Repository navigation
Merging internal commits for release/9.0 - #135728
Open
dotnet-release-bot[bot] wants to merge 31 commits into
Open
dotnet-release-bot[bot] wants to merge 31 commits into
dotnet-release-bot[bot] wants to merge 31 commits into
Conversation
… directory on Unix On Unix, we were using an incorrect default servicing directory of `opt/servicing` instead of `/opt/servicing`, resulting in resolution based on the relative path. This change fixes that constructed path and rejects servicing directories without the needed access permissions.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c86d8382-d8cb-4d8a-a5d5-b257d1f7124e
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c86d8382-d8cb-4d8a-a5d5-b257d1f7124e
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c86d8382-d8cb-4d8a-a5d5-b257d1f7124e
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c86d8382-d8cb-4d8a-a5d5-b257d1f7124e
Decode didn't merge attributes on .NET Framework, and we don't merge them in SignedCms, or in EnvelopedCms except on Windows.
#### AI description (iteration 1) #### PR Classification Bug fix to prevent proxy authentication credentials from being inadvertently sent to origin servers during HTTP redirects. #### PR Summary This PR fixes a security issue where proxy authentication headers were incorrectly forwarded to destination servers when following redirects. The fix ensures that `Proxy-Authorization` headers are cleared along with `Authorization` headers during redirects. - `RedirectHandler.cs`: Added clearing of `Proxy-Authorization` header alongside `Authorization` header during redirect handling - `HttpClientHandlerTest.Proxy.cs`: Added two test cases to verify proxy credentials are not leaked to origin servers during HTTP-to-HTTPS and HTTP-to-no-proxy redirects - `LoopbackProxyServer.cs`: Disabled auto-redirect on the outbound client to ensure the proxy correctly relays redirect responses back to clients <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Update MsQuic to 2.5.11-ci.156755675 ---- #### AI description (iteration 1) #### PR Classification Dependency update to upgrade the MsQuic package version from 2.5.10 to 2.5.11-ci.156755675. #### PR Summary This pull request updates the MsQuic Schannel dependency to a newer continuous integration build version. - `/eng/Versions.props`: Updated `MicrosoftNativeQuicMsQuicSchannelVersion` from 2.5.10 to 2.5.11-ci.156755675 <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…links during tar extraction #### AI description (iteration 1) #### PR Classification Security bug fix to prevent directory traversal vulnerabilities during tar extraction by implementing deferred symlink processing and enhanced validation of symlink targets containing relative parent references. #### PR Summary This PR adds comprehensive security measures to prevent malicious tar archives from using symlinks with relative parent paths (`..`) to write files outside the intended extraction directory. The fix introduces a deferred symlink mechanism where symlinks containing `..` are created as placeholder files during extraction and resolved after all entries are processed. - `TarFile.ExtractToDirectory.File.Tests.cs`: Added 16 new test cases covering symlink directory traversal attacks, deferred symlink processing, circular symlink handling, symlink depth limits, and various edge cases for validating that symlinks with `..` cannot escape the destination directory or follow chains that lead outside the extraction boundary. <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
#### AI description (iteration 1) #### PR Classification Dependency version updates and build infrastructure improvements. #### PR Summary This pull request updates numerous dependency versions across the repository, primarily upgrading toolset components (Arcade, Cecil, LLVM, XHarness, etc.) to newer versions. It also introduces new GitHub App-based authentication support for build pipelines and updates third-party license notices. - `/eng/Version.Details.xml` and `/eng/Versions.props`: Updated versions for Microsoft.DotNet.Cecil, Microsoft.DotNet.Arcade.Sdk, runtime packages, optimization packages, and numerous other dependencies to newer releases - `/eng/common/Get-GitHubAppToken.ps1` (new file) and `/eng/common/core-templates/steps/get-github-app-token.yml` (new file): Added GitHub App installation token minting functionality for Azure DevOps pipelines - `/eng/common/cross/toolchain.cmake`: Improved Tizen toolchain path detection to dynamically find version subdirectories - `/eng/common/core-templates/job/onelocbuild.yml`: Added Entra token acquisition and GitHub App authentication support for localization builds - `/THIRD-PARTY-NOTICES.TXT`: Updated zlib-ng license notice with improved formatting <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…eges/permissions Don't try changing permissions for globally visible directories and don't follow symlinks if someone deletes and recreates the directory before we can fix permissions #### Differences from .NET 10 - .NET 9 doesn't have user-scoped mutexes before this change ---- #### AI description (iteration 1) #### PR Classification Bug fix addressing security and race condition issues in shared memory directory creation and permission handling. #### PR Summary This PR fixes privilege and permission handling for shared mutex operations by addressing race conditions in directory creation and strengthening security checks. The changes replace symbolic link-vulnerable operations with safer alternatives and ensure proper permission validation. - `sharedmemory.cpp`: Replaced `stat()` with `lstat()` to prevent