dotnet / dotnet/aspnetcore

Potentially unsound trimming suppression in DefaultAntiforgeryStateProvider

Open
#50,536 4 comments 0 reactions 0 assignees View on GitHub
area-blazor feature-trimming Pillar: Technical Debt Priority:2 task
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

https://github.com/dotnet/aspnetcore/blob/f510d8655230143a3bbc20e756baa12a5333a0d9/src/Components/Shared/src/DefaultAntiforgeryStateProvider.cs#L14-L18

The justification for the trimmer warning suppression does not make sense to me. Yes, `PersistentComponentState`'s `PersistAsJson` and `TryTakeFromJson` are "already annotated." That's why it correctly raises a warning when the `DefaultAntiforgeryStateProvider` constructor calls these methods.

This might be okay if the static [JsonSerializerOptionsProvider.Options](https://github.com/dotnet/aspnetcore/blob/f510d8655230143a3bbc20e756baa12a5333a0d9/src/Components/Shared/src/JsonSerializerOptionsProvider.cs#L10) used by `PersistentComponentState` had a `TypeInfoResolver` backed by a `JsonSerializerContext` statically generated using `[JsonSerializable(typeof(AntiforgeryRequestToken))]`. Otherwise, don't we risk trimming the `AntiforgeryRequestToken` constructor which has no callers other indirectly via the `JsonSerializer` calls in `PersistentComponentState`?

Or better yet, we should probably update `PersistentComponentState` to use the `JsonOptions` in DI, and register its statically generated `JsonSerializerContext` with the `TypeInfoResolverChain` similar to what we do for [MapIdentityApi](https://github.com/dotnet/aspnetcore/blob/f510d8655230143a3bbc20e756baa12a5333a0d9/src/Identity/Core/src/IdentityEndpointsJsonOptionsSetup.cs#L15) and [ProblemDetails](https://github.com/dotnet/aspnetcore/blob/f510d8655230143a3bbc20e756baa12a5333a0d9/src/Http/Http.Extensions/src/ProblemDetailsJsonOptionsSetup.cs#L24).

@javiercn @eerhardt

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.