From 18aecbc32ce745fed85f4bde75b02c72a6413a59 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A1ra=20El-Saig?= Date: Wed, 28 Feb 2024 02:47:45 +0100 Subject: [PATCH 1/2] Exclude "The filename, directory name, or volume label syntax is incorrect" --- .../Services/OrchardCoreUITestExecutorConfiguration.cs | 1 + 1 file changed, 1 insertion(+) diff --git a/Lombiq.Tests.UI/Services/OrchardCoreUITestExecutorConfiguration.cs b/Lombiq.Tests.UI/Services/OrchardCoreUITestExecutorConfiguration.cs index dc81be07c..020ca628d 100644 --- a/Lombiq.Tests.UI/Services/OrchardCoreUITestExecutorConfiguration.cs +++ b/Lombiq.Tests.UI/Services/OrchardCoreUITestExecutorConfiguration.cs @@ -238,6 +238,7 @@ public static Func CreateAppLogAssertionForSecuri // a directory. Presumably this is an attempt to access protected files using source path manipulation. // This is handled by ASP.NET Core and there is nothing for us to worry about. "System.IO.IOException: Not a directory", + "The filename, directory name, or volume label syntax is incorrect", // This happens when a request's model contains a dictionary and a key is missing. While this can be a // legitimate application error, during a security scan it's more likely the result of an incomplete // artificially constructed request. So the means the ASP.NET Core model binding is working as intended. From 76ac87161f956115f3c609b5f8972811b67877c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A1ra=20El-Saig?= Date: Wed, 28 Feb 2024 04:01:28 +0100 Subject: [PATCH 2/2] Permit another benign exception. --- .../Services/OrchardCoreUITestExecutorConfiguration.cs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Lombiq.Tests.UI/Services/OrchardCoreUITestExecutorConfiguration.cs b/Lombiq.Tests.UI/Services/OrchardCoreUITestExecutorConfiguration.cs index 020ca628d..f62cdd38d 100644 --- a/Lombiq.Tests.UI/Services/OrchardCoreUITestExecutorConfiguration.cs +++ b/Lombiq.Tests.UI/Services/OrchardCoreUITestExecutorConfiguration.cs @@ -238,7 +238,8 @@ public static Func CreateAppLogAssertionForSecuri // a directory. Presumably this is an attempt to access protected files using source path manipulation. // This is handled by ASP.NET Core and there is nothing for us to worry about. "System.IO.IOException: Not a directory", - "The filename, directory name, or volume label syntax is incorrect", + "System.IO.IOException: The filename, directory name, or volume label syntax is incorrect", + "System.IO.DirectoryNotFoundException: Could not find a part of the path", // This happens when a request's model contains a dictionary and a key is missing. While this can be a // legitimate application error, during a security scan it's more likely the result of an incomplete // artificially constructed request. So the means the ASP.NET Core model binding is working as intended.