search

CyberSource / cybersource-rest-client-dotnetstandard

.NET Standard client library for the CyberSource REST API
7 stars 21 forks source link

LogUtility.MaskSensitiveData is not thread safe #22

Closed wrightsonm closed 2 years ago

wrightsonm commented 2 years ago

We have just pulled in the latest changes that include the new logging with MaskSensitiveData options, and quickly identified a concurrency issue when deploying to production.

System.InvalidOperationException: Collection was modified; enumeration operation may not execute. at System.ThrowHelper.ThrowInvalidOperationException(ExceptionResource resource) at System.Collections.Generic.Dictionary`2.Enumerator.MoveNext() at AuthenticationSdk.util.LogUtility.MaskSensitiveData(String str) at CyberSource.Api.KeyGenerationApi.GeneratePublicKeyWithHttpInfo(String format, GeneratePublicKeyRequest generatePublicKeyRequest) at CyberSource.Api.KeyGenerationApi.GeneratePublicKey(String format, GeneratePublicKeyRequest generatePublicKeyRequest)

Specifically we deployed the netFramework version, but am discussing here as AuthenticationSdk for netFramework is closed source, and the NetStandard version is open source & can be seen to be non-thread safe here:

AuthenticationSdk/util/LogUtility.cs

Tagging developers to flag this issue: @gnongsie

wrightsonm commented 2 years ago

Also raised as an issue on dotnet repo https://github.com/CyberSource/cybersource-rest-client-dotnet/issues/123

wrightsonm commented 2 years ago

Fixed in https://github.com/CyberSource/cybersource-rest-client-dotnetstandard/releases/tag/0.0.1.11