Joseph Doherty
f056b67e9a
ecf6b628 pinned AngleSharp to 1.5.2 to clear GHSA-pgww-w46g-26qg. That fixed the
build but BROKE 33 CentralUI bunit tests at runtime with
MissingMethodException: AngleSharp.Dom.IHtmlCollection`1.get_Item(Int32)
because 1.5.x changed IHtmlCollection<T>'s indexer and bunit is compiled against
1.1.x. My mistake: I verified `dotnet build` was clean and did not run the test
suite before committing, so a runtime-only break sailed through.
There is no working patched combination upstream. Verified empirically:
AngleSharp 1.1.2 / 1.2.0 / 1.3.0 / 1.4.0 -> still flagged NU1902
AngleSharp 1.5.0 / 1.5.2 -> patched, but breaks bunit at runtime
bunit up to 2.7.2 (latest) -> still resolves AngleSharp 1.4.0
So the real choice is a suppressed advisory or an unbuildable suite. Scoped
suppression wins here because the reach is nil: AngleSharp is an HTML parser bunit
uses to assert on rendered markup, it ships in no production project, and the only
"documents" it parses are our own components' output.
Explicitly NOT the same call as GHSA-2m69-gcr7-jv3q (SQLitePCLRaw), whose
suppression was removed in 2026-07: that one masked a vulnerability on PRODUCTION
code paths and had a working patched version available. Neither is true here.
Revisit when bunit ships against AngleSharp 1.5+.
Verified:
dotnet build ZB.MOM.WW.ScadaBridge.slnx -> 0 Error(s), 0 Warning(s)
CentralUI.Tests -> 925 passed, 0 failed (was 33 failing)
Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts
67 lines
3.0 KiB
XML
67 lines
3.0 KiB
XML
<Project Sdk="Microsoft.NET.Sdk">
|
|
|
|
<PropertyGroup>
|
|
<TargetFramework>net10.0</TargetFramework>
|
|
<ImplicitUsings>enable</ImplicitUsings>
|
|
<Nullable>enable</Nullable>
|
|
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
|
|
<IsPackable>false</IsPackable>
|
|
</PropertyGroup>
|
|
|
|
<ItemGroup>
|
|
<PackageReference Include="bunit" />
|
|
<PackageReference Include="coverlet.collector" />
|
|
<PackageReference Include="Microsoft.AspNetCore.TestHost" />
|
|
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
|
|
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
|
|
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
|
|
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
|
|
<PackageReference Include="Microsoft.NET.Test.Sdk" />
|
|
<PackageReference Include="NSubstitute" />
|
|
<PackageReference Include="xunit" />
|
|
<PackageReference Include="xunit.runner.visualstudio" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<Using Include="Xunit" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<FrameworkReference Include="Microsoft.AspNetCore.App" />
|
|
</ItemGroup>
|
|
|
|
<ItemGroup>
|
|
<ProjectReference Include="../../src/ZB.MOM.WW.ScadaBridge.CentralUI/ZB.MOM.WW.ScadaBridge.CentralUI.csproj" />
|
|
<!--
|
|
The DbContext-race regression test (AuditLogQueryServiceTests) exercises a
|
|
real ScadaBridgeDbContext + AuditLogRepository over SQLite in-memory to prove
|
|
scope-per-query isolation. Pulls in the ConfigurationDatabase project.
|
|
-->
|
|
<ProjectReference Include="../../src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.csproj" />
|
|
</ItemGroup>
|
|
|
|
<!--
|
|
GHSA-pgww-w46g-26qg (NU1902, moderate) on AngleSharp, reached ONLY transitively via
|
|
bunit. Suppressed here, scoped to this one test project, because there is verifiably
|
|
no version combination that resolves it:
|
|
|
|
- AngleSharp < 1.5.0 is vulnerable (1.4.0 is what even the newest bunit resolves).
|
|
- AngleSharp >= 1.5.0 changed IHtmlCollection<T>'s indexer, so every bunit build
|
|
throws MissingMethodException at runtime - 33 CentralUI render tests fail.
|
|
- Bumping bunit does not help: checked up to 2.7.2, still AngleSharp 1.4.0.
|
|
|
|
So the choice is a suppressed advisory or an unbuildable/failing test suite. Scoped
|
|
suppression wins because the reach is genuinely nil: AngleSharp is an HTML parser used
|
|
by bunit to assert on rendered markup in unit tests. It ships in no production project
|
|
and processes no untrusted input - the "documents" it parses are our own components'
|
|
output. Revisit when bunit ships against AngleSharp 1.5+.
|
|
|
|
NOT the same call as GHSA-2m69-gcr7-jv3q (SQLitePCLRaw): that suppression was removed
|
|
in 2026-07 precisely because it was masking a vulnerability in PRODUCTION code paths.
|
|
This one is test-only, and a patched-but-working version does not exist upstream.
|
|
-->
|
|
<ItemGroup>
|
|
<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-pgww-w46g-26qg" />
|
|
</ItemGroup>
|
|
|
|
</Project> |