Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Manual updates 20240502 security wave 1 #883

Open
wants to merge 31 commits into
base: main
Choose a base branch
from
Open

Manual updates 20240502 security wave 1 #883

Changes from all commits
Commits
Show all changes
31 commits
Select commit Hold shift + click to select a range
c1d74ae
added SAST tool .NET Security Guard PackageReference Include="Securit…
moljac May 3, 2024
9c7a666
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac May 9, 2024
24bbaf1
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac May 16, 2024
1c0a784
automatic files
moljac May 19, 2024
f0b7f98
NugetAudit added
moljac May 19, 2024
2d4f35a
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Jun 3, 2024
e3d25b2
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Jun 7, 2024
f00b4b0
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Jun 11, 2024
b0c5dc8
automatic files
moljac Jun 12, 2024
b8b5e1c
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Jun 20, 2024
307217b
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Jul 8, 2024
a9cce16
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Jul 30, 2024
9b37b70
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Oct 3, 2024
70a6592
template fixes
moljac Oct 7, 2024
7ac37b1
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Oct 7, 2024
bab4dbc
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Oct 9, 2024
355cf0b
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Oct 10, 2024
dff88de
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Oct 13, 2024
fdf2d96
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Oct 22, 2024
ef8593d
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Oct 23, 2024
55194d2
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Oct 26, 2024
b57f390
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Nov 4, 2024
935293a
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Nov 6, 2024
0f5bd8c
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Nov 8, 2024
c850cdd
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Nov 12, 2024
0accd20
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Nov 14, 2024
4092dd2
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Nov 21, 2024
fd0e3c2
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Dec 17, 2024
cc6912f
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Dec 19, 2024
3e67472
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Jan 9, 2025
bc20358
Merge branch 'main' into mu-20240502-security-wave-sast-security-code…
moljac Jan 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions source/AndroidXProject.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,11 @@
}
</PropertyGroup>

<PropertyGroup>
<NuGetAuditMode>all</NuGetAuditMode>
<NuGetAuditLevel>moderate</NuGetAuditLevel>
</PropertyGroup>

<!-- NuGet package properties -->
<PropertyGroup>
<PackageId>@(Model.NuGetPackageId)</PackageId>
Expand Down Expand Up @@ -164,4 +169,11 @@

@{ await IncludeAsync("source/_PackageLevelCustomizations.cshtml", Model); }

<ItemGroup>
<PackageReference Include="SecurityCodeScan.VS2019" Version="5.6.7">
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From Discord:

It is for Nuget Auditing only, though I tried to add SAST nuget but it causes some issues I need to check.

If this is true, then let's not add this package.

Copy link
Contributor

@jpobst jpobst Oct 7, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also note that our pipeline(s) already run the CodeQL static code analysis tool recommended and required by Microsoft security. We should likely rely on their expertise rather than trying to come up with our own solution here.

https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=10305045&view=logs&j=784e4eae-0a8d-50ee-7be1-df4337debdeb&t=fbdff2d1-992e-564e-2a8b-113c89c83f2b

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this is true, then let's not add this package.

I pushed to see whether the same problems can be reproduced on CI, but CI built OK. Now I know that updates borked my workloads locally. I had to nuke dotnet installations completely and after clean installation and workloads everything was OK.

<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
</PackageReference>
</ItemGroup>

</Project>