Skip to content

Fix CVE-2024-51417#870

Merged
StefH merged 8 commits into
masterfrom
bug/867
Jan 23, 2025
Merged

Fix CVE-2024-51417#870
StefH merged 8 commits into
masterfrom
bug/867

Conversation

@StefH

@StefH StefH commented Jan 22, 2025

Copy link
Copy Markdown
Collaborator
  • remove 'object' from PredefinedTypes
  • refactor DefaultDynamicLinqCustomTypeProvider so that only classes with DynamicLinqType annotation are resolved

- remove 'object' from PredefinedTypes
- refactor DefaultDynamicLinqCustomTypeProvider so that only classes with DynamicLinqType annotation are resolved
@StefH StefH added the bug label Jan 22, 2025
@StefH StefH self-assigned this Jan 22, 2025
Comment thread test/System.Linq.Dynamic.Core.Tests/SecurityTests.cs Outdated
@StefH
StefH marked this pull request as ready for review January 23, 2025 16:16
@StefH
StefH merged commit 49b6cf0 into master Jan 23, 2025
@StefH
StefH deleted the bug/867 branch January 23, 2025 16:22
@mhubis

mhubis commented Feb 11, 2025

Copy link
Copy Markdown

ResolveTypeBySimpleName's call to FindTypesMarkedWithDynamicLinqTypeAttribute is missing the union with AdditionalTypes. ResolveType makes the same call to FindTypesMarkedWithDynamicLinqTypeAttribute but does union with AdditionalTypes.

Can this be fixed?

@StefH

StefH commented Feb 11, 2025

Copy link
Copy Markdown
Collaborator Author

ResolveTypeBySimpleName's call to FindTypesMarkedWithDynamicLinqTypeAttribute is missing the union with AdditionalTypes. ResolveType makes the same call to FindTypesMarkedWithDynamicLinqTypeAttribute but does union with AdditionalTypes.

Can this be fixed?

Good point. I'm fixing it with: #896

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Development

Successfully merging this pull request may close these issues.

3 participants