chore: bump regular System.Text.RegularExpressions due to a known CVE in earlier versions (#1735)

aygalinc · lukebakken · web-flow · commit e4e05a0eaa3d · 2024-12-06T13:24:09.000-08:00
* * Bump regular System.Text.RegularExpressions due to detected cve
* Increment the nuget cache version to invalidate the cache
* Add `Directory.Packages.props` to GHA NuGet cache

* * Set `TestTfmsInParallel` to `false`

---------

Co-authored-by: Luke Bakken &lt;luke@bakken.io&gt;
diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml
@@ -20,9 +20,9 @@ jobs:
           path: |
             ~/.nuget/packages
             ~/AppData/Local/NuGet/v3-cache
-          key: ${{ runner.os }}-v1-nuget-${{ hashFiles('**/*.csproj') }}
+          key: ${{ runner.os }}-v2-nuget-${{ hashFiles('**/*.csproj','projects/Directory.Packages.props') }}
           restore-keys: |
-            ${{ runner.os }}-v1-nuget-
+            ${{ runner.os }}-v2-nuget-
       - name: Build (Debug)
         run: dotnet build ${{ github.workspace }}\Build.csproj
       - name: Verify
@@ -142,9 +142,9 @@ jobs:
           path: |
             ~/.nuget/packages
             ~/.local/share/NuGet/v3-cache
-          key: ${{ runner.os }}-v1-nuget-${{ hashFiles('**/*.csproj') }}
+          key: ${{ runner.os }}-v2-nuget-${{ hashFiles('**/*.csproj','projects/Directory.Packages.props') }}
           restore-keys: |
-            ${{ runner.os }}-v1-nuget-
+            ${{ runner.os }}-v2-nuget-
       - name: Build (Debug)
         run: dotnet build ${{ github.workspace }}/Build.csproj
       - name: Verify
diff --git a/projects/Directory.Packages.props b/projects/Directory.Packages.props
@@ -16,6 +16,8 @@
     -->
     <PackageVersion Include="System.IO.Pipelines" Version="8.0.0" />
     <PackageVersion Include="System.Net.Http" Version="4.3.4" />
+    <PackageVersion Include="System.Text.Json" Version="8.0.5" />
+    <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
     <PackageVersion Include="System.Threading.RateLimiting" Version="8.0.0" />
     <PackageVersion Include="WireMock.Net" Version="1.5.62" />
     <PackageVersion Include="xunit" Version="2.9.0" />
@@ -33,13 +35,9 @@
     <PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="8.0.1" />
     <PackageVersion Include="System.Memory" Version="4.5.5" />
     <PackageVersion Include="System.Threading.Channels" Version="8.0.0" />
-    <PackageVersion Include="System.Text.Json" Version="8.0.5" />
     <PackageVersion Include="System.Net.Http.Json" Version="8.0.1" />
     <PackageVersion Include="Microsoft.Bcl.AsyncInterfaces" Version="8.0.0" />
   </ItemGroup>
-  <ItemGroup Condition="$(TargetFramework)=='net472'">
-    <PackageVersion Include="System.Text.Json" Version="8.0.5" />
-  </ItemGroup>
   <ItemGroup Condition="'$(TargetFrameworkIdentifier)' == '.NETFramework'">
     <GlobalPackageReference Include="Microsoft.NETFramework.ReferenceAssemblies" Version="1.0.3" />
   </ItemGroup>
diff --git a/projects/Test/Common/Common.csproj b/projects/Test/Common/Common.csproj
@@ -26,6 +26,7 @@
   </ItemGroup>
   
   <ItemGroup>
+    <PackageReference Include="System.Text.Json" />
     <PackageReference Include="EasyNetQ.Management.Client" />
     <PackageReference Include="xunit" />
     <PackageReference Include="xunit.abstractions" />
diff --git a/projects/Test/Integration/Integration.csproj b/projects/Test/Integration/Integration.csproj
@@ -39,6 +39,7 @@
   -->
 
   <ItemGroup>
+    <PackageReference Include="System.Text.Json" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="xunit" />
     <PackageReference Include="xunit.runner.visualstudio" PrivateAssets="all" />
diff --git a/projects/Test/Integration/TestExchangeDeclare.cs b/projects/Test/Integration/TestExchangeDeclare.cs
@@ -112,6 +112,7 @@ public async Task TestConcurrentExchangeDeclareAndDelete()
             var exchangeNames = new ConcurrentBag<string>();
             var tasks = new List<Task>();
             NotSupportedException nse = null;
+            Exception unexpectedException = null;
             for (int i = 0; i < 256; i++)
             {
                 var t = Task.Run(async () =>
@@ -129,13 +130,24 @@ public async Task TestConcurrentExchangeDeclareAndDelete()
                             {
                                 nse = e;
                             }
+                            catch (Exception ex)
+                            {
+                                unexpectedException = ex;
+                            }
                         });
                 tasks.Add(t);
             }
 
             await Task.WhenAll(tasks);
 
