swagger-api / swagger-api/swagger-codegen
Swagger Codegen C# Generator References Vulnerable version of newtonsoft
Nobody has claimed this yet.
- Dominant language
- Mustache
- Stars
- 17.8k
- Forks
- 6k
- PR merge metrics
- No merged PRs in 30d
Description
Description
https://github.com/swagger-api/swagger-codegen/blob/master/modules/swagger-codegen/src/main/resources/csharp/Project.mustache
The mustache files reference a vulnerable version of Newtonsoft
https://github.com/advisories/GHSA-5crp-9r3c-p9vr
Swagger-codegen version
N/a, as this involves the mustache files
Swagger declaration file content or url
N/a, as this involves the mustache files
Command line used for generation
N/a, as this involves the mustache files
Steps to reproduce
Regenerate any C# files from the csharp generator or look at the Mustache files. The files reference a vulnerable version of newtonsoft
Related issues/PRs
N/a
Suggest a fix/enhancement
Upgrade to Newtonsoft.Json v13.x
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with modules/swagger-codegen/src/main/resources/csharp/Project.mustache and inspect the C# mustache templates for the referenced Newtonsoft.Json version. Update the vulnerable reference to version 13.x, then regenerate C# output or inspect the generated dependency to confirm the new version is used.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100