Skip to content

Commit

Permalink
Ensure safer access to system.web.security.roles (#2425)
Browse files Browse the repository at this point in the history
Follow up from: 

- #2377
- #2417
  • Loading branch information
Mpdreamz authored Aug 19, 2024
1 parent 824a5b4 commit 72a5b8d
Showing 1 changed file with 20 additions and 7 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -632,10 +632,23 @@ private void FillSampledTransactionContextUser(HttpContext context, ITransaction

var user = new User { UserName = userIdentity.Name };

var sqlRoleProvider =
System.Web.Security.Roles.Enabled && System.Web.Security.Roles.Providers.Cast<object>().Any(provider => provider.GetType().Name == "SqlRoleProvider");
if (!sqlRoleProvider && context.User is ClaimsPrincipal claimsPrincipal)
FillUserIdentity(context, user);

transaction.Context.User = user;

_logger.Debug()?.Log("Captured user - {CapturedUser}", transaction.Context.User);
}

private void FillUserIdentity(HttpContext context, User user)
{
try
{
var sqlRoleProvider =
System.Web.Security.Roles.Enabled && System.Web.Security.Roles.Providers.Cast<object>().Any(provider => provider.GetType().Name == "SqlRoleProvider");

if (sqlRoleProvider || context.User is not ClaimsPrincipal claimsPrincipal)
return;

try
{
static string GetClaimWithFallbackValue(ClaimsPrincipal principal, string claimType, string fallbackClaimType)
Expand All @@ -652,10 +665,10 @@ static string GetClaimWithFallbackValue(ClaimsPrincipal principal, string claimT
_logger.Error()?.Log("Unable to access user claims due to SqlException with message: {message}", ex.Message);
}
}

transaction.Context.User = user;

_logger.Debug()?.Log("Captured user - {CapturedUser}", transaction.Context.User);
catch (Exception ex)
{
_logger.Trace()?.Log("Error accessing System.Web.Security.Roles: {message}", ex.Message);
}
}

/// <summary>
Expand Down

0 comments on commit 72a5b8d

Please sign in to comment.