunit" Version="2.4.2" />
25-
<PackageVersion Include="xunit.runner.visualstudio" Version="2.4.5" />
26-
<PackageVersion Include="Serilog" Version="3.1.1" />
27-
<PackageVersion Include="Serilog.Extensions.Hosting" Version="5.0.1" />
28-
<PackageVersion Include="Serilog.Settings.Configuration" Version="3.4.0" />
29-
<PackageVersion Include="Serilog.Sinks.PeriodicBatching" Version="3.1.0" />
30-
</ItemGroup>
31-
</Project>
2+
<PropertyGroup>
3+
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
4+
</PropertyGroup>
5+
<ItemGroup>
6+
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
7+
<PackageVersion Include="System.Configuration.ConfigurationManager" Version="6.0.1" />
8+
<PackageVersion Include="System.Formats.Asn1" Version="8.0.1" />
9+
<PackageVersion Include="System.Private.Uri" Version="4.3.2" />
10+
<PackageVersion Include="Microsoft.Data.SqlClient" Version="5.1.6" />
11+
<PackageVersion Include="Microsoft.Extensions.Configuration" Version="6.0.1" />
12+
<PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="6.0.0" />
13+
<PackageVersion Include="Microsoft.Extensions.Hosting" Version="6.0.1" />
14+
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="6.0.0" />
15+
<PackageVersion Include="Microsoft.SourceLink.GitHub" Version="1.1.1" />
16+
<PackageVersion Include="coverlet.collector" Version="3.2.0" />
17+
<PackageVersion Include="FluentAssertions" Version="6.7.0" />
18+
<PackageVersion Include="Dapper.StrongName" Version="2.0.123" />
19+
<PackageVersion Include="Moq" Version="4.18.2" />
20+
<PackageVersion Include="xunit" Version="2.9.0" />
21+
<PackageVersion Include="xunit.runner.visualstudio" Version="2.8.2" />
22+
<PackageVersion Include="Serilog" Version="3.1.1" />
23+
<PackageVersion Include="Serilog.Extensions.Hosting" Version="5.0.1" />
24+
<PackageVersion Include="Serilog.Settings.Configuration" Version="3.4.0" />
25+
<PackageVersion Include="Serilog.Sinks.PeriodicBatching" Version="3.1.0" />
26+
</ItemGroup>
27+
</Project>

‎serilog-sinks-mssqlserver.sln

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution
2424
.editorconfig = .editorconfig
2525
Build.ps1 = Build.ps1
2626
CHANGES.md = CHANGES.md
27+
Directory.Build.props = Directory.Build.props
2728
Directory.Packages.props = Directory.Packages.props
2829
.github\ISSUE_TEMPLATE.md = .github\ISSUE_TEMPLATE.md
2930
.github\workflows\pr-analysis-codeql.yml = .github\workflows\pr-analysis-codeql.yml

‎src/Serilog.Sinks.MSSqlServer/Serilog.Sinks.MSSqlServer.csproj

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@
3838
<PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" />
3939
<PackageReference Include="Serilog" />
4040
<PackageReference Include="Serilog.Sinks.PeriodicBatching" />
41+
<PackageReference Include="System.Formats.Asn1" />
42+
<PackageReference Include="System.Private.Uri" />
4143
</ItemGroup>
4244

4345
<ItemGroup>

‎test/Serilog.Sinks.MSSqlServer.Tests/Serilog.Sinks.MSSqlServer.Tests.csproj

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -38,21 +38,13 @@
3838
</ItemGroup>
3939

4040
<ItemGroup Condition=" '$(TargetFramework)' == 'net472' Or '$(TargetFramework)' == 'net462' ">
41-
<Reference Include="System" />
42-
<Reference Include="System.Transactions" />
4341
<Reference Include="Microsoft.CSharp" />
4442
<Compile Include="Configuration\Extensions\Hybrid\**\*.cs" />
4543
<Compile Include="Configuration\Implementations\Microsoft.Extensions.Configuration\**\*.cs" />
4644
<Compile Include="Configuration\Implementations\System.Configuration\**\*.cs" />
4745
</ItemGroup>
4846

4947
<ItemGroup Condition=" '$(TargetFramework)' == 'net6.0' ">
50-
<PackageReference Include="System.Collections" />
51-
<PackageReference Include="System.Runtime.InteropServices" />
52-
<PackageReference Include="System.Runtime.Extensions" />
53-
<PackageReference Include="System.IO.FileSystem.Primitives" />
54-
<PackageReference Include="System.Resources.ResourceManager" />
55-
<PackageReference Include="System.Text.Encoding.Extensions" />
5648
<PackageReference Include="coverlet.collector">
5749
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
5850
<PrivateAssets>all</PrivateAssets>

‎test/Serilog.Sinks.MSSqlServer.Tests/Sinks/MSSqlServer/MSSqlServerSinkTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ public async Task EmitBatchAsyncCallsSqlLogEventWriter()
162162
});
163163

164164
// Act
165-
await _sut.EmitBatchAsync(logEvents).ConfigureAwait(false);
165+
await _sut.EmitBatchAsync(logEvents);
166166

