Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[NRBF] Address issues discovered by Threat Model #106629

Merged
merged 13 commits into from
Sep 16, 2024
Merged

[NRBF] Address issues discovered by Threat Model #106629

merged 13 commits into from
Sep 16, 2024

Commits on Aug 19, 2024

  1. introduce ArrayRecord.TotalElementsCount

    @adamsitnik
    adamsitnik committed Aug 19, 2024
    Configuration menu
    Copy the full SHA
    d5addcb View commit details
    Browse the repository at this point in the history

  2. remove recursion

    @adamsitnik
    adamsitnik committed Aug 19, 2024
    Configuration menu
    Copy the full SHA
    38fb5f8 View commit details
    Browse the repository at this point in the history

  3. don't allocate the Stack unless it's necessary

    @adamsitnik
    adamsitnik committed Aug 19, 2024
    Configuration menu
    Copy the full SHA
    f89177c View commit details
    Browse the repository at this point in the history

  4. use Queue (both are fine as the order does not really matter here)

    @adamsitnik
    adamsitnik committed Aug 19, 2024
    Configuration menu
    Copy the full SHA
    77088c2 View commit details
    Browse the repository at this point in the history

  5. do not include invalid Type or Assembly names in the exception messag… 

    …es, as it's most likely corrupted/tampered/malicious data and could be used as a vector of attack.
    @adamsitnik
    adamsitnik committed Aug 19, 2024
    Configuration menu
    Copy the full SHA
    13306fc View commit details
    Browse the repository at this point in the history

  6. It is possible to have binary array records have an element type of a… 

    …rray without being marked as jagged
    @adamsitnik
    adamsitnik committed Aug 19, 2024
    Configuration menu
    Copy the full SHA
    297aa4b View commit details
    Browse the repository at this point in the history

Commits on Aug 20, 2024

  1. address feedback: 

    - rename TotalElementsCount to FlattenedLength
- Ensure lack of recursive call
- add a comment explaining null nuances
    @adamsitnik
    adamsitnik committed Aug 20, 2024
    Configuration menu
    Copy the full SHA
    ea50be4 View commit details
    Browse the repository at this point in the history

  2. improve exception messages: 

    - don't include member name in the exception message
- remove unused resource
- make the argument int rather than an object to make it clear it's never a string
    @adamsitnik
    adamsitnik committed Aug 20, 2024
    Configuration menu
    Copy the full SHA
    e740b0a View commit details
    Browse the repository at this point in the history

Commits on Aug 21, 2024

  1. add checked to ensure no long overflow for very unusual payloads

    @adamsitnik
    adamsitnik committed Aug 21, 2024
    Configuration menu
    Copy the full SHA
    140bf92 View commit details
    Browse the repository at this point in the history

Commits on Aug 28, 2024

  1. FlattenedLength must include nulls

    @adamsitnik
    adamsitnik committed Aug 28, 2024
    Configuration menu
    Copy the full SHA
    16394e2 View commit details
    Browse the repository at this point in the history

Commits on Sep 13, 2024

  1. Merge remote-tracking branch 'upstream/main' into totalElementsCount 

    # Conflicts:
#	src/libraries/System.Formats.Nrbf/src/System/Formats/Nrbf/RectangularArrayRecord.cs
    @adamsitnik
    adamsitnik committed Sep 13, 2024
    Configuration menu
    Copy the full SHA
    a5a38fb View commit details
    Browse the repository at this point in the history

  2. address code review feedback: count the arrays themselves

    @adamsitnik
    adamsitnik committed Sep 13, 2024
    Configuration menu
    Copy the full SHA
    8a61178 View commit details
    Browse the repository at this point in the history

Commits on Sep 16, 2024

  1. Merge remote-tracking branch 'upstream/main' into totalElementsCount 

    # Conflicts:
#	src/libraries/System.Formats.Nrbf/src/System/Formats/Nrbf/RectangularArrayRecord.cs
    @adamsitnik
    adamsitnik committed Sep 16, 2024
    Configuration menu
    Copy the full SHA
    2556647 View commit details
    Browse the repository at this point in the history