Newtonsoft and Layout Changes #142

marmegh · 2022-07-26T20:23:21Z

Updates

Added images for Sonar and For All Secure to the contributor list
Replaced WhiteSource contributor image with Mend.png reflecting name change
Layout updates and added java-sarif link
Newtonsoft.Json update to address Advisory: Improper Handling of Exceptional Conditions in Newtonsoft.Json. This includes updating Sarif.Multitool.Library to v3.0.0-beta1 (which directly implements the mitigation without updating to Newtonsoft 13.0) and Microsoft.ApplicationInsights.AspNetCore to 2.21.0.

Sarif.sdk

SARIF Package Release History (SDK, Driver, Converters, and Multitool)

3.0.0-beta1 Sdk | Driver | Converters | Multitool | Multitool Library

BUGFIX: Loosen Newtonsoft.JSON minimum version requirement to 6.0.8 (for .NET framework) or 9.0.1 (for all other compilations) for Sarif.Sdk. Sarif.Converts requires 8.0.1, minimally, for .NET framework compilations.
BUGFIX: Broaden set of supported .NET frameworks for compatibility reasons. Sarif.Sdk now supports net45 forward. Sarif.Driver and Sarif.WorkItems requires net461 due to other dependencies.
BUGFIX: Set default stack limit in Newtonsoft.JSON utilization (if JsonConvert.Defaults is not already configured) to address GitHub advisory GHSA-5crp-9r3c-p9vr.

v2.4.16 Sdk | Driver | Converters | Multitool | Multitool Library

FEATURE: Add max-file-size-in-kb argument that allows filtering scan targets by file size. #2494
BUGFIX: Fix false positive for SARIF1002.UrisMustBeValid for file URIs that omit the authority. #2501
DEPENDENCY BREAKING: SARIF now requires Newtonsoft.JSON 13.0.1. Updating Newtonsoft.Json to v13.0.1, Microsoft.Json.Schema to v1.1.5, Microsoft.Json.Pointer to v1.1.5, Microsoft.Azure.Kusto.Data to v10.0.3, Microsoft.NET.Test.Sdk to v17.4.0-preview-20220707-01, Microsoft.Extensions.Logging.ApplicationInsights to v.2.20.0, Microsoft.TeamFoundationServer.Client to v.16.170.0, Microsoft.Coyote to v.1.5.8 and Microsoft.Coyote.Test to v.1.5.8 in response to Advisory: Improper Handling of Exceptional Conditions in Newtonsoft.Json. #2504

marmegh · 2022-07-26T22:26:01Z

src/SarifWeb/SarifWeb.csproj

-    <PackageReference Include="Microsoft.ApplicationInsights.AspNetCore" Version="2.20.0" />
-    <PackageReference Include="Sarif.Multitool.Library" Version="2.4.14" />
+    <PackageReference Include="Microsoft.ApplicationInsights.AspNetCore" Version="2.21.0" />
+    <PackageReference Include="Sarif.Multitool.Library" Version="2.4.16" />


@EasyRhinoMSFT, do we need something other than this to update the Multitool package? #Resolved

Nope this should be it.
Note: using the Package Manager is the best way to go and ensures that everything is updated correctly.

Unfortunately, this approach doesn't work in most of the repos for this particular update. :(

What is the issue? I made the same change and it worked fine.

No issue, this thread started in a Teams chat. I think some of the context got lost.

EasyRhinoMSFT · 2022-07-26T22:27:24Z

src/SarifWeb/Views/Home/Index.cshtml

+            <img role="listitem" aria-label="Sonar" src="~/Images/Logos/Sonar.png" alt="Sonar" />
+        </a>
+        <a href="https://forallsecure.com/" target="_blank">
+            <img role="listitem" aria-label="For All Secure" src="~/Images/Logos/ForAllSecure.png" alt="For All Secure" />


For All Secure

This is one word, ForAllSecure #Closed

EasyRhinoMSFT · 2022-07-26T22:28:23Z

src/SarifWeb/Views/Home/Index.cshtml

-                <div class="tools-item-description tools-other-item-description"><a href="https://github.com/microsoft/sarif-js-sdk">Code and supporting files</a> for working with SARIF in JavaScript applications.</div>
+                <div class="tools-item-description tools-other-item-description">
+                    <a href="https://github.com/microsoft/sarif-js-sdk">Code and supporting files</a> for working with SARIF in JavaScript applications.
+                    </div>


[](http://example.com/codeflow?start=16&length=4)

Remove #Closed

EasyRhinoMSFT

michaelcfanning · 2022-08-04T22:08:14Z

.github/CODEOWNERS

michaelcfanning

might want to add cfaucon as a defensive measure. :) #Resolved

michaelcfanning · 2022-08-04T22:08:39Z

src/ReleaseHistory.md

@@ -1,5 +1,8 @@
 # SARIF Website Release History

+## **v1.0.1**
+- Updating contributors list/images, bump Sarif.Multitool.Library from 2.4.14 to 2.4.16, add link to java-sarif documentation. [#142](https://github.com/microsoft/sarif-website/pull/142)


contributors

Just curious, didn't we hear from Contrast Security that they'd be willing to be badged on the site?

