Merge pull request #9272 from NuGet/dev

[ReleasePrep][2022.10.05] RI of dev into main
NuGet · Oct 5, 2022 · 214b162 · 214b162
2 parents 94499fd + 5e27c1e
commit 214b162
Show file tree

Hide file tree

Showing 13 changed files with 155 additions and 108 deletions.
diff --git a/CodeQL.yml b/CodeQL.yml
@@ -0,0 +1,6 @@
+path_classifiers:
+  library:
+    # The default behavior is to tag library code as `library`. Results are hidden 
+    # for library code. You can tag further files as being library code by adding them
+    # to the `library` section.
+    - "src/NuGetGallery/Scripts/gallery/moment-*.js"
diff --git a/src/DatabaseMigrationTools/DatabaseMigrationTools.csproj b/src/DatabaseMigrationTools/DatabaseMigrationTools.csproj
@@ -65,7 +65,7 @@
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
     <PackageReference Include="NuGet.Services.Validation">
-      <Version>2.105.0</Version>
+      <Version>2.106.0</Version>
     </PackageReference>
   </ItemGroup>
   <ItemGroup>

diff --git a/src/GitHubVulnerabilities2Db/GitHubVulnerabilities2Db.csproj b/src/GitHubVulnerabilities2Db/GitHubVulnerabilities2Db.csproj
@@ -91,7 +91,7 @@
       <Version>4.3.0-dev-5590084</Version>
     </PackageReference>
     <PackageReference Include="NuGet.Services.Cursor">
-      <Version>2.105.0</Version>
+      <Version>2.106.0</Version>
     </PackageReference>
   </ItemGroup>
   <ItemGroup>

diff --git a/src/NuGetGallery.Core/NuGetGallery.Core.csproj b/src/NuGetGallery.Core/NuGetGallery.Core.csproj
@@ -50,7 +50,7 @@
       <Version>6.0.0</Version>
     </PackageReference>
     <PackageReference Include="NuGet.Services.FeatureFlags">
-      <Version>2.105.0</Version>
+      <Version>2.106.0</Version>
     </PackageReference>
     <PackageReference Include="WindowsAzure.Storage">
       <Version>9.3.3</Version>
@@ -59,13 +59,13 @@
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net472'">
     <PackageReference Include="NuGet.Services.Messaging.Email">
-      <Version>2.105.0</Version>
+      <Version>2.106.0</Version>
     </PackageReference>
     <PackageReference Include="NuGet.Services.Validation">
-      <Version>2.105.0</Version>
+      <Version>2.106.0</Version>
     </PackageReference>
     <PackageReference Include="NuGet.Services.Validation.Issues">
-      <Version>2.105.0</Version>
+      <Version>2.106.0</Version>
     </PackageReference>
     <PackageReference Include="NuGet.StrongName.elmah.corelibrary">
       <Version>1.2.2</Version>

