Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

[release/9.0] Harden parsing of [Range] attribute values - #59077

#59077
Merged
wtgodbe merged 1 commit into
release/9.0dotnet/aspnetcore:release/9.0from
backport/pr-59043-to-release/9.0dotnet/aspnetcore:backport/pr-59043-to-release/9.0Copy head branch name to clipboard
Nov 27, 2024
Merged

[release/9.0] Harden parsing of [Range] attribute values#59077
wtgodbe merged 1 commit into
release/9.0dotnet/aspnetcore:release/9.0from
backport/pr-59043-to-release/9.0dotnet/aspnetcore:backport/pr-59043-to-release/9.0Copy head branch name to clipboard

Conversation

@github-actions

@github-actions github-actions Bot commented Nov 20, 2024

Copy link
Copy Markdown
Contributor

Backport of #59043 to release/9.0

/cc @captainsafia

Description

This change hardens the parsing logic for [Range] attributes to handle:

  • Values that cannot be mapped to a decimal as is required by the minimum and maximum keywords in the OpenAPI schema, like DateTime.
  • Handling for InvariantCulture as is set in RangeAttribute.ParseLimitsInInvariantCulture.

For scenarios where the range value is too large to be represented as a decimal, this implementation will no-op and not set the corresponding minimum or maximum in the OpenAPI document.

Fixes #57390

Customer Impact

Prevents unhandled exceptions when customers use the Range(object, object) overloads of the Range attribute instead of those that take a double/integer. There's no immediate workarounds for this bug outside of removing the attribute.

Regression?

  • Yes
  • No

Risk

  • High
  • Medium
  • Low

Change localized to Range attribute handling in OpenAPI package.

Verification

  • Manual (required)
  • Automated

Packaging changes reviewed?

  • Yes
  • No
  • N/A

@github-actions
github-actions Bot requested review from a team and captainsafia as code owners November 20, 2024 16:30
@ghost ghost added the area-mvc Includes: MVC, Actions and Controllers, Localization, CORS, most templates label Nov 20, 2024
@dotnet-policy-service dotnet-policy-service Bot added this to the 9.0.x milestone Nov 20, 2024

@captainsafia captainsafia left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good bot! 🤖

@captainsafia captainsafia added Servicing-consider Shiproom approval is required for the issue Servicing-approved Shiproom has approved the issue and removed Servicing-consider Shiproom approval is required for the issue labels Nov 27, 2024
@captainsafia

Copy link
Copy Markdown
Contributor

Approved via email.

@wtgodbe
wtgodbe merged commit 198cf83 into release/9.0 Nov 27, 2024
@wtgodbe
wtgodbe deleted the backport/pr-59043-to-release/9.0 branch November 27, 2024 20:30
@dotnet-policy-service dotnet-policy-service Bot modified the milestones: 9.0.x, 9.0.1 Nov 27, 2024
This was referenced Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area-mvc Includes: MVC, Actions and Controllers, Localization, CORS, most templates Servicing-approved Shiproom has approved the issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

Morty Proxy This is a proxified and sanitized view of the page, visit original site.