fix: Bunit browser file exc (#1504)

linkdotnet · web-flow · commit ecc480a20c6c · 2024-07-19T16:49:28.000+02:00
* chore: Align package versions

* fix: BunitBrowserFile throws when filesize too big

* chore: Fix CVE in System.Text.Json for production code

* docs: Added changelog entry
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,10 @@ All notable changes to **bUnit** will be documented in this file. The project ad
 
 ## [Unreleased]
 
+### Fixed
+
+- `UploadFile` doesn't throw an exception when the file size exceeds the maximum allowed size. Reported by [@MorneZaayman](https://github.com/MorneZaayman) in [#1503](https://github.com/bUnit-dev/bUnit/issues/1503). Fixed by [@linkdotnet](https://github.com/linkdotnet).
+
 ## [1.29.5] - 2024-07-05
 
 ### Fixed
diff --git a/Directory.Build.props b/Directory.Build.props
@@ -52,7 +52,7 @@
 	<!-- Shared code analyzers used for all projects in the solution -->
 	<ItemGroup Label="Code Analyzers">
 		<PackageReference Include="AsyncFixer" Version="1.6.0" PrivateAssets="All" />
-		<PackageReference Include="SonarAnalyzer.CSharp" Version="9.26.0.92422" PrivateAssets="All" />
+		<PackageReference Include="SonarAnalyzer.CSharp" Version="9.29.0.95321" PrivateAssets="All" />
 	</ItemGroup>
 
 	<ItemGroup Label="Implicit usings"
diff --git a/benchmark/bunit.benchmarks.assets/bunit.benchmarks.assets.csproj b/benchmark/bunit.benchmarks.assets/bunit.benchmarks.assets.csproj
@@ -12,7 +12,7 @@
     </ItemGroup>
 
     <ItemGroup>
-        <PackageReference Include="Microsoft.AspNetCore.Components.Web" Version="6.0.4" />
+        <PackageReference Include="Microsoft.AspNetCore.Components.Web" Version="6.0.32" />
     </ItemGroup>
 
 </Project>
diff --git a/docs/samples/tests/Directory.Build.props b/docs/samples/tests/Directory.Build.props
@@ -13,7 +13,7 @@
   </PropertyGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net6.0' OR '$(TargetFramework)' == 'net7.0' OR '$(TargetFramework)' == 'net8.0'">
-    <PackageReference Include="System.Text.Json" Version="8.0.0" />
+    <PackageReference Include="System.Text.Json" Version="8.0.4" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
diff --git a/docs/samples/tests/razor/bunit.docs.razor.samples.csproj b/docs/samples/tests/razor/bunit.docs.razor.samples.csproj
@@ -9,7 +9,7 @@
     <PackageReference Include="Moq" Version="4.16.1" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.0.0" />
     <PackageReference Include="NSubstitute" Version="4.2.2" />
-		<PackageReference Include="xunit" Version="2.8.1" />
+		<PackageReference Include="xunit" Version="2.9.0" />
 		<!-- DO NOT UPGRADE TO versions > 2.4.5 as they do not support .net5 or older -->
 		<PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
 			<PrivateAssets>all</PrivateAssets>
diff --git a/docs/samples/tests/xunit/bunit.docs.xunit.samples.csproj b/docs/samples/tests/xunit/bunit.docs.xunit.samples.csproj
@@ -11,7 +11,7 @@
     <PackageReference Include="Moq" Version="4.16.1" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.0.0" />
     <PackageReference Include="NSubstitute" Version="4.2.2" />
-		<PackageReference Include="xunit" Version="2.8.1" />
+		<PackageReference Include="xunit" Version="2.9.0" />
 		<!-- DO NOT UPGRADE TO versions > 2.4.5 as they do not support .net5 or older -->
 		<PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
 			<PrivateAssets>all</PrivateAssets>
diff --git a/src/bunit.template/template/Company.BlazorTests1.csproj b/src/bunit.template/template/Company.BlazorTests1.csproj
@@ -25,7 +25,7 @@
 	</ItemGroup>
 
