Skip to content

Commit 87801ea

Browse files
Add some info to MessagePack page (#19980)
1 parent 3c8a75b commit 87801ea

1 file changed

Lines changed: 15 additions & 2 deletions

File tree

aspnetcore/signalr/messagepackhubprotocol.md

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ description: Add MessagePack Hub Protocol to ASP.NET Core SignalR.
55
monikerRange: '>= aspnetcore-2.1'
66
ms.author: bradyg
77
ms.custom: mvc
8-
ms.date: 04/13/2020
8+
ms.date: 09/24/2020
99
no-loc: ["ASP.NET Core Identity", cookie, Cookie, Blazor, "Blazor Server", "Blazor WebAssembly", "Identity", "Let's Encrypt", Razor, SignalR]
1010
uid: signalr/messagepackhubprotocol
1111
---
@@ -57,6 +57,9 @@ services.AddSignalR()
5757
To enable MessagePack in the .NET Client, install the `Microsoft.AspNetCore.SignalR.Protocols.MessagePack` package and call `AddMessagePackProtocol` on `HubConnectionBuilder`.
5858

5959
```csharp
60+
using Microsoft.AspNetCore.SignalR.Client;
61+
using Microsoft.Extensions.DependencyInjection;
62+
6063
var hubConnection = new HubConnectionBuilder()
6164
.WithUrl("/chathub")
6265
.AddMessagePackProtocol()
@@ -211,9 +214,11 @@ services.AddSignalR()
211214
```
212215

213216
> [!WARNING]
214-
> We strongly recommend reviewing [CVE-2020-5234](https://github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf) and applying the recommended patches. For example, setting the `MessagePackSecurity.Active` static property to `MessagePackSecurity.UntrustedData`. Setting the `MessagePackSecurity.Active` requires manually installing a [1.9.x version of MessagePack](https://www.nuget.org/packages/MessagePack/1.9.3). Installing `MessagePack` 1.9.x upgrades the version SignalR uses. When `MessagePackSecurity.Active` is not set to `MessagePackSecurity.UntrustedData`, a malicious client could cause a denial of service. Set `MessagePackSecurity.Active` in `Program.Main`, as shown in the following code:
217+
> We strongly recommend reviewing [CVE-2020-5234](https://github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf) and applying the recommended patches. For example, setting the `MessagePackSecurity.Active` static property to `MessagePackSecurity.UntrustedData`. Setting the `MessagePackSecurity.Active` requires manually installing a [1.9.x version of MessagePack](https://www.nuget.org/packages/MessagePack/1.9.3). Installing `MessagePack` 1.9.x upgrades the version SignalR uses. `MessagePack` version 2.x introduced breaking changes and is incompatible with SignalR versions 3.1 and earlier. When `MessagePackSecurity.Active` isn't set to `MessagePackSecurity.UntrustedData`, a malicious client could cause a denial of service. Set `MessagePackSecurity.Active` in `Program.Main`, as shown in the following code:
215218
216219
```csharp
220+
using MessagePack;
221+
217222
public static void Main(string[] args)
218223
{
219224
MessagePackSecurity.Active = MessagePackSecurity.UntrustedData;
@@ -232,6 +237,9 @@ public static void Main(string[] args)
232237
To enable MessagePack in the .NET Client, install the `Microsoft.AspNetCore.SignalR.Protocols.MessagePack` package and call `AddMessagePackProtocol` on `HubConnectionBuilder`.
233238

234239
```csharp
240+
using Microsoft.AspNetCore.SignalR.Client;
241+
using Microsoft.Extensions.DependencyInjection;
242+
235243
var hubConnection = new HubConnectionBuilder()
236244
.WithUrl("/chathub")
237245
.AddMessagePackProtocol()
@@ -389,6 +397,8 @@ services.AddSignalR()
389397
> We strongly recommend reviewing [CVE-2020-5234](https://github.com/neuecc/MessagePack-CSharp/security/advisories/GHSA-7q36-4xx7-xcxf) and applying the recommended patches. For example, setting the `MessagePackSecurity.Active` static property to `MessagePackSecurity.UntrustedData`. Setting the `MessagePackSecurity.Active` requires manually installing a [1.9.x version of MessagePack](https://www.nuget.org/packages/MessagePack/1.9.3). Installing `MessagePack` 1.9.x upgrades the version SignalR uses. When `MessagePackSecurity.Active` is not set to `MessagePackSecurity.UntrustedData`, a malicious client could cause a denial of service. Set `MessagePackSecurity.Active` in `Program.Main`, as shown in the following code:
390398
391399
```csharp
400+
using MessagePack;
401+
392402
public static void Main(string[] args)
393403
{
394404
MessagePackSecurity.Active = MessagePackSecurity.UntrustedData;
@@ -407,6 +417,9 @@ public static void Main(string[] args)
407417
To enable MessagePack in the .NET Client, install the `Microsoft.AspNetCore.SignalR.Protocols.MessagePack` package and call `AddMessagePackProtocol` on `HubConnectionBuilder`.
408418

409419
```csharp
420+
using Microsoft.AspNetCore.SignalR.Client;
421+
using Microsoft.Extensions.DependencyInjection;
422+
410423
var hubConnection = new HubConnectionBuilder()
411424
.WithUrl("/chathub")
412425
.AddMessagePackProtocol()

0 commit comments

Comments
 (0)