167167
// Assert
168168
_sqlBulkBatchWriter.Verify(w => w.WriteBatch(It.IsAny<IEnumerable<LogEvent>>(), _dataTable), Times.Once);

‎test/Serilog.Sinks.MSSqlServer.Tests/Sinks/MSSqlServer/Platform/SqlBulkBatchWriterTests.cs

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ public async Task WriteBatchCallsLogEventDataGeneratorGetColumnsAndValuesForEach
7272
var logEvents = CreateLogEvents();
7373

7474
// Act
75-
await _sut.WriteBatch(logEvents, _dataTable).ConfigureAwait(false);
75+
await _sut.WriteBatch(logEvents, _dataTable);
7676

7777
// Assert
7878
_logEventDataGeneratorMock.Verify(c => c.GetColumnsAndValues(logEvents[0]), Times.Once);
@@ -86,7 +86,7 @@ public async Task WriteBatchCallsSqlConnectionFactoryCreate()
8686
var logEvents = CreateLogEvents();
8787

8888
// Act
89-
await _sut.WriteBatch(logEvents, _dataTable).ConfigureAwait(false);
89+
await _sut.WriteBatch(logEvents, _dataTable);
9090

9191
// Assert
9292
_sqlConnectionFactoryMock.Verify(f => f.Create(), Times.Once);
@@ -99,7 +99,7 @@ public async Task WriteBatchCallsSqlConnectionWrapperOpenAsync()
9999
var logEvents = CreateLogEvents();
100100

101101
// Act
102-
await _sut.WriteBatch(logEvents, _dataTable).ConfigureAwait(false);
102+
await _sut.WriteBatch(logEvents, _dataTable);
103103

104104
// Assert
105105
_sqlConnectionWrapperMock.Verify(c => c.OpenAsync(), Times.Once);
@@ -113,7 +113,7 @@ public async Task WriteBatchCallsSqlConnectionWrappeCreateSqlBulkCopy()
113113
var expectedDestinationTableName = string.Format(CultureInfo.InvariantCulture, "[{0}].[{1}]", _schemaName, _tableName);
114114

115115
// Act
116-
await _sut.WriteBatch(logEvents, _dataTable).ConfigureAwait(false);
116+
await _sut.WriteBatch(logEvents, _dataTable);
117117

118118
// Assert
119119
_sqlConnectionWrapperMock.Verify(c => c.CreateSqlBulkCopy(false, expectedDestinationTableName), Times.Once);
@@ -128,7 +128,7 @@ public async Task WriteBatchCallsSqlConnectionWrappeCreateSqlBulkCopyWithDisable
128128
var sut = new SqlBulkBatchWriter(_tableName, _schemaName, true, _sqlConnectionFactoryMock.Object, _logEventDataGeneratorMock.Object);
129129

130130
// Act
131-
await sut.WriteBatch(logEvents, _dataTable).ConfigureAwait(false);
131+
await sut.WriteBatch(logEvents, _dataTable);
132132

133133
// Assert
134134
_sqlConnectionWrapperMock.Verify(c => c.CreateSqlBulkCopy(true, expectedDestinationTableName), Times.Once);
@@ -145,7 +145,7 @@ public async Task WriteBatchCallsSqlBulkCopyWrapperAddSqlBulkCopyColumnMappingFo
145145
_dataTable.Columns.Add(new DataColumn(column2Name));
146146

147147
// Act
148-
await _sut.WriteBatch(logEvents, _dataTable).ConfigureAwait(false);
148+
await _sut.WriteBatch(logEvents, _dataTable);
149149

150150
// Assert
151151
_sqlBulkCopyWrapper.Verify(c => c.AddSqlBulkCopyColumnMapping(column1Name, column1Name), Times.Once);
@@ -159,7 +159,7 @@ public async Task WriteBatchCallsSqlBulkCopyWrapperWriteToServerAsync()
159159
var logEvents = CreateLogEvents();
160160

161161
// Act
162-
await _sut.WriteBatch(logEvents, _dataTable).ConfigureAwait(false);
162+
await _sut.WriteBatch(logEvents, _dataTable);
163163

164164
// Assert
165165
_sqlBulkCopyWrapper.Verify(c => c.WriteToServerAsync(_dataTable), Times.Once);
@@ -172,48 +172,48 @@ public async Task WriteBatchClearsDataTable()
172172
var logEvents = CreateLogEvents();
173173

174174
// Act
175-
await _sut.WriteBatch(logEvents, _dataTable).ConfigureAwait(false);
175+
await _sut.WriteBatch(logEvents, _dataTable);
176176

177177
// Assert
178178
Assert.Empty(_dataTable.Rows);
179179
}
180180

181181
[Fact]
182-
public void WriteBatchRethrowsIfLogEventDataGeneratorMockGetColumnsAndValuesThrows()
182+
public async Task WriteBatchRethrowsIfLogEventDataGeneratorMockGetColumnsAndValuesThrows()
183183
{
184184
// Arrange
185185
_logEventDataGeneratorMock.Setup(d => d.GetColumnsAndValues(It.IsAny<LogEvent>()))
186186
.Callback(() => throw new InvalidOperationException());
187187
var logEvents = CreateLogEvents();
188188

