From 85455d9293d5085c48eda5550e170baddf5fa4d0 Mon Sep 17 00:00:00 2001
From: Vincent Biret <vibiret@microsoft.com>
Date: Wed, 10 Jul 2024 09:54:08 -0400
Subject: [PATCH] fix: warning suppression for STJ CVE

Signed-off-by: Vincent Biret <vibiret@microsoft.com>
---
 .../Microsoft.Kiota.Http.HttpClientLibrary.csproj   | 13 +++++++++----
 .../json/Microsoft.Kiota.Serialization.Json.csproj  | 13 +++++++++----
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/src/http/httpClient/Microsoft.Kiota.Http.HttpClientLibrary.csproj b/src/http/httpClient/Microsoft.Kiota.Http.HttpClientLibrary.csproj
index 21ff350b..9deabe22 100644
--- a/src/http/httpClient/Microsoft.Kiota.Http.HttpClientLibrary.csproj
+++ b/src/http/httpClient/Microsoft.Kiota.Http.HttpClientLibrary.csproj
@@ -10,9 +10,13 @@
   </PropertyGroup>
 
   <!-- NET 5 target to be removed on next major version-->
-  <ItemGroup Condition="'$(TargetFramework)' == 'net5.0' or '$(TargetFramework)'== 'netStandard2.0' or '$(TargetFramework)' == 'netStandard2.1' or '$(TargetFramework)' == 'net462'">
+  <ItemGroup
+    Condition="'$(TargetFramework)' == 'net5.0' or '$(TargetFramework)'== 'netStandard2.0' or '$(TargetFramework)' == 'netStandard2.1' or '$(TargetFramework)' == 'net462'">
     <PackageReference Include="System.Diagnostics.DiagnosticSource" Version="[6.0,9.0)" />
-    <PackageReference Include="System.Text.Json" Version="[6.0,9.0)" />
+    <!-- suppressed because of this CVE https://github.com/advisories/GHSA-hh2w-p6rv-4g7w 
+     The target application is the one which will resolve the correct version
+     when the version range is updated to > 8.0.4 in the future, remove the nowarn suppression -->
+    <PackageReference Include="System.Text.Json" Version="[6.0,9.0)" NoWarn="NU1903" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net462'">
@@ -21,6 +25,7 @@
 
   <ItemGroup>
     <ProjectReference Include="..\..\abstractions\Microsoft.Kiota.Abstractions.csproj" />
-    <ProjectReference Include="..\..\generated\KiotaGenerated.csproj" OutputItemType="Analyzer" ReferenceOutputAssembly="false" />
+    <ProjectReference Include="..\..\generated\KiotaGenerated.csproj" OutputItemType="Analyzer"
+      ReferenceOutputAssembly="false" />
   </ItemGroup>
-</Project>
+</Project>
\ No newline at end of file
diff --git a/src/serialization/json/Microsoft.Kiota.Serialization.Json.csproj b/src/serialization/json/Microsoft.Kiota.Serialization.Json.csproj
index 0a0cd3f6..e45e5773 100644
--- a/src/serialization/json/Microsoft.Kiota.Serialization.Json.csproj
+++ b/src/serialization/json/Microsoft.Kiota.Serialization.Json.csproj
@@ -7,15 +7,20 @@
     <!-- NET 5 target to be removed on next major version-->
     <TargetFrameworks>netstandard2.0;netstandard2.1;net5.0;net6.0;net8.0</TargetFrameworks>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
-    <NoWarn>$(NoWarn);CS1591</NoWarn> <!-- Ignore warning from code generated by source generators from System.Text.Json-->
+    <NoWarn>$(NoWarn);CS1591</NoWarn> <!-- Ignore warning from code generated by source generators
+    from System.Text.Json-->
   </PropertyGroup>
 
   <!-- NET 5 target to be removed on next major version-->
-  <ItemGroup Condition="'$(TargetFramework)' == 'net5.0' or '$(TargetFramework)'== 'netStandard2.0' or '$(TargetFramework)' == 'netStandard2.1'">
-    <PackageReference Include="System.Text.Json" Version="[6.0,9.0)" />
+  <ItemGroup
+    Condition="'$(TargetFramework)' == 'net5.0' or '$(TargetFramework)'== 'netStandard2.0' or '$(TargetFramework)' == 'netStandard2.1'">
+    <!-- suppressed because of this CVE https://github.com/advisories/GHSA-hh2w-p6rv-4g7w
+     The target application is the one which will resolve the correct version
+     when the version range is updated to > 8.0.4 in the future, remove the nowarn suppression -->
+    <PackageReference Include="System.Text.Json" Version="[6.0,9.0)" NoWarn="NU1903" />
   </ItemGroup>
 
   <ItemGroup>
     <ProjectReference Include="..\..\abstractions\Microsoft.Kiota.Abstractions.csproj" />
   </ItemGroup>
-</Project>
+</Project>
\ No newline at end of file