Potentially unsound trimming suppression in DefaultAntiforgeryStateProvider
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
https://github.com/dotnet/aspnetcore/blob/f510d8655230143a3bbc20e756baa12a5333a0d9/src/Components/Shared/src/DefaultAntiforgeryStateProvider.cs#L14-L18
The justification for the trimmer warning suppression does not make sense to me. Yes, `PersistentComponentState`'s `PersistAsJson` and `TryTakeFromJson` are "already annotated." That's why it correctly raises a warning when the `DefaultAntiforgeryStateProvider` constructor calls these methods.
This might be okay if the static [JsonSerializerOptionsProvider.Options](https://github.com/dotnet/aspnetcore/blob/f510d8655230143a3bbc20e756baa12a5333a0d9/src/Components/Shared/src/JsonSerializerOptionsProvider.cs#L10) used by `PersistentComponentState` had a `TypeInfoResolver` backed by a `JsonSerializerContext` statically generated using `[JsonSerializable(typeof(AntiforgeryRequestToken))]`. Otherwise, don't we risk trimming the `AntiforgeryRequestToken` constructor which has no callers other indirectly via the `JsonSerializer` calls in `PersistentComponentState`?
Or better yet, we should probably update `PersistentComponentState` to use the `JsonOptions` in DI, and register its statically generated `JsonSerializerContext` with the `TypeInfoResolverChain` similar to what we do for [MapIdentityApi](https://github.com/dotnet/aspnetcore/blob/f510d8655230143a3bbc20e756baa12a5333a0d9/src/Identity/Core/src/IdentityEndpointsJsonOptionsSetup.cs#L15) and [ProblemDetails](https://github.com/dotnet/aspnetcore/blob/f510d8655230143a3bbc20e756baa12a5333a0d9/src/Http/Http.Extensions/src/ProblemDetailsJsonOptionsSetup.cs#L24).
@javiercn @eerhardt
Contributor guide
Assessment
This issue has not been assessed yet.