Sarand/Common-VS2019
1
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Prepare for NPOI upgrade.

Browse Source
This commit is contained in:
Andy Howard
2026-09-12 16:05:32 +01:00
parent 1903cb31f1
commit c510adc95c
4 changed files with 271 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/component-reviews.md
+1
View File
@@ -16,4 +16,5 @@ Last updated: 2026-09-12
| [`SacsMobileMaui`](../SacsMobileMaui/docs/component-reviews.md) | Project | .NET 10 migration complete; tracked in project docs | 2026-09-11 | Validate Apple targets on a Mac and continue API cleanup in the project tracker. | The shared project and both active mobile consumers target .NET 10. Windows runtime smoke tests pass, and Windows and Android Debug builds complete with zero errors. |
| `SacsStandardBase/Base/Procs/SaProcess_Base.cs` | Class | In progress | 2026-09-09 | Complete the Process Base actions recorded in `topics.md`; review derived processes separately for cooperative polling. | Lifecycle state ownership and cancellation lock ordering were changed. Five focused tests pass. Remaining concerns include mixed sync/async execution, durable cancellation outcome, cancellation exception handling, disposal, and status synchronization. |
| `SacsStandardBase/Base/Email/SaEmailConsole.cs` | Class | Dependency upgrade complete; security action still required | 2026-09-12 | Separately restore SMTP certificate validation and require the configured TLS mode. | MailKit and MimeKit 4.17.0 pass the Common and downstream validation suites without vulnerability warnings. Message construction is covered for addressing, bodies, attachments, content IDs, default filenames, and tags. The current SMTP client still accepts every server certificate. |
| `SacsStandardProc/Proc/Excel/SaMsSpreadsheet_POI.cs` | Class | Characterization baseline complete; dependency upgrade pending | 2026-09-12 | Upgrade to NPOI 2.7.6 with an explicit patched cryptography dependency and rerun the focused and downstream suites. | Ten tests exercise lifecycle, worksheets, XLSX byte/stream/file round trips, typed values, formulas, dimensions, active cells, and legacy XLS. Automatic worksheet naming, typed text reads, and XLS fallback stream rewinding were corrected; all specifications now pass. NPOI 2.8.0 introduces a maintenance-fee EULA; 2.7.6 remains Apache-2.0. |
| `SacsStandardBase/Base/Helpers/SacsEncryptionHelper.cs` and `SacsStandardBase/Base/Data/SacsAesIvCrypter.cs` | Classes | Reviewed; action required | 2026-09-08 | Design a versioned authenticated-encryption format with legacy migration and tamper tests. | Current CBC encryption is unauthenticated; password-based key derivation uses a fixed salt and low iteration count. |
docs/topics.md
+1
View File
@@ -13,6 +13,7 @@ Last updated: 2026-09-12
| Priority | Topic | Date noted | Next step | Notes |
|---|---|---|---|---|
| P1 | Upgrade NPOI and override its vulnerable cryptography dependency | 2026-09-12 | Evaluate NPOI 2.7.6 with an explicit `System.Security.Cryptography.Xml` 10.0.12 reference against the completed spreadsheet baseline, then validate downstream BusinessMgr exports. | `SacsStandardProc` directly references NPOI 2.6.2. Current NPOI 2.8.0 still declares vulnerable `System.Security.Cryptography.Xml` 8.0.2 and introduces a maintenance-fee EULA; do not adopt it without an explicit licensing decision. NPOI 2.7.6 remains Apache-2.0 but also needs the explicit cryptography override. Ten new NPOI tests pass, including fixes for automatic worksheet naming, typed reads of text cells, and XLS fallback stream handling. |
| P2 | Resolve .NET 10 migration warnings in non-MAUI Common code | 2026-09-10 | Replace the obsolete `Rfc2898DeriveBytes` constructor, make the three `FileStream.Read` operations exact, and review removal of the redundant `Microsoft.Win32.Registry` package. | The .NET 10 build reports `SYSLIB0060`, three `CA2022` warnings, and `NU1510`. The cryptography change overlaps the existing encryption-hardening topic and requires compatibility tests. |
| P1 | Prevent synchronous and asynchronous execution from overlapping in `SaProcess_Base` | 2026-09-09 | Route `RunProcess()` and `RunAsync()` through one guarded start operation and extend the lifecycle tests. | A synchronous call can currently reuse and dispose the asynchronous worker's task data. |
| P2 | Retain cancellation as a completed process outcome | 2026-09-09 | Store a durable cancellation result until the next process reset and test post-completion state. | `IsInterrupted` currently loses token-based cancellation after task-data cleanup. |