Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-32571: GitHub - zzzprojects/System.Linq.Dynamic.Core: The .NET Standard / .NET Core version from the System Linq Dynamic functionality.

Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.

CVE
#web#microsoft#git#perl#auth

Library Powered By

This library is powered by Entity Framework Extensions

System.Linq.Dynamic.Core

This is a .NET Core / Standard port of the Microsoft assembly for the .Net 4.0 Dynamic language functionality.

Overview

With this library it’s possible to write Dynamic LINQ queries (string based) on an IQueryable:

var query = db.Customers .Where("City == @0 and Orders.Count >= @1", "London", 10) .OrderBy(“CompanyName”) .Select("new(CompanyName as Name, Phone)");

Interpolated strings are supported on .NET 4.6(and above), .NET Core 2.1(and above), .NET Standard 1.3(and above) and UAP 10.0(and above). For example:

string cityName = “London"; int c = 10; db.Customers.WhereInterpolated($"City == {cityName} and Orders.Count >= {c}”);

❗ Breaking changes****v1.3.0

A breaking change is introduced in version 1.3.0 which is related to calling methods on classes. Due to security reasons, it’s now only allowed to call methods on the standard predefined classes like (bool, int, string …). If you want to call a method on an own custom class, annotate that class with the DynamicLinqType. Example:

[DynamicLinqType] public class MyCustomClass { public int GetAge(int x) => x; }

If it’s not possible to add that attribute, you need to implement a custom CustomTypeProvider and set this to the ParsingConfig and provide that config to the dynamic call.

Useful links

  • Website
  • Documentation
  • Online examples
  • NuGet

Info

Project

Chat

Issues

Quality

CI Workflow

NuGet

System.Linq.Dynamic.Core

EntityFramework.DynamicLinq

Microsoft.EntityFrameworkCore.DynamicLinq

Z.EntityFramework.Classic.DynamicLinq

Development Details****Frameworks

The following frameworks are supported:

  • net35, net40, net45, net46 and up
  • netstandard1.3, netstandard2.0 and netstandard2.1
  • netcoreapp3.1, net5.0, net6.0 and net7.0
  • uap10.0

Fork details

This fork takes the basic library to a new level. Contains XML Documentation and examples on how to use it. Also adds unit testing to help ensure that it works properly.

Some background: I forked from https://github.com/NArnott/System.Linq.Dynamic and added some more functionality there.
My fork is still visible on github [https://github.com/StefH/System.Linq.Dynamic], however I decided to start a new project + nuget to avoid confusion and create the project according to the new VS2017 + .NET Core rules / standards.

However, currently there are multiple nuget packages and projects available:

Project

NuGet

Author

Comment

kahanu/System.Linq.Dynamic

System.Linq.Dynamic

@kahanu

-

kavun/System.Linq.Dynamic.3.5

System.Linq.Dynamic.3.5/

@kavun

only 3.5 and VB.NET

NArnott/System.Linq.Dynamic

System.Linq.Dynamic.Library

@NArnott

removed from github + nuget ?

dynamiclinq.codeplex

-

dialectsoftware

-

dynamic-linq

-

scottgu

-

Contribute

Want to help us? Your donation directly helps us maintain and grow ZZZ Free Projects.

We can’t thank you enough for your support 🙏.

👍 One-time donation

❤️ Become a sponsor

Why should I contribute to this free & open-source library?

We all love free and open-source libraries! But there is a catch… nothing is free in this world.

We NEED your help. Last year alone, we spent over 3000 hours maintaining all our open source libraries.

Contributions allow us to spend more of our time on: Bug Fix, Development, Documentation, and Support.

How much should I contribute?

Any amount is much appreciated. All our free libraries together have more than 100 million downloads.

If everyone could contribute a tiny amount, it would help us make the .NET community a better place to code!

Another great free way to contribute is spreading the word about the library.

A HUGE THANKS for your help!

More Projects

  • EntityFramework Extensions
  • Dapper Plus
  • C# Eval Expression
  • and much more!

To view all our free and paid projects, visit our website.

Related news

GHSA-w65q-jcmv-28gj: Dynamic Linq vulnerable to remote code execution

Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda