Create document on safely executing repros Fixes #45341 #45456
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dotnet-issue-labeler
bot
added
Area-NetSDK
untriaged
| If none of the above methods work, it may be viable to read all customer code carefully to ensure that no part of it is risky or malicious. | ||
|
|
||
| Some examples of specific patterns to watch out for that can cause issues include: | ||
| 1. PackageReferences. These download code from the internet and permit its execution locally. If you are unfamiliar with any package in a PackageReference, this is insecure. |
There was a problem hiding this comment.
NuGet.Config could point to a malicious site, even if the package name is reserved at nuget.org.
dsplaisted
approved these changes
Dec 20, 2024
|
|
||
| The other disadvantage of this approach is that it can take a lot of time to select appropriate parameters for your VM, start it, connect to it, set it up properly for your scenario, and execute the scenario. Unlike Sandbox, it can retain certain information across restarts, but it may lose active work just as your computer loses active work when you restart it. It's important to keep in mind that many VMs restart automatically at a fixed time every day when not in use to save resources. | ||
|
|
||
| That said, this is a secure means for executing a customer's scenario, and it works for any operating system and can even be configured to work for other architectures. Note that it does cost real money to use. |
There was a problem hiding this comment.
Note that it does cost real money to use.
I think you're referring to VMs in the cloud. It's also possible to create a local VM (for example using Hyper-V).
Forgind
commented
Dec 20, 2024
Thanks for the review! I set a reminder for myself to ping them in January when they're back from vacations 🙂 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #45341
/cc: @JanKrivanek