 	<ItemGroup Condition="'$(testFramework_xunit)' == 'true'">
-		<PackageReference Include="xunit" Version="2.8.1" />
+		<PackageReference Include="xunit" Version="2.9.0" />
 		<PackageReference Include="xunit.runner.visualstudio" Version="2.5.4">
 			<PrivateAssets>all</PrivateAssets>
 			<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
diff --git a/src/bunit.web/Extensions/InputFile/BUnitBrowserFile.cs b/src/bunit.web/Extensions/InputFile/BUnitBrowserFile.cs
@@ -27,7 +27,12 @@ public BUnitBrowserFile(
 
 	public Stream OpenReadStream(long maxAllowedSize = 512000, CancellationToken cancellationToken = default)
 	{
+		if (Size > maxAllowedSize)
+		{
+			throw new IOException($"Supplied file with size {Size} bytes exceeds the maximum of {maxAllowedSize} bytes.");
+		}
+
 		return new MemoryStream(Content);
 	}
 }
-#endif
+#endif
diff --git a/src/bunit.web/Extensions/InputFile/InputFileExtensions.cs b/src/bunit.web/Extensions/InputFile/InputFileExtensions.cs
@@ -1,4 +1,5 @@
 ﻿#if NET5_0_OR_GREATER
+using System.Runtime.ExceptionServices;
 using Microsoft.AspNetCore.Components.Forms;
 
 namespace Bunit;
@@ -36,6 +37,11 @@ public static void UploadFiles(
 		{
 			uploadTask.GetAwaiter().GetResult();
 		}
+
+		if (uploadTask.Exception is { InnerException: not null } e)
+		{
+			ExceptionDispatchInfo.Capture(e.InnerException).Throw();
+		}
 	}
 }
-#endif
+#endif
diff --git a/src/bunit.web/bunit.web.csproj b/src/bunit.web/bunit.web.csproj
@@ -31,6 +31,9 @@
 		<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="$(DotNet3Version)" />
 		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="3.2.1" />
 		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Authentication" Version="3.2.1" />
+
+		<!-- Due to a CVE in System.Text.Json we explicitly reference the latest version of System.Text.Json -->
+		<PackageReference Include="System.Text.Json" Version="6.0.9" />
 	</ItemGroup>
 
 	<ItemGroup Condition="'$(TargetFramework)' == 'net5.0'">
@@ -41,6 +44,9 @@
 		<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="$(DotNet5Version)" />
 		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="$(DotNet5Version)" />
 		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Authentication" Version="$(DotNet5Version)" />
+
+		<!-- Due to a CVE in System.Text.Json we explicitly reference the latest version of System.Text.Json -->
+		<PackageReference Include="System.Text.Json" Version="6.0.9" />
 	</ItemGroup>
 
 	<ItemGroup Condition="'$(TargetFramework)' == 'net6.0'">
@@ -52,6 +58,9 @@
 		<PackageReference Include="Microsoft.AspNetCore.Components.Web" Version="$(DotNet6Version)" />
 		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="$(DotNet6Version)" />
 		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Authentication" Version="$(DotNet6Version)" />
+
+		<!-- Due to a CVE in System.Text.Json we explicitly reference the latest version of System.Text.Json -->
+		<PackageReference Include="System.Text.Json" Version="6.0.9" />
 	</ItemGroup>
 
 	<ItemGroup Condition="'$(TargetFramework)' == 'net7.0'">
@@ -63,6 +72,9 @@
 		<PackageReference Include="Microsoft.AspNetCore.Components.Web" Version="$(DotNet7Version)" />
 		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="$(DotNet7Version)" />
 		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Authentication" Version="$(DotNet7Version)" />
+
+		<!-- Due to a CVE in System.Text.Json we explicitly reference the latest version of System.Text.Json -->
+		<PackageReference Include="System.Text.Json" Version="8.0.4" />
 	</ItemGroup>
 
 	<ItemGroup Condition="'$(TargetFramework)' == 'net8.0'">
@@ -74,6 +86,9 @@
 		<PackageReference Include="Microsoft.AspNetCore.Components.Web" Version="$(DotNet8Version)" />
 		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="$(DotNet8Version)" />
 		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Authentication" Version="$(DotNet8Version)" />
+
+		<!-- Due to a CVE in System.Text.Json we explicitly reference the latest version of System.Text.Json -->
+		<PackageReference Include="System.Text.Json" Version="8.0.4" />
 	</ItemGroup>
 
