Aspnetcore.docs: Samples that require attention for Microsoft Security Advisories

[guardrex]

@Rick-Anderson @scottaddie

https://github.com/aspnet/Announcements/issues/284
https://github.com/aspnet/Announcements/issues/285

I searched on a couple of the files from the list of those that require changes to get a handle on how many samples are affected. Here's the list that was generated:

• [x] security\authentication\identity\sample\src\ASPNETCore-IdentityDemoComplete
• [x] security\authorization\resourcebased\samples\ResourceBasedAuthApp2
• [x] security\authentication\accconfirm\sample\WebPW
• [ ] migration\1x-to-2x\samples\AspNetCoreDotNetFx2.0App\AspNetCoreDotNetFx2.0App
• [x] security\authorization\secure-data\samples\starter
• [x] security\authorization\secure-data\samples\final
• [x] security\authentication\identity\sample\src\ASPNET-IdentityDemo
• [ ] security\authentication\identity-custom-storage-providers\sample\CustomIdentityProviderSample
• [x] security\authentication\accconfirm\sample\WebApp1
• [ ] security\authentication\2fa\sample\Web2FA
• [ ] migration\1x-to-2x\samples\AspNetCoreDotNetCore2App\AspNetCoreDotNetCore2App
• [ ] migration\1x-to-2x\samples\AspNetCoreDotNetCore1App\AspNetCoreDotNetCore1App
• [x] fundamentals\localization\sample\Localization
• [ ] common\samples\WebApplication1
• [ ] security\authorization\policies\samples\PoliciesAuthApp1
• [ ] security\authorization\resourcebased\samples\ResourceBasedAuthApp1

Since I only searched two files, that might not be a complete list. However, it gives a rough idea of the number of projects that require attention.

[EDIT] May want to assess this for update at the same time: https://github.com/aspnet/templating/issues/226

[EDIT] Steps to update samples where template code isn't modified. 5 -> 285
MVC

Replace:
Controllers\ManageController.cs 5 4
Models\ManageViewModels\EnableAuthenticatorViewModel.cs 5
Views\Manage\EnableAuthenticator.cshtml 5
Views\Manage\GenerateRecoveryCodes.cshtml 5
Views\Manage\TwoFactorAuthentication.cshtml 5 4

Add:
\Models\ManageViewModels\ShowRecoveryCodesViewModel.cs 4
Views\Manage\ShowRecoveryCodes.cshtml 5 4

Delete:
Models\ManageViewModels\generateRecoveryCodesViewModel.cs 5 4

------------ Razor Pages -------------------

Replace:
Pages\Account\Manage\EnableAuthenticator.cshtml 5 4
Pages\Account\Manage\EnableAuthenticator.cshtml.cs 5 4
Pages\Account\Manage\GenerateRecoveryCodes.cshtml 4
Pages\Account\Manage\GenerateRecoveryCodes.cshtml.cs 4

Add:
Pages\Account\Manage\ShowRecoveryCodes.cshtml 4
Pages\Account\Manage\ShowRecoveryCodes.cshtml.cs 4

[kevinchalet]

You may also want to revamp https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity-enable-qrcodes#adding-qr-codes-to-the-2fa-configuration-page and remove the last paragraph of https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity-enable-qrcodes#using-a-different-qr-code-library as it recommends using Html.Raw for invalid reasons (which is double-terribad :sweat_smile:)

[Rick-Anderson]

@guardrex

May want to assess this for update at the same time: aspnet/templating#226

Using the replacement approach I suggest fixes this. This issue is too big for one PR so breaking up.

[hishamco]

@guardrex seems fundamentals\localization\sample\Localization item need to be checked after the Microsoft.AspNetCore.All package has been upgraded to 2.0.9 in all of the localization samples

[guardrex]

It's on the sample update tracking issue for 2.2, but I don't know when (or who) will get to it.

https://github.com/aspnet/Docs/issues/5495

[hishamco]

I already finalized the localization sample there, but i'm not sure why the localization checkbox item above is still unchecked?

[guardrex]

need to be checked

Oh! lol ... sorry. I thought you were saying that someone needs to check the sample app. I didn't know that you were talking about the checkbox. :smile: ... I just checked the box above. Thanks.

[hishamco]

Thanks