Possibly, but to my knowledge they have not submitted the graphic for inclusion at this time. @EasyRhinoMSFT, have you heard from them at all?

michaelcfanning

marmegh added 5 commits June 30, 2022 12:29

Added images for new SARIF contributor organizations.

241b5e3

Removed images for organizations no longer contributing.

db1a96d

Layout updates and added java-sarif link.

5ee923c

logo update

05ae231

Add Mend and Newtonsoft updates.

eee40d9

marmegh requested review from michaelcfanning and EasyRhinoMSFT as code owners July 26, 2022 20:23

marmegh added 4 commits July 26, 2022 14:04

Update code owners.

38aee7e

Update release history

ff29cdc

Resolve merge conflicts

32318da

Fix merge error

63ae1ff

marmegh changed the title ~~Users/marmegh/june updates~~ Newtonsoft and Layout Changes Jul 26, 2022

Remove Eddy

e0aef4a

marmegh commented Jul 26, 2022

View reviewed changes

EasyRhinoMSFT reviewed Jul 26, 2022

View reviewed changes

marmegh added 2 commits July 26, 2022 17:07

PR feedback

e740e6a

Add component governance check

66bf453

EasyRhinoMSFT approved these changes Jul 27, 2022

View reviewed changes

Update Sarif.Multitool to v3.0.0-beta1

94f9ba5

EasyRhinoMSFT approved these changes Aug 4, 2022

View reviewed changes

michaelcfanning reviewed Aug 4, 2022

View reviewed changes

michaelcfanning approved these changes Aug 4, 2022

View reviewed changes

Added cfaucon as owner, too

cc46238

marmegh merged commit c203753 into main Aug 9, 2022

marmegh deleted the users/marmegh/JuneUpdates branch August 9, 2022 17:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Newtonsoft and Layout Changes #142

Newtonsoft and Layout Changes #142

marmegh commented Jul 26, 2022 •

edited

Loading

marmegh Jul 26, 2022 •

edited

Loading

EasyRhinoMSFT Jul 27, 2022

marmegh Jul 27, 2022

EasyRhinoMSFT Jul 27, 2022 •

edited

Loading

marmegh Jul 28, 2022

EasyRhinoMSFT Jul 26, 2022 •

edited

Loading

EasyRhinoMSFT Jul 26, 2022 •

edited

Loading

EasyRhinoMSFT left a comment

michaelcfanning Aug 4, 2022 •

edited by marmegh

Loading

michaelcfanning Aug 4, 2022

marmegh Aug 4, 2022

michaelcfanning left a comment

Newtonsoft and Layout Changes #142

Newtonsoft and Layout Changes #142

Conversation

marmegh commented Jul 26, 2022 • edited Loading

Updates

Sarif.sdk

SARIF Package Release History (SDK, Driver, Converters, and Multitool)

3.0.0-beta1 Sdk | Driver | Converters | Multitool | Multitool Library

v2.4.16 Sdk | Driver | Converters | Multitool | Multitool Library

marmegh Jul 26, 2022 • edited Loading

Choose a reason for hiding this comment

EasyRhinoMSFT Jul 27, 2022

Choose a reason for hiding this comment

marmegh Jul 27, 2022

Choose a reason for hiding this comment

EasyRhinoMSFT Jul 27, 2022 • edited Loading

Choose a reason for hiding this comment

marmegh Jul 28, 2022

Choose a reason for hiding this comment

EasyRhinoMSFT Jul 26, 2022 • edited Loading

Choose a reason for hiding this comment

EasyRhinoMSFT Jul 26, 2022 • edited Loading

Choose a reason for hiding this comment

EasyRhinoMSFT left a comment

Choose a reason for hiding this comment

michaelcfanning Aug 4, 2022 • edited by marmegh Loading

Choose a reason for hiding this comment

michaelcfanning Aug 4, 2022

Choose a reason for hiding this comment

marmegh Aug 4, 2022

Choose a reason for hiding this comment

michaelcfanning left a comment

Choose a reason for hiding this comment

marmegh commented Jul 26, 2022 •

edited

Loading

marmegh Jul 26, 2022 •

edited

Loading

EasyRhinoMSFT Jul 27, 2022 •

edited

Loading

EasyRhinoMSFT Jul 26, 2022 •

edited

Loading

EasyRhinoMSFT Jul 26, 2022 •

edited

Loading

michaelcfanning Aug 4, 2022 •

edited by marmegh

Loading