 	<ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
diff --git a/tests/Directory.Build.props b/tests/Directory.Build.props
@@ -13,6 +13,14 @@
 		<IsTestProject>true</IsTestProject>
 		<SuppressTfmSupportBuildWarnings>true</SuppressTfmSupportBuildWarnings>
 	</PropertyGroup>
+	
+	<PropertyGroup>
+		<!-- 
+		Because of a CVE in System.Text.Json we get NU1903.
+		As this is a test project, we can ignore this warning for the time being.
+		 -->
+		<NoWarn>NU1903</NoWarn>
+	</PropertyGroup>
 
 	<ItemGroup>
 		<PackageReference Include="AutoFixture" Version="4.18.1" />
diff --git a/tests/bunit.core.tests/bunit.core.tests.csproj b/tests/bunit.core.tests/bunit.core.tests.csproj
@@ -13,7 +13,7 @@
 	</ItemGroup>
 
 	<ItemGroup>
-		<PackageReference Include="xunit" Version="2.8.1" />
+		<PackageReference Include="xunit" Version="2.9.0" />
 		<!-- DO NOT UPGRADE TO versions > 2.4.5 as they do not support .net5 or older -->
 		<PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
 			<PrivateAssets>all</PrivateAssets>
diff --git a/tests/bunit.generators.tests/bunit.generators.tests.csproj b/tests/bunit.generators.tests/bunit.generators.tests.csproj
@@ -14,7 +14,6 @@
 
 	<ItemGroup>
 		<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.10.0" />
-		<PackageReference Include="System.Net.Http" Version="4.3.4" />
 		<PackageReference Include="System.Text.RegularExpressions" Version="4.3.1" />
 		<PackageReference Include="Verify.SourceGenerators" Version="2.2.0" />
 		<PackageReference Include="Verify.Xunit" Version="25.3.0" />
@@ -25,8 +24,8 @@
 		<PackageReference Update="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.9.2" />
 		<PackageReference Update="Microsoft.CodeAnalysis.CSharp.SourceGenerators.Testing.XUnit" Version="1.1.1" />
 
-		<PackageReference Include="xunit" Version="2.8.1" />
-		<PackageReference Include="xunit.runner.visualstudio" Version="2.5.6">
+		<PackageReference Include="xunit" Version="2.9.0" />
+		<PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
 			<PrivateAssets>all</PrivateAssets>
 			<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
 		</PackageReference>
diff --git a/tests/bunit.testassets/SampleComponents/PersistentComponentStateSample.razor.cs b/tests/bunit.testassets/SampleComponents/PersistentComponentStateSample.razor.cs
@@ -32,7 +32,7 @@ private WeatherForecast[] CreateForecasts()
 		{
 			return new WeatherForecast[]
 			{
-			new WeatherForecast{ Temperature = 42 },
+				new WeatherForecast{ Temperature = 42 },
 			};
 		}
 #endif
diff --git a/tests/bunit.testassets/_Imports.razor b/tests/bunit.testassets/_Imports.razor
@@ -1,4 +1,3 @@
-@using System.Net.Http
 @using Microsoft.AspNetCore.Components.Forms
 @using Microsoft.AspNetCore.Components.Routing
 @using Microsoft.AspNetCore.Components.Web
diff --git a/tests/bunit.testassets/bunit.testassets.csproj b/tests/bunit.testassets/bunit.testassets.csproj
@@ -16,16 +16,16 @@
 	<ItemGroup>
 		<PackageReference Include="Serilog" Version="4.0.0" />
 		<PackageReference Include="Serilog.Expressions" Version="4.0.0" />
-		<PackageReference Include="xunit.extensibility.execution" Version="2.8.1" />
+		<PackageReference Include="xunit.extensibility.execution" Version="2.9.0" />
 		<PackageReference Include="xunit.abstractions" Version="2.0.3" />		
-		<PackageReference Include="xunit.assert" Version="2.8.1" />
+		<PackageReference Include="xunit.assert" Version="2.9.0" />
 	</ItemGroup>
 
 	<ItemGroup Condition="'$(TargetFramework)' == 'netstandard2.1'">
 		<PackageReference Include="Microsoft.Extensions.Localization.Abstractions" Version="$(DotNet3Version)" />
 		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="3.2.1" />
 		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Authentication" Version="3.2.1" />
-		<PackageReference Include="System.Text.Json" Version="8.0.3" />
+		<PackageReference Include="System.Text.Json" Version="8.0.4" />
 		<PackageReference Include="Serilog.Extensions.Logging" Version="8.0.0" />
 	</ItemGroup>
 	<ItemGroup Condition="'$(TargetFramework)' == 'net5.0'">
diff --git a/tests/bunit.web.query.tests/bunit.web.query.tests.csproj b/tests/bunit.web.query.tests/bunit.web.query.tests.csproj
@@ -14,7 +14,7 @@
 	</ItemGroup>
 
