From 6a020d8becb10079b847dfc025206ba2f40a55b2 Mon Sep 17 00:00:00 2001 From: Paul Ming Date: Wed, 5 Aug 2020 09:32:34 -0700 Subject: [PATCH] Remove CA2363; not sure if we'd run into it --- .../Core/AnalyzerReleases.Unshipped.md | 1 - .../MicrosoftNetCoreAnalyzersResources.resx | 12 ---------- ...aSetDataTableInSerializableTypeAnalyzer.cs | 22 +++++-------------- .../MicrosoftNetCoreAnalyzersResources.cs.xlf | 20 ----------------- .../MicrosoftNetCoreAnalyzersResources.de.xlf | 20 ----------------- .../MicrosoftNetCoreAnalyzersResources.es.xlf | 20 ----------------- .../MicrosoftNetCoreAnalyzersResources.fr.xlf | 20 ----------------- .../MicrosoftNetCoreAnalyzersResources.it.xlf | 20 ----------------- .../MicrosoftNetCoreAnalyzersResources.ja.xlf | 20 ----------------- .../MicrosoftNetCoreAnalyzersResources.ko.xlf | 20 ----------------- .../MicrosoftNetCoreAnalyzersResources.pl.xlf | 20 ----------------- ...crosoftNetCoreAnalyzersResources.pt-BR.xlf | 20 ----------------- .../MicrosoftNetCoreAnalyzersResources.ru.xlf | 20 ----------------- .../MicrosoftNetCoreAnalyzersResources.tr.xlf | 20 ----------------- ...osoftNetCoreAnalyzersResources.zh-Hans.xlf | 20 ----------------- ...osoftNetCoreAnalyzersResources.zh-Hant.xlf | 20 ----------------- ...DataSetDataTableInSerializableTypeTests.cs | 7 +----- 17 files changed, 6 insertions(+), 296 deletions(-) diff --git a/src/NetAnalyzers/Core/AnalyzerReleases.Unshipped.md b/src/NetAnalyzers/Core/AnalyzerReleases.Unshipped.md index 5f3800dd29..6f195fc591 100644 --- a/src/NetAnalyzers/Core/AnalyzerReleases.Unshipped.md +++ b/src/NetAnalyzers/Core/AnalyzerReleases.Unshipped.md @@ -10,4 +10,3 @@ CA2355 | Security | Disabled | DataSetDataTableInSerializableObjectGraphAnalyzer CA2356 | Security | Disabled | DataSetDataTableInWebSerializableObjectGraphAnalyzer, [Documentation](https://docs.microsoft.com/visualstudio/code-quality/ca2356) CA2361 | Security | Disabled | DoNotUseDataSetReadXml, [Documentation](https://docs.microsoft.com/visualstudio/code-quality/ca2361) CA2362 | Security | Disabled | DataSetDataTableInSerializableTypeAnalyzer, [Documentation](https://docs.microsoft.com/visualstudio/code-quality/ca2362) -CA2363 | Security | Disabled | DataSetDataTableInSerializableTypeAnalyzer, [Documentation](https://docs.microsoft.com/visualstudio/code-quality/ca2363) diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/MicrosoftNetCoreAnalyzersResources.resx b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/MicrosoftNetCoreAnalyzersResources.resx index 270d1fa0e9..f321070751 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/MicrosoftNetCoreAnalyzersResources.resx +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/MicrosoftNetCoreAnalyzersResources.resx @@ -1248,12 +1248,6 @@ Unsafe DataSet or DataTable in deserialized object graph can be vulnerable to remote code execution attacks - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - - - Unsafe DataSet or DataTable in autogenerated serializable type - When deserializing untrusted input with an IFormatter-based serializer, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. @@ -1272,10 +1266,4 @@ Ensure autogenerated class containing DataSet.ReadXml() is not used with untrusted data - - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - - - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - \ No newline at end of file diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/Security/DataSetDataTableInSerializableTypeAnalyzer.cs b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/Security/DataSetDataTableInSerializableTypeAnalyzer.cs index 42fd722c4e..65d9000fd7 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/Security/DataSetDataTableInSerializableTypeAnalyzer.cs +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/Security/DataSetDataTableInSerializableTypeAnalyzer.cs @@ -48,21 +48,12 @@ public sealed class DataSetDataTableInSerializableTypeAnalyzer : DiagnosticAnaly RuleLevel.Disabled, isPortedFxCopRule: false, isDataflowRule: false); - internal static readonly DiagnosticDescriptor AutogeneratedSerializableContainsDangerousType = - SecurityHelpers.CreateDiagnosticDescriptor( - "CA2363", - nameof(MicrosoftNetCoreAnalyzersResources.DataSetDataTableInAutogeneratedSerializableTypeTitle), - nameof(MicrosoftNetCoreAnalyzersResources.DataSetDataTableInAutogeneratedSerializableTypeMessage), - RuleLevel.Disabled, - isPortedFxCopRule: false, - isDataflowRule: false); public override ImmutableArray SupportedDiagnostics => ImmutableArray.Create( RceSerializableContainsDangerousType, SerializableContainsDangerousType, - RceAutogeneratedSerializableContainsDangerousType, - AutogeneratedSerializableContainsDangerousType); + RceAutogeneratedSerializableContainsDangerousType); [SuppressMessage("Style", "IDE0047:Remove