symbolic link attacks and ensure proper directory validation - `sharedmemory.cpp`: Changed `chmod()` to `fchmod()` on file descriptors opened with `O_NOFOLLOW | O_DIRECTORY` flags to eliminate race conditions during permission setting - `sharedmemory.cpp`: Simplified permission checking logic to strictly enforce required permissions mask and fail immediately if conditions are not met - `sharedmemory.cpp`: Introduced differentiated permission masks (`PermissionsMask_CurrentUser_ReadWriteExecute` for system directories, `PermissionsMask_AllUsers_ReadWriteExecute` for others) <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…er`, controllable via a new feature switch #### AI description (iteration 1) #### PR Classification Bug fix / security hardening: adds maximum depth enforcement to `CborReader` to prevent stack overflow from deeply nested CBOR data, with a configurable AppContext switch. #### PR Summary Introduces a default max nesting depth of 64 for `CborReader`, configurable via the `System.Formats.Cbor.CborReader.MaxDepth` AppContext switch, and throws `CborContentException` when the depth is exceeded. - `CborReader.cs`: Adds `GetMaxDepth()`, `EnsureMaxDepthNotExceeded()`, and `s_maxDepth` static field with default value 64, configurable via AppContext. - `CborReader.Array.cs` and `CborReader.Map.cs`: Add depth check calls in `ReadStartArray` and `ReadStartMap`. - `CborReader.String.cs`: Adds depth checks in indefinite-length byte/text string reading paths. - `Strings.resx`: Adds new error message `Cbor_Reader_MaximumDepthExceeded`. - Tests updated/added in `CborReaderTests.cs` and `CborReaderTests.SkipValue.cs` to validate default and configurable max depth behavior, replacing prior overflow test with `RemoteExecutor`-based test using the new switch. <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…dle permissions itself If a user tries to run a .NET process with `sudo` in a Docker container, named mutexes would be created/modified in the root's `HOME` directory, which may have different permissions than 0700. Don't block this as the SB depends on this being allowed for SB Validation. ---- #### AI description (iteration 1) #### PR Classification Code cleanup / permission handling change: removes explicit ownership and permission validation for shared memory directories used by shared mutexes, delegating enforcement to the filesystem. #### PR Summary This PR removes manual `fstat`-based ownership and permission checks in shared memory directory handling, letting the filesystem itself enforce access control instead. - `sharedmemory.cpp`: Removed the `validateDirectory` lambda and its invocation calls in `EnsurePersistedUserDirectoryExists`, eliminating explicit uid/permission validation of the home and shared directories. - `sharedmemory.cpp` (`EnsureDirectoryExists`): Removed `fstat`-based checks for directory ownership and permission mask, simplifying the function to directly return the directory file descriptor. - Removed related error reporting and retry/cleanup logic tied to failed permission validation. <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Update MsQuic to 2.5.11-ci-159417053 ---- #### AI description (iteration 1) #### PR Classification Dependency version update. #### PR Summary Updates the MsQuic package version to a newer CI build. - `eng/Versions.props`: bumped `MicrosoftNativeQuicMsQuicSchannelVersion` from `2.5.11-ci.156755675` to `2.5.11-ci.159417053`. <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…-merge-9.0-2026-10-13-2152
|
Azure Pipelines: Successfully started running 4 pipeline(s). 12 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
dotnet-policy-service
Bot
added
the
community-contribution
Contributor
|
Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security |
Fixes #135880 main PR #135749 <!-- Give a brief summary of the issue and how the pull request is fixing it. --> Updates the public release/9.0 servicing branch to use the publicly available MsQuic 2.5.12 package. This completes the private-to-public security servicing handoff so internal-to-public merges do not retain the private `2.5.11-ci.159417053` identifier that public CI cannot restore. <!-- What is the impact to customers of not taking this fix? --> Public release/9.0 builds fail restore with NU1603 because the private MsQuic servicing package is unavailable to public CI, blocking clean servicing builds. <!-- Is this fixing a problem that was introduced in the most recent release, ie., fixing a regression? --> This is not a product-code regression. The failure occurs during the post-disclosure dependency handoff from private MSRC bits to the corresponding public package. <!-- What kind of testing has been done with the fix. --> Passed: ```console .\dotnet.cmd restore .\src\libraries\System.Net.Quic\src\System.Net.Quic.csproj /p:TargetOS=windows /p:TargetArchitecture=x64 --no-cache ``` The restore resolved MsQuic 2.5.12 without NU1603. <!-- Please assess the risk of taking this fix. Provide details backing up your assessment. --> Low. This is a one-line patch-version dependency update to the public servicing package, with no managed-code changes. Full functional testing is delegated to CI. IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version. Keep in mind that we still need package authoring in .NET 8 and older versions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b0b9c360-7d5d-4fdc-bede-48036e9dd9b7 (cherry picked from commit 3b202ff)
ViveliDuCh
force-pushed
the
internal-merge-9.0-2026-10-13-2152
branch
from
October 16, 2026 16:03
5c138bf to
9347ebe
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.