 	<ItemGroup>
-		<PackageReference Include="xunit" Version="2.8.1" />
+		<PackageReference Include="xunit" Version="2.9.0" />
 		<!-- DO NOT UPGRADE TO versions > 2.4.5 as they do not support .net5 or older -->
 		<PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
 			<PrivateAssets>all</PrivateAssets>
diff --git a/tests/bunit.web.tests/Extensions/InputFile/InputFileTests.cs b/tests/bunit.web.tests/Extensions/InputFile/InputFileTests.cs
@@ -102,9 +102,23 @@ public void Test008()
 
 		act.ShouldNotThrow();
 	}
+	
+	[Fact(DisplayName = "Uploading file exceeding the maximum file size will throw an exception")]
+	public void Test009()
+	{
+		var cut = RenderComponent<InputFileComponent>(ps => ps.Add(p => p.MaxFileSize, 512));
+		var file = InputFileContent.CreateFromText(new string('a', 513));
+
+		Action act = () => cut.FindComponent<InputFile>().UploadFiles(file);
+
+		act.ShouldThrow<IOException>();
+	}
 
 	private sealed class InputFileComponent : ComponentBase
 	{
+		[Parameter]
+		public long MaxFileSize { get; set; } = 512000;
+		
 		public string? Filename { get; private set; }
 		public string? Content { get; private set; }
 		public DateTimeOffset? LastChanged { get; private set; }
@@ -127,7 +141,7 @@ private void OnChange(InputFileChangeEventArgs args)
 			Filename = file.Name;
 			LastChanged = file.LastModified;
 			Size = file.Size;
-			using var stream = new StreamReader(file.OpenReadStream());
+			using var stream = new StreamReader(file.OpenReadStream(MaxFileSize));
 			Content = stream.ReadToEnd();
 		}
 	}
diff --git a/tests/bunit.web.tests/bunit.web.tests.csproj b/tests/bunit.web.tests/bunit.web.tests.csproj
@@ -13,7 +13,7 @@
 	</ItemGroup>
 
 	<ItemGroup>
-		<PackageReference Include="xunit" Version="2.8.1" />
+		<PackageReference Include="xunit" Version="2.9.0" />
 		<!-- DO NOT UPGRADE TO versions > 2.4.5 as they do not support .net5 or older -->
 		<PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
 			<PrivateAssets>all</PrivateAssets>

Original file line number	Diff line number	Diff line change
`@@ -27,7 +27,12 @@ public BUnitBrowserFile(`
`27`	`27`
`28`	`28`	`public Stream OpenReadStream(long maxAllowedSize = 512000, CancellationToken cancellationToken = default)`
`29`	`29`	`{`
	`30`	`+ if (Size > maxAllowedSize)`
	`31`	`+ {`
	`32`	`+ throw new IOException($"Supplied file with size {Size} bytes exceeds the maximum of {maxAllowedSize} bytes.");`
	`33`	`+ }`
	`34`	`+`
`30`	`35`	`return new MemoryStream(Content);`
`31`	`36`	`}`
`32`	`37`	`}`
`33`		`-#endif`
	`38`	`+#endif`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`	`1`	`#if NET5_0_OR_GREATER`
	`2`	`+using System.Runtime.ExceptionServices;`
`2`	`3`	`using Microsoft.AspNetCore.Components.Forms;`
`3`	`4`
`4`	`5`	`namespace Bunit;`
`@@ -36,6 +37,11 @@ public static void UploadFiles(`
`36`	`37`	`{`
`37`	`38`	`uploadTask.GetAwaiter().GetResult();`
`38`	`39`	`}`
	`40`	`+`
	`41`	`+ if (uploadTask.Exception is { InnerException: not null } e)`
	`42`	`+ {`
	`43`	`+ ExceptionDispatchInfo.Capture(e.InnerException).Throw();`
	`44`	`+ }`
`39`	`45`	`}`
`40`	`46`	`}`
`41`		`-#endif`
	`47`	`+#endif`