Skip to content

RazorEngine.NetFramework 4.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Oct 23:20
· 70 commits to master since this release
v4.0.0
da7d5a6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
  • (BREAKING) First release of the fork, published as the new package RazorEngine.NetFramework.
  • (SECURITY, BREAKING) Fix CVE-2021-46703 (sandbox escape in IsolatedRazorEngineService): IsolatedRazorEngineService and IsolatedTemplateService now refuse partially trusted (sandboxed) AppDomains with a NotSupportedException, because Code Access Security is no security boundary. Isolation with fully trusted AppDomains (to unload templates) works as before. Templates must come from trusted sources; see doc/Isolation.md.
  • (BREAKING) The assembly is now RazorEngine.NetFramework.dll, signed with a new key (public key token 58ad996d4f48e61f), so it no longer collides with the original RazorEngine.dll. Namespaces stay RazorEngine.*. When migrating, update app.config/web.config:
    • Change the assembly name of the section registration, e.g. type="RazorEngine.Configuration.RazorEngineConfigurationSection, RazorEngine.NetFramework".
    • Change every assembly-qualified type name inside <razorEngine> that names , RazorEngine (activatorType, baseTemplateType, cachingProviderType, compilerServiceFactoryType, encodedStringFactoryType, referenceResolverType, templateManagerType, templateResolverType).
    • Remove bindingRedirect entries for the old RazorEngine assembly.
  • (BUGFIX) The default reference resolver no longer passes the original RazorEngine/RazorEngine.Roslyn 3.x assemblies to the template compiler, so templates still compile when the original package is loaded in the same process.
  • (NEW) Roslyn is part of the package. In the original project it was the separate package RazorEngine.Roslyn (last 4.1.1-rc1); the fork contains the never-released upstream change from 3.10.1-alpha001 that merged it into the main assembly, so RoslynCompilerServiceFactory is available without another package. Remove RazorEngine.Roslyn when switching. CodeDom (csc.exe, C# 5) stays the default compiler in 4.0.0.
  • (PACKAGING) Because of that, the package now depends on Microsoft.CodeAnalysis.CSharp 1.3.2, System.Collections.Immutable 1.3.1 and System.Reflection.Metadata 1.4.2 in addition to Microsoft.AspNet.Razor (the original 3.10.0 only depended on Razor).
  • (NEW) Values in a DynamicViewBag are exchanged across AppDomains, so a view bag works with IsolatedRazorEngineService (never-released upstream change, thanks campersau, Antaris#504).
  • (BREAKING) Target .NET Framework 4.8 only. The net40 (Razor 2) and Razor4 (Microsoft.AspNetCore.Razor) builds are dropped.
  • (BUILD) SDK-style projects with NuGet PackageReference replace Paket and FAKE. Build with dotnet build, test with dotnet test, pack with dotnet pack.
  • (BUILD) GitHub Actions replace Travis CI and AppVeyor.
  • (PACKAGING) The package has the Apache-2.0 license expression, contains README and LICENSE, comes with a symbol package (.snupkg) on nuget.org and is built deterministically on GitHub Actions.
  • (BUILD) Releases are published from GitHub Actions: pushing a version tag builds, tests and packs that commit, pushes the package to nuget.org with trusted publishing and creates the GitHub release.
  • (BREAKING) Requires Microsoft.AspNet.Razor 3.3.0 (3.x maintenance release, the parser is unchanged since 3.2.3, so template syntax is unchanged from the 3.x net45 build). ASP.NET MVC 5.2.x only allows Razor below 3.3.0: apps using MVC have to update to Microsoft.AspNet.Mvc 5.3.0 (and Microsoft.AspNet.WebPages 3.3.0) to install this package, otherwise NuGet reports a version conflict (NU1107).
  • (PACKAGING) Depend on System.Security.Cryptography.X509Certificates 4.3.2 instead of the 4.1.0 pulled in by Roslyn. NuGet audit flags 4.1.0 for CVE-2017-11770, which only affects .NET Core, not .NET Framework; the pin keeps the audit warning away from consumers.
  • (BUILD) Tests use NUnit 5 (constraint model asserts), Moq 4.21 and Autofac 9; RazorEngine.Mvc uses Microsoft.AspNet.Mvc 5.3.0. Package versions are managed centrally in src/Directory.Packages.props.

NuGet: https://www.nuget.org/packages/RazorEngine.NetFramework/4.0.0

Assets 4
Loading