189189
// Act + assert
190-
Assert.ThrowsAsync<InvalidOperationException>(() => _sut.WriteBatch(logEvents, _dataTable));
190+
await Assert.ThrowsAsync<InvalidOperationException>(() => _sut.WriteBatch(logEvents, _dataTable));
191191
}
192192

193193
[Fact]
194-
public void WriteBatchRethrowsIfSqlConnectionFactoryCreateThrows()
194+
public async Task WriteBatchRethrowsIfSqlConnectionFactoryCreateThrows()
195195
{
196196
// Arrange
197197
_sqlConnectionFactoryMock.Setup(f => f.Create()).Callback(() => throw new InvalidOperationException());
198198
var logEvents = CreateLogEvents();
199199

200200
// Act + assert
201-
Assert.ThrowsAsync<InvalidOperationException>(() => _sut.WriteBatch(logEvents, _dataTable));
201+
await Assert.ThrowsAsync<InvalidOperationException>(() => _sut.WriteBatch(logEvents, _dataTable));
202202
}
203203

204204
[Fact]
205-
public void WriteBatchRethrowsIfSqlConnectionOpenAsyncThrows()
205+
public async Task WriteBatchRethrowsIfSqlConnectionOpenAsyncThrows()
206206
{
207207
// Arrange
208208
_sqlConnectionWrapperMock.Setup(c => c.OpenAsync()).Callback(() => throw new InvalidOperationException());
209209
var logEvents = CreateLogEvents();
210210

211211
// Act + assert
212-
Assert.ThrowsAsync<InvalidOperationException>(() => _sut.WriteBatch(logEvents, _dataTable));
212+
await Assert.ThrowsAsync<InvalidOperationException>(() => _sut.WriteBatch(logEvents, _dataTable));
213213
}
214214

215215
[Fact]
216-
public void WriteBatchRethrowsIfSqlBulkCopyWriterAddSqlBulkCopyColumnMappingThrows()
216+
public async Task WriteBatchRethrowsIfSqlBulkCopyWriterAddSqlBulkCopyColumnMappingThrows()
217217
{
218218
// Arrange
219219
_sqlBulkCopyWrapper.Setup(c => c.AddSqlBulkCopyColumnMapping(It.IsAny<string>(), It.IsAny<string>()))
@@ -222,19 +222,19 @@ public void WriteBatchRethrowsIfSqlBulkCopyWriterAddSqlBulkCopyColumnMappingThro
222222
_dataTable.Columns.Add(new DataColumn("ColumnName"));
223223

224224
// Act + assert
225-
Assert.ThrowsAsync<InvalidOperationException>(() => _sut.WriteBatch(logEvents, _dataTable));
225+
await Assert.ThrowsAsync<InvalidOperationException>(() => _sut.WriteBatch(logEvents, _dataTable));
226226
}
227227

228228
[Fact]
229-
public void WriteBatchRethrowsIfSqlBulkCopyWriterWriteToServerAsyncThrows()
229+
public async Task WriteBatchRethrowsIfSqlBulkCopyWriterWriteToServerAsyncThrows()
230230
{
231231
// Arrange
232232
_sqlBulkCopyWrapper.Setup(c => c.WriteToServerAsync(It.IsAny<DataTable>()))
233233
.Callback(() => throw new InvalidOperationException());
234234
var logEvents = CreateLogEvents();
235235

236236
// Act + assert
237-
Assert.ThrowsAsync<InvalidOperationException>(() => _sut.WriteBatch(logEvents, _dataTable));
237+
await Assert.ThrowsAsync<InvalidOperationException>(() => _sut.WriteBatch(logEvents, _dataTable));
238238
}
239239

240240
private static List<LogEvent> CreateLogEvents()

‎test/Serilog.Sinks.MSSqlServer.Tests/Sinks/MSSqlServer/Platform/SqlInsertStatementWriterTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ public async Task WriteBatchCallsLogEventDataGeneratorGetColumnsAndValuesForEach
192192
var logEvents = CreateLogEvents();
193193

194194
// Act
195-
await _sut.WriteBatch(logEvents).ConfigureAwait(false);
195+
await _sut.WriteBatch(logEvents);
196196

197197
// Assert
198198
_logEventDataGeneratorMock.Verify(c => c.GetColumnsAndValues(logEvents[0]), Times.Once);

‎test/Serilog.Sinks.MSSqlServer.Tests/Sinks/MSSqlServer/SqlServerColumnTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ public void StoresPropertyName()
3333

3434
// Assert
3535
Assert.Equal(propertyName, sut.PropertyName);
36-
Assert.Equal(1, sut.PropertyNameHierarchy.Count);
36+
Assert.Single(sut.PropertyNameHierarchy);
3737
Assert.Equal(propertyName, sut.PropertyNameHierarchy[0]);
3838
Assert.False(sut.HasHierarchicalPropertyName);
3939
}

0 commit comments

Comments
 (0)