Skip to content

Add package references for Microsoft.Data.SqlClient and System.Text.Json #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Mar 18, 2025
Merged

Add package references for Microsoft.Data.SqlClient and System.Text.Json #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
043a9d6
Add package references for Microsoft.Data.SqlClient and System.Text.Json
CalinL Mar 18, 2025
2c9ca71
Add daily update schedule for GitHub Actions in dependabot configuration
CalinL Mar 18, 2025
c36c3a2
Update CodeQL queries and log command in IndexModel constructor
CalinL Mar 18, 2025
0ddd643
Update log message format in IndexModel to clarify command string
CalinL Mar 18, 2025
6bde3c6
Update log message in IndexModel to specify command string issue
CalinL Mar 18, 2025
e373218
Refactor log message in IndexModel to simplify command string output
CalinL Mar 18, 2025
044c412
Add initial Visual Studio solution file for the project
CalinL Mar 18, 2025
0ff487a
Update log message in IndexModel to clarify command string prefix
CalinL Mar 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,8 @@ updates:
schedule:
interval: weekly
open-pull-requests-limit: 15
- package-ecosystem: "github-actions"
directory: "/"
schedule:
# Check for updates to GitHub Actions every weekday
interval: "daily"
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ jobs:
# Prefix the list here with "+" to use these queries and those in the config file.

# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
# queries: security-extended,security-and-quality
queries: security-and-quality

# If the analyze step fails for one of the languages you are analyzing with
# "We were unable to automatically build your code", modify the matrix above
Expand Down
29 changes: 29 additions & 0 deletions gh-aspnet-webapp-01.sln
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 17
VisualStudioVersion = 17.5.2.0
MinimumVisualStudioVersion = 10.0.40219.1
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{827E0CD3-B72D-47B6-A68D-7590B98EB39B}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "webapp01", "src\webapp01\webapp01.csproj", "{F2764B25-696E-F627-F6C5-7B44C866BCFE}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{F2764B25-696E-F627-F6C5-7B44C866BCFE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{F2764B25-696E-F627-F6C5-7B44C866BCFE}.Debug|Any CPU.Build.0 = Debug|Any CPU
{F2764B25-696E-F627-F6C5-7B44C866BCFE}.Release|Any CPU.ActiveCfg = Release|Any CPU
{F2764B25-696E-F627-F6C5-7B44C866BCFE}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(NestedProjects) = preSolution
{F2764B25-696E-F627-F6C5-7B44C866BCFE} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {7851C106-5284-4807-BCEF-4B450A66CF69}
EndGlobalSection
EndGlobal
6 changes: 6 additions & 0 deletions src/webapp01/Pages/Index.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,12 @@
public IndexModel(ILogger<IndexModel> logger)
{
_logger = logger;

string drive = Request.Query.ContainsKey("drive") ? Request.Query["drive"] : "C";

Check warning on line 14 in src/webapp01/Pages/Index.cshtml.cs

View workflow job for this annotation

GitHub Actions / Build Web App 

Possible null reference assignment.

Check warning on line 14 in src/webapp01/Pages/Index.cshtml.cs

View workflow job for this annotation

GitHub Actions / Build Web App 

Converting null literal or possible null value to non-nullable type.

Check warning on line 14 in src/webapp01/Pages/Index.cshtml.cs

View workflow job for this annotation

GitHub Actions / Build Web App 

Possible null reference assignment.

Check warning on line 14 in src/webapp01/Pages/Index.cshtml.cs

View workflow job for this annotation

GitHub Actions / Build Web App 

Converting null literal or possible null value to non-nullable type.

var str = $"/C fsutil volume diskfree {drive}:";

_logger.LogInformation($"Command str: {str}");

Check failure

Code scanning / CodeQL

Log entries created from user input High

This log entry depends on a
user-provided value
Loading
.

Copilot Autofix

AI 3 months ago

To fix the problem, we need to sanitize the user input before logging it. Since the log entries are plain text, we should remove any line breaks from the user input to prevent log forgery. We can use the String.Replace method to achieve this. Specifically, we should replace any occurrences of \n and \r with an empty string.

We will modify the code in src/webapp01/Pages/Index.cshtml.cs to sanitize the drive variable before using it to construct the str variable and log it.

Suggested changeset 1
src/webapp01/Pages/Index.cshtml.cs

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/webapp01/Pages/Index.cshtml.cs b/src/webapp01/Pages/Index.cshtml.cs
--- a/src/webapp01/Pages/Index.cshtml.cs
+++ b/src/webapp01/Pages/Index.cshtml.cs
@@ -13,3 +13,3 @@
 
-       	string drive = Request.Query.ContainsKey("drive") ? Request.Query["drive"] : "C";
+       	string drive = Request.Query.ContainsKey("drive") ? Request.Query["drive"].ToString().Replace("\n", "").Replace("\r", "") : "C";
 	    
EOF
@@ -13,3 +13,3 @@

string drive = Request.Query.ContainsKey("drive") ? Request.Query["drive"] : "C";
string drive = Request.Query.ContainsKey("drive") ? Request.Query["drive"].ToString().Replace("\n", "").Replace("\r", "") : "C";

Copilot is powered by AI and may make mistakes. Always verify output.
}

public void OnGet()
Expand Down
5 changes: 5 additions & 0 deletions src/webapp01/webapp01.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,9 @@
<ImplicitUsings>enable</ImplicitUsings>
</PropertyGroup>

<ItemGroup>
<PackageReference Include="Microsoft.Data.SqlClient" Version="5.0.2" />
<PackageReference Include="System.Text.Json" Version="8.0.4" />
</ItemGroup>

</Project>