diff --git a/src/NuGetGallery.Core/Services/AssetFrameworkHelper.cs b/src/NuGetGallery.Core/Services/AssetFrameworkHelper.cs
@@ -0,0 +1,130 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using NuGet.Client;
+using NuGet.ContentModel;
+using NuGet.Frameworks;
+using NuGet.Packaging.Core;
+using NuGet.RuntimeModel;
+
+namespace NuGetGallery
+{
+    public static class AssetFrameworkHelper
+    {
+        /// <summary>
+        /// This method combines the logic used in restore operations to make a determination about the TFM supported by the package.
+        /// We have curated a set of compatibility requirements for our needs in NuGet.org. The client logic can be found here:
+        /// https://github.com/NuGet/NuGet.Client/blob/63255047fe7052cc33b763356ff995d9166f719e/src/NuGet.Core/NuGet.Commands/RestoreCommand/CompatibilityChecker.cs#L252-L294
+        /// https://github.com/NuGet/NuGet.Client/blob/63255047fe7052cc33b763356ff995d9166f719e/src/NuGet.Core/NuGet.Commands/RestoreCommand/CompatibilityChecker.cs#L439-L442
+        /// ...and our combination of these elements is below.
+        /// The logic is essentially this:
+        /// - Determine whether we're looking at a tools package. In this case we will use tools "pattern sets" (collections of file patterns
+        ///   defined in <see cref="ManagedCodeConventions" />) to assess which frameworks are targeted by the package.
+        /// - If this isn't a tools package, we look for build-time, runtime, content and resource file patterns
+        /// For added details on the various cases, see unit tests targeting this method.
+        /// </summary>
+        public static IEnumerable<NuGetFramework> GetAssetFrameworks(string packageId, IReadOnlyList<PackageType> packageTypes, IList<string> packageFiles)
+        {
+            var supportedTFMs = Enumerable.Empty<NuGetFramework>();
+            if (packageFiles != null && packageFiles.Any())
+            {
+                // Setup content items for analysis
+                var items = new ContentItemCollection();
+                items.Load(packageFiles);
+                var runtimeGraph = new RuntimeGraph();
+                var conventions = new ManagedCodeConventions(runtimeGraph);
+
+                // Let's test for tools packages first--they're a special case
+                var groups = Enumerable.Empty<ContentItemGroup>();
+                if (packageTypes.Count == 1 && (packageTypes[0] == PackageType.DotnetTool ||
+                                                packageTypes[0] == PackageType.DotnetCliTool))
+                {
+                    // Only a package that is a tool package (and nothing else) will be matched against tools pattern set
+                    groups = items.FindItemGroups(conventions.Patterns.ToolsAssemblies);
+                }
+                else
+                {
+                    // Gather together a list of pattern sets indicating the kinds of packages we wish to evaluate
+                    var patterns = new[]
+                    {
+                        conventions.Patterns.CompileRefAssemblies,
+                        conventions.Patterns.CompileLibAssemblies,
+                        conventions.Patterns.RuntimeAssemblies,
+                        conventions.Patterns.ContentFiles,
+                        conventions.Patterns.ResourceAssemblies,
+                    };
+
+                    // Add MSBuild to this list, but we need to ensure we have package assets before they make the cut.
+                    // A series of files in the right places won't matter if there's no {id}.props|targets.
+                    var msbuildPatterns = new[]
+                    {
+                        conventions.Patterns.MSBuildFiles,
+                        conventions.Patterns.MSBuildMultiTargetingFiles,
+                    };
+
+                    // We'll create a set of "groups" --these are content items which satisfy file pattern sets
+                    var standardGroups = patterns
+                        .SelectMany(p => items.FindItemGroups(p));
+
+                    // Filter out MSBuild assets that don't match the package ID and append to groups we already have
+                    var msbuildGroups = msbuildPatterns
+                        .SelectMany(p => items.FindItemGroups(p))
+                        .Where(g => HasBuildItemsForPackageId(g.Items, packageId));
+                    groups = standardGroups.Concat(msbuildGroups);
+                }
+
+                // Now that we have a collection of groups which have made it through the pattern set filter, let's transform them into TFMs
+                supportedTFMs = groups
+                    .SelectMany(p => p.Properties)
+                    .Where(pair => pair.Key == ManagedCodeConventions.PropertyNames.TargetFrameworkMoniker)
+                    .Select(pair => pair.Value)
+                    .Cast<NuGetFramework>()
+                    .Distinct();
+            }
+
+            return supportedTFMs;
+        }
+
+        private static bool HasBuildItemsForPackageId(IEnumerable<ContentItem> items, string packageId)
+        {
+            foreach (var item in items)
+            {
+                var fileName = Path.GetFileName(item.Path);
+                if (fileName == PackagingCoreConstants.EmptyFolder)
+                {
+                    return true;
+                }
+
+                if ($"{packageId}.props".Equals(fileName, StringComparison.OrdinalIgnoreCase))
+                {
+                    return true;
+                }
+
+                if ($"{packageId}.targets".Equals(fileName, StringComparison.OrdinalIgnoreCase))
+                {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+
+        /// <summary>
+        /// Framework Generation shortname identifiers used by the Search Service for framework filtering.
+        /// </summary>
+        public static class FrameworkGenerationIdentifiers
+        {
+            public const string Net = "net";
+
+            public const string NetFramework = "netframework";
+
+            public const string NetCoreApp = "netcoreapp";
+
+            public const string NetStandard = "netstandard";
+        }
+    }
+}
diff --git a/src/NuGetGallery.Services/NuGetGallery.Services.csproj b/src/NuGetGallery.Services/NuGetGallery.Services.csproj
@@ -88,10 +88,10 @@
       <Version>6.0.0</Version>
     </PackageReference>
     <PackageReference Include="NuGet.Services.Configuration">
-      <Version>2.105.0</Version>
+      <Version>2.106.0</Version>
     </PackageReference>
     <PackageReference Include="NuGet.Services.Logging">
-      <Version>2.105.0</Version>
+      <Version>2.106.0</Version>
     </PackageReference>
     <PackageReference Include="NuGet.StrongName.WebBackgrounder">
       <Version>0.2.0</Version>

diff --git a/src/NuGetGallery.Services/PackageManagement/PackageService.cs b/src/NuGetGallery.Services/PackageManagement/PackageService.cs
@@ -712,104 +712,14 @@ public virtual IEnumerable<NuGetFramework> GetSupportedFrameworks(PackageArchive
             return package.GetSupportedFrameworks();
         }
 
-        /// <summary>
-        /// This method combines the logic used in restore operations to make a determination about the TFM supported by the package.
-        /// We have curated a set of compatibility requirements for our needs in NuGet.org. The client logic can be found here:
-        /// https://github.com/NuGet/NuGet.Client/blob/63255047fe7052cc33b763356ff995d9166f719e/src/NuGet.Core/NuGet.Commands/RestoreCommand/CompatibilityChecker.cs#L252-L294
-        /// https://github.com/NuGet/NuGet.Client/blob/63255047fe7052cc33b763356ff995d9166f719e/src/NuGet.Core/NuGet.Commands/RestoreCommand/CompatibilityChecker.cs#L439-L442
-        /// ...and our combination of these elements is below.
-        /// The logic is essentially this:
-        /// - Determine whether we're looking at a tools package. In this case we will use tools "pattern sets" (collections of file patterns
-        ///   defined in <see cref="ManagedCodeConventions" />) to assess which frameworks are targeted by the package.
-        /// - If this isn't a tools package, we look for build-time, runtime, content and resource file patterns
-        /// For added details on the various cases, see unit tests targeting this method.
-        /// </summary>
         public virtual IEnumerable<NuGetFramework> GetSupportedFrameworks(NuspecReader nuspecReader, IList<string> packageFiles)
         {
-            var supportedTFMs = Enumerable.Empty<NuGetFramework>();
-            if (packageFiles != null && packageFiles.Any() && nuspecReader != null)
-            {
-                // Setup content items for analysis
-                var items = new ContentItemCollection();
-                items.Load(packageFiles);
-                var runtimeGraph = new RuntimeGraph();
-                var conventions = new ManagedCodeConventions(runtimeGraph);
-
-                // Let's test for tools packages first--they're a special case
-                var groups = Enumerable.Empty<ContentItemGroup>();
-                var packageTypes = nuspecReader.GetPackageTypes();
-                if (packageTypes.Count == 1 && (packageTypes[0] == PackageType.DotnetTool ||
-                                                packageTypes[0] == PackageType.DotnetCliTool))
-                {
-                    // Only a package that is a tool package (and nothing else) will be matched against tools pattern set
-                    groups = items.FindItemGroups(conventions.Patterns.ToolsAssemblies);
-                }
-                else
-                {
-                    // Gather together a list of pattern sets indicating the kinds of packages we wish to evaluate
-                    var patterns = new[]
-                    {
-                        conventions.Patterns.CompileRefAssemblies,
-                        conventions.Patterns.CompileLibAssemblies,
-                        conventions.Patterns.RuntimeAssemblies,
-                        conventions.Patterns.ContentFiles,
-                        conventions.Patterns.ResourceAssemblies,
-                    };
-
-                    // Add MSBuild to this list, but we need to ensure we have package assets before they make the cut.
-                    // A series of files in the right places won't matter if there's no {id}.props|targets.
-                    var msbuildPatterns = new[]
-                    {
-                        conventions.Patterns.MSBuildFiles,
-                        conventions.Patterns.MSBuildMultiTargetingFiles,
-                    };
-
-                    // We'll create a set of "groups" --these are content items which satisfy file pattern sets
-                    var standardGroups = patterns
-                        .SelectMany(p => items.FindItemGroups(p));
-
-                    // Filter out MSBuild assets that don't match the package ID and append to groups we already have
-                    var packageId = nuspecReader.GetId();
-                    var msbuildGroups = msbuildPatterns
-                        .SelectMany(p => items.FindItemGroups(p))
-                        .Where(g => HasBuildItemsForPackageId(g.Items, packageId));
-                    groups = standardGroups.Concat(msbuildGroups);
-                }
-
-                // Now that we have a collection of groups which have made it through the pattern set filter, let's transform them into TFMs
-                supportedTFMs = groups
-                    .SelectMany(p => p.Properties)
-                    .Where(pair => pair.Key == ManagedCodeConventions.PropertyNames.TargetFrameworkMoniker)
-                    .Select(pair => pair.Value)
-                    .Cast<NuGetFramework>()
-                    .Distinct();
-            }
-
-            return supportedTFMs;
-        }
-
-        private static bool HasBuildItemsForPackageId(IEnumerable<ContentItem> items, string packageId)
-        {
-            foreach (var item in items)
+            if (nuspecReader != null)
             {
-                var fileName = Path.GetFileName(item.Path);
-                if (fileName == PackagingCoreConstants.EmptyFolder)
-                {
-                    return true;
-                }
-
-                if ($"{packageId}.props".Equals(fileName, StringComparison.OrdinalIgnoreCase))
-                {
-                    return true;
-                }
-
-                if ($"{packageId}.targets".Equals(fileName, StringComparison.OrdinalIgnoreCase))
-                {
-                    return true;
-                }
+                return AssetFrameworkHelper.GetAssetFrameworks(nuspecReader.GetId(), nuspecReader.GetPackageTypes(), packageFiles);
             }
 