unnecessary parentheses", Justification = "Group related conditions together.")] public override void Initialize(AnalysisContext context) @@ -171,19 +162,16 @@ public override void Initialize(AnalysisContext context) out ImmutableArray results)) { DiagnosticDescriptor diagnosticToReport; - if (isProbablyAutogeneratedForGuiApp) + if (hasSerializableAttribute) { diagnosticToReport = - hasSerializableAttribute + isProbablyAutogeneratedForGuiApp ? RceAutogeneratedSerializableContainsDangerousType - : AutogeneratedSerializableContainsDangerousType; + : RceSerializableContainsDangerousType; } else { - diagnosticToReport = - hasSerializableAttribute - ? RceSerializableContainsDangerousType - : SerializableContainsDangerousType; + diagnosticToReport = SerializableContainsDangerousType; } foreach (InsecureObjectGraphResult result in results) diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.cs.xlf b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.cs.xlf index f89c305ae6..1046c0cae5 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.cs.xlf +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.cs.xlf @@ -157,16 +157,6 @@ Spolehlivost - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - - - - Unsafe DataSet or DataTable in autogenerated serializable type - Unsafe DataSet or DataTable in autogenerated serializable type - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} @@ -247,16 +237,6 @@ Do not use DataSet.ReadXml() with untrusted data - - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - - - - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - - The method '{0}' is insecure when deserializing untrusted data The method '{0}' is insecure when deserializing untrusted data diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.de.xlf b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.de.xlf index 93f795d018..250c4cbe6a 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.de.xlf +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.de.xlf @@ -157,16 +157,6 @@ Zuverlässigkeit - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - - - - Unsafe DataSet or DataTable in autogenerated serializable type - Unsafe DataSet or DataTable in autogenerated serializable type - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} @@ -247,16 +237,6 @@ Do not use DataSet.ReadXml() with untrusted data - - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - - - - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - - The method '{0}' is insecure when deserializing untrusted data The method '{0}' is insecure when deserializing untrusted data diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.es.xlf b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.es.xlf index 3bce1df7a2..c1c636e13c 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.es.xlf +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.es.xlf @@ -157,16 +157,6 @@ Fiabilidad - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - - - - Unsafe DataSet or DataTable in autogenerated serializable type - Unsafe DataSet or DataTable in autogenerated serializable type - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} @@ -247,16 +237,6 @@ Do not use DataSet.ReadXml() with untrusted data - - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - - - - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - - The method '{0}' is insecure when deserializing untrusted data The method '{0}' is insecure when deserializing untrusted data diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.fr.xlf b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.fr.xlf index 67f7e4f0d4..e63c313f3f 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.fr.xlf +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.fr.xlf @@ -157,16 +157,6 @@ Fiabilité - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - - - - Unsafe DataSet or DataTable in autogenerated serializable type - Unsafe DataSet or DataTable in autogenerated serializable type - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} @@ -247,16 +237,6 @@ Do not use DataSet.ReadXml() with untrusted data - - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - - - - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - - The method '{0}' is insecure when deserializing untrusted data The method '{0}' is insecure when deserializing untrusted data diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.it.xlf b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.it.xlf index ca51ed9481..ceb7595916 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.it.xlf +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.it.xlf @@ -157,16 +157,6 @@ Affidabilità - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - - - - Unsafe DataSet or DataTable in autogenerated serializable type - Unsafe DataSet or DataTable in autogenerated serializable type - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} @@ -247,16 +237,6 @@ Do not use DataSet.ReadXml() with untrusted data - - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - - - - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - - The method '{0}' is insecure when deserializing untrusted data The method '{0}' is insecure when deserializing untrusted data diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ja.xlf b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ja.xlf index 3a22d5826f..7bd5689e5e 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ja.xlf +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ja.xlf @@ -157,16 +157,6 @@ 信頼性 - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - - - - Unsafe DataSet or DataTable in autogenerated serializable type - Unsafe DataSet or DataTable in autogenerated serializable type - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} @@ -247,16 +237,6 @@ Do not use DataSet.ReadXml() with untrusted data - - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - - - - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - - The method '{0}' is insecure when deserializing untrusted data The method '{0}' is insecure when deserializing untrusted data diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ko.xlf b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ko.xlf index 964c5dc994..2c30c85985 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ko.xlf +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ko.xlf @@ -157,16 +157,6 @@ 안정성 - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - - - - Unsafe DataSet or DataTable in autogenerated serializable type - Unsafe DataSet or DataTable in autogenerated serializable type - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} @@ -247,16 +237,6 @@ Do not use DataSet.ReadXml() with untrusted data - - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - - - - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - - The method '{0}' is insecure when deserializing untrusted data The method '{0}' is insecure when deserializing untrusted data diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pl.xlf b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pl.xlf index 86d9d6276c..07017fae2d 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pl.xlf +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pl.xlf @@ -157,16 +157,6 @@ Niezawodność - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - - - - Unsafe DataSet or DataTable in autogenerated serializable type - Unsafe DataSet or DataTable in autogenerated serializable type - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} @@ -247,16 +237,6 @@ Do not use DataSet.ReadXml() with untrusted data - - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - - - - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - - The method '{0}' is insecure when deserializing untrusted data The method '{0}' is insecure when deserializing untrusted data diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pt-BR.xlf b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pt-BR.xlf index 7e5d61f920..4f64375e30 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pt-BR.xlf +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.pt-BR.xlf @@ -157,16 +157,6 @@ Confiabilidade - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - - - - Unsafe DataSet or DataTable in autogenerated serializable type - Unsafe DataSet or DataTable in autogenerated serializable type - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} @@ -247,16 +237,6 @@ Do not use DataSet.ReadXml() with untrusted data - - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - - - - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - - The method '{0}' is insecure when deserializing untrusted data The method '{0}' is insecure when deserializing untrusted data diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ru.xlf b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ru.xlf index 5ec02e4e05..1135ea7b31 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ru.xlf +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.ru.xlf @@ -157,16 +157,6 @@ Надежность - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - - - - Unsafe DataSet or DataTable in autogenerated serializable type - Unsafe DataSet or DataTable in autogenerated serializable type - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} @@ -247,16 +237,6 @@ Do not use DataSet.ReadXml() with untrusted data - - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - - - - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - - The method '{0}' is insecure when deserializing untrusted data The method '{0}' is insecure when deserializing untrusted data diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.tr.xlf b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.tr.xlf index 2fa3ed44ef..3f63f4fa62 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.tr.xlf +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.tr.xlf @@ -157,16 +157,6 @@ Güvenilirlik - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - - - - Unsafe DataSet or DataTable in autogenerated serializable type - Unsafe DataSet or DataTable in autogenerated serializable type - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} @@ -247,16 +237,6 @@ Do not use DataSet.ReadXml() with untrusted data - - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - - - - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - - The method '{0}' is insecure when deserializing untrusted data The method '{0}' is insecure when deserializing untrusted data diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hans.xlf b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hans.xlf index 7f492eca13..cf874d6aea 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hans.xlf +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hans.xlf @@ -157,16 +157,6 @@ 可靠性 - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - - - - Unsafe DataSet or DataTable in autogenerated serializable type - Unsafe DataSet or DataTable in autogenerated serializable type - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} @@ -247,16 +237,6 @@ Do not use DataSet.ReadXml() with untrusted data - - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - - - - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - - The method '{0}' is insecure when deserializing untrusted data The method '{0}' is insecure when deserializing untrusted data diff --git a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hant.xlf b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hant.xlf index 20e2753972..3690a586f7 100644 --- a/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hant.xlf +++ b/src/NetAnalyzers/Core/Microsoft.NetCore.Analyzers/xlf/MicrosoftNetCoreAnalyzersResources.zh-Hant.xlf @@ -157,16 +157,6 @@ 可靠性 - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0}. Ensure that the autogenerated type is never deserialized with untrusted data. - - - - Unsafe DataSet or DataTable in autogenerated serializable type - Unsafe DataSet or DataTable in autogenerated serializable type - - When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} When deserializing untrusted input, deserializing a {0} object is insecure. '{1}' either is or derives from {0} @@ -247,16 +237,6 @@ Do not use DataSet.ReadXml() with untrusted data - - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - The method '{0}' is insecure when deserializing untrusted data. Make sure that autogenerated class containing the '{0}' call is not deserialized with untrusted data. - - - - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - Ensure autogenerated class containing DataTable.ReadXml() is not used with untrusted data - - The method '{0}' is insecure when deserializing untrusted data The method '{0}' is insecure when deserializing untrusted data diff --git a/src/NetAnalyzers/UnitTests/Microsoft.NetCore.Analyzers/Security/DataSetDataTableInSerializableTypeTests.cs b/src/NetAnalyzers/UnitTests/Microsoft.NetCore.Analyzers/Security/DataSetDataTableInSerializableTypeTests.cs index 5679c8c673..d1fa4e7dd0 100644 --- a/src/NetAnalyzers/UnitTests/Microsoft.NetCore.Analyzers/Security/DataSetDataTableInSerializableTypeTests.cs +++ b/src/NetAnalyzers/UnitTests/Microsoft.NetCore.Analyzers/Security/DataSetDataTableInSerializableTypeTests.cs @@ -419,7 +419,7 @@ public class BlahClass : global::System.Data.DataSet { private DataTable table; } }", - GetAutogeneratedNonIFormatterCSharpResultAt(8, 5, "DataSet", "BlahClass")); + GetNonIFormatterCSharpResultAt(8, 5, "DataSet", "BlahClass")); } [Fact] @@ -514,11 +514,6 @@ private static DiagnosticResult GetIFormatterCSharpResultAt(int line, int column .WithLocation(line, column) .WithArguments(arguments); - private static DiagnosticResult GetAutogeneratedNonIFormatterCSharpResultAt(int line, int column, params string[] arguments) - => VerifyCS.Diagnostic(DataSetDataTableInSerializableTypeAnalyzer.AutogeneratedSerializableContainsDangerousType) - .WithLocation(line, column) - .WithArguments(arguments); - private static DiagnosticResult GetAutogeneratedIFormatterCSharpResultAt(int line, int column, params string[] arguments) => VerifyCS.Diagnostic(DataSetDataTableInSerializableTypeAnalyzer.RceAutogeneratedSerializableContainsDangerousType) .WithLocation(line, column)