Make MinLength required on GenerateParameterDefault
#13641
Conversation
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 13641Or
iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 13641" |
8dd5bb7 to
85e90fc
Compare
There was a problem hiding this comment.
Pull request overview
This PR enhances security by making the MinLength property on GenerateParameterDefault required and adding validation to prevent setting it to zero or negative values. This is a breaking change designed to prevent the generation of insecure zero-length passwords when developers forget to set this property.
Key changes:
- Made
MinLengthpropertyrequiredto enforce explicit specification - Added setter validation that throws
ArgumentOutOfRangeExceptionfor invalid values (≤ 0)
| get; | ||
| set | ||
| { | ||
| ArgumentOutOfRangeException.ThrowIfLessThanOrEqual(0, value); |
There was a problem hiding this comment.
The arguments to ArgumentOutOfRangeException.ThrowIfLessThanOrEqual are in the wrong order. The correct signature is ThrowIfLessThanOrEqual(value, other) which throws if value <= other.
Currently, this code passes (0, value) which throws if 0 <= value, meaning it would throw for any positive value (the opposite of the intended behavior). It should be ThrowIfLessThanOrEqual(value, 0) to throw when value <= 0.
| ArgumentOutOfRangeException.ThrowIfLessThanOrEqual(0, value); | |
| ArgumentOutOfRangeException.ThrowIfLessThanOrEqual(value, 0); |
| public required int MinLength | ||
| { | ||
| get; | ||
| set | ||
| { | ||
| ArgumentOutOfRangeException.ThrowIfLessThanOrEqual(0, value); | ||
| field = value; | ||
| } | ||
| } |
There was a problem hiding this comment.
The new validation logic for the MinLength property setter lacks test coverage. Consider adding tests to verify that:
- Setting
MinLengthto zero throwsArgumentOutOfRangeException - Setting
MinLengthto a negative value throwsArgumentOutOfRangeException - Setting
MinLengthto a positive value succeeds
These tests would be appropriate in the AddParameterTests.cs file where other GenerateParameterDefault tests exist.
85e90fc to
47a7a2f
Compare
Description
Marked
MinLengthas a required property, and make it throw if you try to set the Min Length to an invalid (zero/negative) value.Marking this property
requiredis a breaking change, however if you forget to set this value, it will currently generate an insecure password of length zero, which almost certainly a mistake.An alternative to avoid the breaking change would be to set a default value (e.g.
16).Fixes #10570
Checklist
<remarks />and<code />elements on your triple slash comments?doc-ideatemplatebreaking-changetemplatediagnostictemplate