Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added an option to disable dynamic assembly loading #6280

Merged
merged 3 commits into from
Feb 18, 2022

Conversation

ramonsmits
Copy link
Member

@ramonsmits ramonsmits commented Feb 18, 2022

Backport of #6250

Looking up message types defined in the Headers.EnclosedMessageTypes header can cause a call to Type.GetType(...) which can lead to assemblies being loaded at runtime.

The new setting allows disabling calls to Type.GetType in the message metadata registry. Incoming message types must be part of the scanned assemblies at endpoint startup time.

Documentation: https://docs.particular.net/nservicebus/serialization/#security

…#6250)

Resolved big conflict on NativeSubscribeTerminatorTests which seemed to have been deleted prior to cherry picking from main.

Co-authored-by: Tim Bussmann <timbussmann@users.noreply.github.com>
Co-authored-by: Ramon Smits <ramon.smits@gmail.com>
@ramonsmits ramonsmits added this to the 7.7.0 milestone Feb 18, 2022
@ramonsmits ramonsmits changed the base branch from master to release-7.7 February 18, 2022 13:30
@ramonsmits ramonsmits changed the title Support disabling dynamic assembly loading in MessageMetadataRegistry-7.7 Support disabling dynamic assembly loading in MessageMetadataRegistry Feb 18, 2022
@ramonsmits ramonsmits enabled auto-merge (squash) February 18, 2022 14:11
@ramonsmits ramonsmits merged commit f216f9d into release-7.7 Feb 18, 2022
@ramonsmits ramonsmits deleted the message-type-lookup-7.7 branch February 18, 2022 14:25
@timbussmann timbussmann changed the title Support disabling dynamic assembly loading in MessageMetadataRegistry Support disabling dynamic assembly loading Feb 21, 2022
@DavidBoike DavidBoike changed the title Support disabling dynamic assembly loading Added an option to disable dynamic assembly loading Mar 9, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants