17.4 security update #8049
Merged
17.4 security update #8049
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
On Linux, the default /tmp folder is shared across all users and accessible by them. There are some cases in which we put sensitive information in temp and assume it's fine because on Windows, it is. This doesn't actually fix that assumption, since we're currently waiting for a new API that will be introduced in .NET 7 that will make a folder with appropriate permissions. However, this PR changes all the issues Eric Erhardt identified such that they go through a single code path, so to fix the security issue afterwards just requires changing the one place in our code. It did occur to me that we may not be able to use that API, in which case I can just write something to make a folder with a random name under temp then tweak its permissions.
rainersigwald
force-pushed
the
17.4-security-update
branch
from
c478a85
to
6521b15
Compare
rainersigwald
approved these changes
Oct 11, 2022
This was referenced Jan 25, 2023
Forgind
added a commit
that referenced
this pull request
Jan 26, 2023
(Copied from #8351) Fixes AB#1678521 Context #8049 broke the temp filtering logic by using the MSBuild-specific temp path instead of the true base temp path. This manifests as an overbuild of some C++ projects. Changes Made Reverted the change. Enabled relevant unit tests. Testing Existing unit tests and a C++ end-to-end repro. Notes The rest of FileTracker tests cannot be enabled without significant work (related to #649).
Forgind
added a commit
that referenced
this pull request
Feb 7, 2023
(Copied from #8351) Fixes AB#1678521 Context #8049 broke the temp filtering logic by using the MSBuild-specific temp path instead of the true base temp path. This manifests as an overbuild of some C++ projects. Changes Made Reverted the change. Enabled relevant unit tests. Testing Existing unit tests and a C++ end-to-end repro. Notes The rest of FileTracker tests cannot be enabled without significant work (related to #649).
Forgind
added a commit
that referenced
this pull request
Feb 13, 2023
Fixes AB#1678521 Context #8049 broke the temp filtering logic by using the MSBuild-specific temp path instead of the true base temp path. This manifests as an overbuild of some C++ projects. Changes Made Reverted the change. Enabled relevant unit tests. Testing Existing unit tests and a C++ end-to-end repro. Notes The rest of FileTracker tests cannot be enabled without significant work (related to #649).
JaynieBai
pushed a commit
that referenced
this pull request
Feb 14, 2023
Fixes AB#1678521 Context #8049 broke the temp filtering logic by using the MSBuild-specific temp path instead of the true base temp path. This manifests as an overbuild of some C++ projects. Changes Made Reverted the change. Enabled relevant unit tests. Testing Existing unit tests and a C++ end-to-end repro. Notes The rest of FileTracker tests cannot be enabled without significant work (related to #649).
JanKrivanek
added a commit
that referenced
this pull request
Apr 26, 2023
commit 81da5a2 Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed Apr 26 10:17:54 2023 -0700 [vs17.2] Temporary turn off static graph restore. (#8697) Turn off static graph restore. (Backport of #8498 to vs17.2) commit 872ddd9 Merge: 94fcedf 6faa1d5 Author: Forgind <12969783+Forgind@users.noreply.github.com> Date: Mon Feb 13 07:30:47 2023 -0800 Merge pull request #8419 from Forgind/fix-temp-file-filtering-17.2 Fixes AB#1678521 Context #8049 broke the temp filtering logic by using the MSBuild-specific temp path instead of the true base temp path. This manifests as an overbuild of some C++ projects. Changes Made Reverted the change. Enabled relevant unit tests. Testing Existing unit tests and a C++ end-to-end repro. Notes The rest of FileTracker tests cannot be enabled without significant work (related to #649). commit 6faa1d5 Merge: 94fcedf 2fdde65 Author: Forgind <Forgind@users.noreply.github.com> Date: Tue Feb 7 14:56:15 2023 -0800 Merge branch 'vs17.0' of https://github.com/dotnet/msbuild into vs17.2 commit 2fdde65 Author: Forgind <12969783+Forgind@users.noreply.github.com> Date: Tue Feb 7 09:06:10 2023 -0800 Fix temp file filtering in FileTracker (#8352) (Copied from #8351) Fixes AB#1678521 Context #8049 broke the temp filtering logic by using the MSBuild-specific temp path instead of the true base temp path. This manifests as an overbuild of some C++ projects. Changes Made Reverted the change. Enabled relevant unit tests. Testing Existing unit tests and a C++ end-to-end repro. Notes The rest of FileTracker tests cannot be enabled without significant work (related to #649).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #
Context
Changes Made
Testing
Notes