Mock and core generator test restores report vulnerable System.Security.Cryptography.Pkcs versions

Open Beginner friendly
  • Is something wrong?
#7,412 8 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
65/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
csharp
Domain
security, testing

Research direction

Start with tests/TUnit.Mocks.SourceGenerator.Tests/TUnit.Mocks.SourceGenerator.Tests.csproj and tests/TUnit.Core.SourceGenerator.Tests/TUnit.Core.SourceGenerator.Tests.csproj. Run dotnet restore on each and run dotnet list package --include-transitive to see which parent package pulls in System.Security.Cryptography.Pkcs. Done when restore no longer reports NU1902 for GHSA-2fmv-rv2c-59x7, the target frameworks are unchanged, and both generator test suites pass.

Written by the indexing model from the issue text.

Description

dependencies P2

Summary

Restoring the mock and core source generator test projects reports NU1902 for transitive System.Security.Cryptography.Pkcs versions 9.0.6 and 8.0.1 respectively. The dependency graph should resolve a version without the reported moderate-severity vulnerability so local validation and CI do not continue using the vulnerable package.

Reproduction

At commit ad542eb83d3c675189715094dfd4b10abfb02338, with .NET SDK 10.0.403 on macOS arm64, run:

dotnet restore tests/TUnit.Mocks.SourceGenerator.Tests/TUnit.Mocks.SourceGenerator.Tests.csproj
dotnet restore tests/TUnit.Core.SourceGenerator.Tests/TUnit.Core.SourceGenerator.Tests.csproj

Expected and actual

Expected: no known-vulnerability warning from the restored dependency graph.

Actual: NU1902 reports System.Security.Cryptography.Pkcs 9.0.6 for the mock generator tests and 8.0.1 for the core generator tests, with advisory https://github.com/advisories/GHSA-2fmv-rv2c-59x7.

Acceptance criteria

  • Both generator test dependency graphs resolve patched versions without GHSA-2fmv-rv2c-59x7 warnings.
  • Verify restore for the supported target frameworks of both projects and run the affected generator suites.
  • Preserve the existing supported target frameworks.

Please update both dependency graphs and verify restore no longer reports this advisory.

Dominant language
C#
Stars
4k
Forks
139
Avg merge
7h 54m
Merged PRs (30d)
359

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from thomhurst/TUnit

All issues in thomhurst/TUnit

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.