Vulnerabilities Detected

[drma-tech]

[Jericho]

@Pathoschild have you had time to look into this issue?

I can confirm that Visual Studio is reporting vulnerabilities when opening the solution:

More specifically:

Warning	NU1903	Package 'Microsoft.NETCore.App' 1.1.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-7mfr-774f-w5r9	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1903	Package 'Microsoft.NETCore.App' 1.1.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-8884-xcr4-r68p	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1903	Package 'Microsoft.NETCore.App' 2.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-7mfr-774f-w5r9	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1701	Package 'NUnit3TestAdapter 4.3.1' was restored using '.NETFramework,Version=v4.6.1, .NETFramework,Version=v4.6.2, .NETFramework,Version=v4.7, .NETFramework,Version=v4.7.1, .NETFramework,Version=v4.7.2, .NETFramework,Version=v4.8, .NETFramework,Version=v4.8.1' instead of the project target framework '.NETCoreApp,Version=v2.0'. This package may not be fully compatible with your project.	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Error	NU1202	Package Microsoft.AspNet.WebUtilities 1.0.0-rc1-final is not compatible with netcoreapp1.1 (.NETCoreApp,Version=v1.1). Package Microsoft.AspNet.WebUtilities 1.0.0-rc1-final supports:
  - dotnet54 (.NETPlatform,Version=v5.4)
  - net451 (.NETFramework,Version=v4.5.1)	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1903	Package 'Microsoft.NETCore.App' 1.1.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-7mfr-774f-w5r9	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1903	Package 'Microsoft.NETCore.App' 1.1.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-8884-xcr4-r68p	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1903	Package 'Microsoft.NETCore.App' 2.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-7mfr-774f-w5r9	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1701	Package 'NUnit3TestAdapter 4.3.1' was restored using '.NETFramework,Version=v4.6.1, .NETFramework,Version=v4.6.2, .NETFramework,Version=v4.7, .NETFramework,Version=v4.7.1, .NETFramework,Version=v4.7.2, .NETFramework,Version=v4.8, .NETFramework,Version=v4.8.1' instead of the project target framework '.NETCoreApp,Version=v2.0'. This package may not be fully compatible with your project.	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Error	NU1202	Package Microsoft.AspNet.WebUtilities 1.0.0-rc1-final is not compatible with netcoreapp1.1 (.NETCoreApp,Version=v1.1). Package Microsoft.AspNet.WebUtilities 1.0.0-rc1-final supports:
  - dotnet54 (.NETPlatform,Version=v5.4)
  - net451 (.NETFramework,Version=v4.5.1)	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1903	Package 'Microsoft.NETCore.App' 1.1.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-7mfr-774f-w5r9	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1903	Package 'Microsoft.NETCore.App' 1.1.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-8884-xcr4-r68p	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1903	Package 'Microsoft.NETCore.App' 2.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-7mfr-774f-w5r9	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1701	Package 'NUnit3TestAdapter 4.3.1' was restored using '.NETFramework,Version=v4.6.1, .NETFramework,Version=v4.6.2, .NETFramework,Version=v4.7, .NETFramework,Version=v4.7.1, .NETFramework,Version=v4.7.2, .NETFramework,Version=v4.8, .NETFramework,Version=v4.8.1' instead of the project target framework '.NETCoreApp,Version=v2.0'. This package may not be fully compatible with your project.	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Error	NU1202	Package Microsoft.AspNet.WebUtilities 1.0.0-rc1-final is not compatible with netcoreapp1.1 (.NETCoreApp,Version=v1.1). Package Microsoft.AspNet.WebUtilities 1.0.0-rc1-final supports:
  - dotnet54 (.NETPlatform,Version=v5.4)
  - net451 (.NETFramework,Version=v4.5.1)	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1903	Package 'Microsoft.NETCore.App' 1.1.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-7mfr-774f-w5r9	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1903	Package 'Microsoft.NETCore.App' 1.1.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-8884-xcr4-r68p	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1903	Package 'Microsoft.NETCore.App' 2.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-7mfr-774f-w5r9	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Warning	NU1701	Package 'NUnit3TestAdapter 4.3.1' was restored using '.NETFramework,Version=v4.6.1, .NETFramework,Version=v4.6.2, .NETFramework,Version=v4.7, .NETFramework,Version=v4.7.1, .NETFramework,Version=v4.7.2, .NETFramework,Version=v4.8, .NETFramework,Version=v4.8.1' instead of the project target framework '.NETCoreApp,Version=v2.0'. This package may not be fully compatible with your project.	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		
Error	NU1202	Package Microsoft.AspNet.WebUtilities 1.0.0-rc1-final is not compatible with netcoreapp1.1 (.NETCoreApp,Version=v1.1). Package Microsoft.AspNet.WebUtilities 1.0.0-rc1-final supports:
  - dotnet54 (.NETPlatform,Version=v5.4)
  - net451 (.NETFramework,Version=v4.5.1)	Tests	D:\_build\FluentHttpClient\Tests\Tests.csproj	1		

As best as I can tell, some of these errors could be fixed by updating a few outdated package references but the major source of vulnerabilities is the fact that you are still targeting legacy frameworks (such as netstandard1.3 and net452 for example) and I doubt the vulnerabilities in these frameworks will ever be resolved.

One of the problem with these vulnerabilities is that they trickle down to projects that reference your library (such as the libraries that I maintain for example) and the verbiage leads developers to think that the problem originates with my libraries. That's why @drma-tech alerted me of this problem originally and after a short investigation, he and I came to the conclusion that the problem originated upstream in the FluentHttpClient library.

You and I had a discussion about modernizing the list of targeted frameworks 4 years ago. At the time is was important to you to support legacy projects and you decided not to drop support for these out-of-support frameworks but, in light of the recently discovered vulnerabilities, I suggest it's time to revisit this decision and to drop support for problematic legacy frameworks such as netstandard1.x for instance.

I'd be happy to assist any way I can.

[Pathoschild]

Vulnerabilities in old target frameworks shouldn't affect newer projects in theory. For example, a .NET 8 project should use the net5.0 dependencies:

The issue in this case is the Microsoft.AspNet.WebApi.Client 5.2.9 dependency in newer target frameworks. I just updated it to 6.0.0 in the upcoming FluentHttpClient 4.4.0, which fixes the vulnerability warnings in my tests.

Thanks for reporting it!