Joseph Doherty
2a0faeab6f
The NuGetAuditSuppress in Directory.Packages.props was masking a LIVE high-severity vulnerability, not documenting an accepted one. Only the Host project resolved a patched SQLitePCLRaw.lib.e_sqlite3 2.1.12 (transitively, via ZB.MOM.WW.Auth.ApiKeys). Every other SQLite consumer - AuditLog, SiteRuntime, StoreAndForward, SiteEventLogging and 11 test projects - still resolved the vulnerable 2.1.11. The suppression's rationale was factually wrong: it claimed 'the only patched native lib is the SQLitePCLRaw 3.x line'. 2.1.12 patches this advisory within the 2.1.x line, so the feared risky force-override of the whole family to 3.x is unnecessary. Fix: explicit PackageReference to the patched 2.1.12 in each SQLite-consuming project, plus the central PackageVersion row. Suppression removed, so the advisory is audited again rather than silenced. Rejected alternative: CentralPackageTransitivePinningEnabled. It clears the advisory in one line but makes every central version a ceiling for transitive resolution, demanding bumps to Google.Protobuf, Grpc.Net.Client, Microsoft.Data.SqlClient and Newtonsoft.Json. That is a gRPC/data-access change to a production SCADA platform and deserves its own reviewed commit. Verified: forced full-solution restore reports no NU1903 (only the pre-existing, unrelated AngleSharp NU1902 in CentralUI.Tests); all four previously-vulnerable src projects now resolve 2.1.12; 55 projects build 0 warnings / 0 errors; 1108 tests pass across the SQLite layer (AuditLog 354, ConfigurationDatabase 357, Security 181, StoreAndForward 152, SiteEventLogging 64).
88 lines
4.2 KiB
XML
88 lines
4.2 KiB
XML
<Project Sdk="Microsoft.NET.Sdk">
|
|
|
|
<PropertyGroup>
|
|
<TargetFramework>net10.0</TargetFramework>
|
|
<ImplicitUsings>enable</ImplicitUsings>
|
|
<Nullable>enable</Nullable>
|
|
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
|
|
<IsPackable>false</IsPackable>
|
|
</PropertyGroup>
|
|
|
|
<ItemGroup>
|
|
<PackageReference Include="Akka.TestKit.Xunit2" />
|
|
<PackageReference Include="coverlet.collector" />
|
|
<!--
|
|
Bundle D D2 needs Microsoft.Data.SqlClient for the MsSqlMigrationFixture
|
|
(mirroring ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests). Pinning 6.1.1 here for
|
|
the same reason: EF SqlServer 10.0.7 needs >= 6.1.1 but the central pin
|
|
is 6.0.2 (production ExternalSystemGateway). Override is test-only.
|
|
-->
|
|
<PackageReference Include="Microsoft.Data.SqlClient" VersionOverride="6.1.1" />
|
|
<PackageReference Include="Microsoft.Data.Sqlite" />
|
|
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
|
|
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
|
|
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
|
|
<PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" />
|
|
<!--
|
|
M4 Bundle E (Task E3): Microsoft.Extensions.Configuration.Json,
|
|
DependencyInjection, and Logging.Abstractions are now provided by the
|
|
Microsoft.AspNetCore.App framework reference below (pulled in for the
|
|
TestHost-based middleware E2E) so we drop them as explicit package
|
|
references to satisfy the warn-as-error pruning rule.
|
|
-->
|
|
<PackageReference Include="Microsoft.NET.Test.Sdk" />
|
|
<PackageReference Include="NSubstitute" />
|
|
<PackageReference Include="xunit" />
|
|
<PackageReference Include="xunit.runner.visualstudio" />
|
|
<!--
|
|
SkippableFact pattern (xunit 2.9.x has no native Assert.Skip) — used by
|
|
Bundle D D2 MSSQL-backed AuditLogIngestActor tests to report Skipped when
|
|
the dev MSSQL container is not reachable.
|
|
-->
|
|
<PackageReference Include="Xunit.SkippableFact" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<Using Include="Xunit" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<ProjectReference Include="../../src/ZB.MOM.WW.ScadaBridge.AuditLog/ZB.MOM.WW.ScadaBridge.AuditLog.csproj" />
|
|
<!--
|
|
D2: the AuditLogIngestActor tests use the real AuditLogRepository against
|
|
a per-test MSSQL database via MsSqlMigrationFixture. The fixture lives in
|
|
ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests; we reference that test project so
|
|
the fixture + EF migrations come along without duplicating them.
|
|
-->
|
|
<ProjectReference Include="../ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests.csproj" />
|
|
<!--
|
|
G2/G3/G4: the cached-call combined telemetry integration tests compose the
|
|
production OperationTrackingStore (site SQLite source of truth for
|
|
Tracking.Status) alongside the M2 audit writer chain, so the harness
|
|
needs a project reference to SiteRuntime where the store lives.
|
|
-->
|
|
<ProjectReference Include="../../src/ZB.MOM.WW.ScadaBridge.SiteRuntime/ZB.MOM.WW.ScadaBridge.SiteRuntime.csproj" />
|
|
<!--
|
|
M4 Bundle E (Task E2): the dispatcher audit-trail end-to-end test
|
|
constructs the production NotificationOutboxActor against the real
|
|
CentralAuditWriter so the Attempted/Delivered NotifyDeliver rows land in
|
|
the central MSSQL AuditLog table.
|
|
-->
|
|
<ProjectReference Include="../../src/ZB.MOM.WW.ScadaBridge.NotificationOutbox/ZB.MOM.WW.ScadaBridge.NotificationOutbox.csproj" />
|
|
<!--
|
|
M4 Bundle E (Task E3): the inbound API audit-trail end-to-end test wires
|
|
the production AuditWriteMiddleware into a TestHost pipeline and asserts
|
|
one InboundRequest/InboundAuthFailure row per request lands in the
|
|
central MSSQL AuditLog.
|
|
-->
|
|
<ProjectReference Include="../../src/ZB.MOM.WW.ScadaBridge.InboundAPI/ZB.MOM.WW.ScadaBridge.InboundAPI.csproj" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<!-- M4 Bundle E (Task E3): need ASP.NET Core for the TestHost-based middleware E2E. -->
|
|
<FrameworkReference Include="Microsoft.AspNetCore.App" />
|
|
<PackageReference Include="Microsoft.AspNetCore.TestHost" />
|
|
</ItemGroup>
|
|
|
|
</Project>
|