-            return false;
+            return Enumerable.Empty<NuGetFramework>();
         }
 
         private static EmbeddedLicenseFileType GetEmbeddedLicenseType(PackageMetadata packageMetadata)

diff --git a/src/NuGetGallery/NuGetGallery.csproj b/src/NuGetGallery/NuGetGallery.csproj
@@ -2244,13 +2244,13 @@
       <Version>1.4.0</Version>
     </PackageReference>
     <PackageReference Include="NuGet.Services.Licenses">
-      <Version>2.105.0</Version>
+      <Version>2.106.0</Version>
     </PackageReference>
     <PackageReference Include="NuGet.Services.Owin">
-      <Version>2.105.0</Version>
+      <Version>2.106.0</Version>
     </PackageReference>
     <PackageReference Include="NuGet.Services.Sql">
-      <Version>2.105.0</Version>
+      <Version>2.106.0</Version>
     </PackageReference>
     <PackageReference Include="Owin">
       <Version>1.0.0</Version>

diff --git a/src/NuGetGallery/Scripts/gallery/autocomplete.js b/src/NuGetGallery/Scripts/gallery/autocomplete.js
@@ -187,7 +187,7 @@
     }
 
     function jquerySafeId(id) {
-        return id.replace(/\./g, "\\.");
+        return jQuery.escapeSelector(id);
     }
 
     function safeId(id) {

diff --git a/src/NuGetGallery/Services/CertificateService.cs b/src/NuGetGallery/Services/CertificateService.cs
@@ -60,6 +60,7 @@ public async Task<Certificate> AddCertificateAsync(HttpPostedFileBase file)
                     certificate = new Certificate()
                     {
 #pragma warning disable CS0618 // Only set the SHA1 thumbprint, for backwards compatibility. Never read it.
+                        // CodeQL [SM02196] Only set the SHA1 thumbprint, for backwards compatibility. Never read it.
                         Sha1Thumbprint = certificateFile.Sha1Thumbprint,
 #pragma warning restore CS0618
                         Thumbprint = certificateFile.Sha256Thumbprint,

diff --git a/src/NuGetGallery/ViewModels/ThirdPartyPackageManagerViewModel.cs b/src/NuGetGallery/ViewModels/ThirdPartyPackageManagerViewModel.cs
@@ -19,7 +19,7 @@ public ThirdPartyPackageManagerViewModel(string name, string contactUrl) : base(
         {
             ContactUrl = contactUrl;
             AlertLevel = AlertLevel.Warning;
-            AlertMessage = "The NuGet Team does not provide support for this client. Please contact its "
+            AlertMessage = "<b display=\"none\" aria-label=\"warning\"></b> The NuGet Team does not provide support for this client. Please contact its "
                 + $"<a href=\"{contactUrl}\" aria-label=\"Contact the maintainers of the {name} client\">maintainers</a> for support.";
         }
     }

diff --git a/src/NuGetGallery/Web.config b/src/NuGetGallery/Web.config
@@ -609,7 +609,7 @@
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31BF3856AD364E35" culture="neutral"/>
-        <bindingRedirect oldVersion="0.0.0.0-4.1.1.0" newVersion="4.1.1.0"/>
+        <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0"/>
       </dependentAssembly>
       <dependentAssembly>
         <assemblyIdentity name="System.Net.Http.Primitives" publicKeyToken="B03F5F7F11D50A3A" culture="neutral"/>

diff --git a/tests/Scripts/Import-Configuration.ps1 b/tests/Scripts/Import-Configuration.ps1
@@ -7,7 +7,7 @@ param (
     [Parameter(Mandatory=$true)][string]$Branch = "master",
     [Parameter(Mandatory=$true)][ValidateSet("production", "staging")][string]$Slot = "production",
     [Parameter(Mandatory=$true)][ValidateSet("Dev", "Int", "Prod")][string]$Environment,
-    [Parameter(Mandatory=$true)][ValidateSet("USNC", "USSC", "USNC-PREVIEW", "USSC-PREVIEW")][string]$Region
+    [Parameter(Mandatory=$true)][ValidateSet("USNC", "USSC", "USNC-PREVIEW", "USSC-PREVIEW", "USNC-ASE", "USSC-ASE")][string]$Region
 )
 
 Write-Host "Importing configuration for Gallery Functional tests on $Environment $Region"