-            Assert.Null(nse);
+            if (nse is not null)
+            {
+                Assert.Fail($"got unexpected NotSupportedException: {nse}");
+            }
+            if (unexpectedException is not null)
+            {
+                Assert.Fail($"got unexpected Exception: {unexpectedException}");
+            }
             tasks.Clear();
 
             foreach (string exchangeName in exchangeNames)
@@ -154,13 +166,24 @@ public async Task TestConcurrentExchangeDeclareAndDelete()
                             {
                                 nse = e;
                             }
+                            catch (Exception ex)
+                            {
+                                unexpectedException = ex;
+                            }
                         });
                 tasks.Add(t);
             }
 
             await Task.WhenAll(tasks);
 
-            Assert.Null(nse);
+            if (nse is not null)
+            {
+                Assert.Fail($"got unexpected NotSupportedException: {nse}");
+            }
+            if (unexpectedException is not null)
+            {
+                Assert.Fail($"got unexpected Exception: {unexpectedException}");
+            }
         }
     }
 }
diff --git a/projects/Test/OAuth2/OAuth2.csproj b/projects/Test/OAuth2/OAuth2.csproj
@@ -28,6 +28,7 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
+    <PackageReference Include="System.Text.RegularExpressions" />
     <PackageReference Include="xunit" />
     <PackageReference Include="xunit.runner.visualstudio" PrivateAssets="all" />
     <PackageReference Include="System.Net.Http" />
diff --git a/projects/Test/SequentialIntegration/SequentialIntegration.csproj b/projects/Test/SequentialIntegration/SequentialIntegration.csproj
@@ -17,6 +17,7 @@
     <SignAssembly>true</SignAssembly>
     <IsTestProject>true</IsTestProject>
     <LangVersion>12.0</LangVersion>
+    <TestTfmsInParallel>false</TestTfmsInParallel>
   </PropertyGroup>
 
   <ItemGroup>
@@ -38,6 +39,7 @@
   </ItemGroup>
 
   <ItemGroup>
+    <PackageReference Include="System.Text.Json" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="OpenTelemetry.Exporter.InMemory" />
     <PackageReference Include="xunit" />
diff --git a/projects/Test/Unit/Unit.csproj b/projects/Test/Unit/Unit.csproj
@@ -24,6 +24,7 @@
   </ItemGroup>
 
   <ItemGroup>
+    <PackageReference Include="System.Text.Json" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="xunit" />
     <PackageReference Include="xunit.runner.visualstudio" PrivateAssets="all" />

Original file line number	Diff line number	Diff line change
`@@ -112,6 +112,7 @@ public async Task TestConcurrentExchangeDeclareAndDelete()`
`112`	`112`	`var exchangeNames = new ConcurrentBag<string>();`
`113`	`113`	`var tasks = new List<Task>();`
`114`	`114`	`NotSupportedException nse = null;`
	`115`	`+ Exception unexpectedException = null;`
`115`	`116`	`for (int i = 0; i < 256; i++)`
`116`	`117`	`{`
`117`	`118`	`var t = Task.Run(async () =>`
`@@ -129,13 +130,24 @@ public async Task TestConcurrentExchangeDeclareAndDelete()`
`129`	`130`	`{`
`130`	`131`	`nse = e;`
`131`	`132`	`}`
	`133`	`+ catch (Exception ex)`
	`134`	`+ {`
	`135`	`+ unexpectedException = ex;`
	`136`	`+ }`
`132`	`137`	`});`
`133`	`138`	`tasks.Add(t);`
`134`	`139`	`}`
`135`	`140`
`136`	`141`	`await Task.WhenAll(tasks);`
`137`	`142`
`138`		`- Assert.Null(nse);`
	`143`	`+ if (nse is not null)`
	`144`	`+ {`
	`145`	`+ Assert.Fail($"got unexpected NotSupportedException: {nse}");`
	`146`	`+ }`
	`147`	`+ if (unexpectedException is not null)`
	`148`	`+ {`
	`149`	`+ Assert.Fail($"got unexpected Exception: {unexpectedException}");`
	`150`	`+ }`
`139`	`151`	`tasks.Clear();`
`140`	`152`
`141`	`153`	`foreach (string exchangeName in exchangeNames)`
`@@ -154,13 +166,24 @@ public async Task TestConcurrentExchangeDeclareAndDelete()`
`154`	`166`	`{`
`155`	`167`	`nse = e;`
`156`	`168`	`}`
	`169`	`+ catch (Exception ex)`
	`170`	`+ {`
	`171`	`+ unexpectedException = ex;`
	`172`	`+ }`
`157`	`173`	`});`
`158`	`174`	`tasks.Add(t);`
`159`	`175`	`}`
`160`	`176`
`161`	`177`	`await Task.WhenAll(tasks);`
`162`	`178`
`163`		`- Assert.Null(nse);`
	`179`	`+ if (nse is not null)`
	`180`	`+ {`
	`181`	`+ Assert.Fail($"got unexpected NotSupportedException: {nse}");`
	`182`	`+ }`
	`183`	`+ if (unexpectedException is not null)`
	`184`	`+ {`
	`185`	`+ Assert.Fail($"got unexpected Exception: {unexpectedException}");`
	`186`	`+ }`
`164`	`187`	`}`
`165`	`188`	`}`
`166`	`189`	`}`