search

jetheredge / SquishIt

Lets you *easily* bundle some css and javascript! Check out the Google group if you have questions!
http://groups.google.com/group/squishit
MIT License
459 stars 119 forks source link

Attempt by security transparent method 'SquishIt.Framework.Minifiers.CSS.YuiMinifier..ctor()' to access security critical method 'Yahoo.Yui.Compressor.CssCompressor..ctor()' failed #349

Closed uniezuka closed 4 years ago

uniezuka commented 4 years ago

Hello I am getting this error, do you know how to solve this?

Attempt by security transparent method 'SquishIt.Framework.Minifiers.CSS.YuiMinifier..ctor()' to access security critical method 'Yahoo.Yui.Compressor.CssCompressor..ctor()' failed

AlexCuse commented 4 years ago

Can you let me know which version you are using, both for SquishIt and the YUI library?

.NET framework version may help too.

uniezuka commented 4 years ago

SquishIt v1.0.3 YUICompressor.NET 3.0.0 .NetFramework 4.8 Microsoft.AspNet.Mvc 5.2.7

the error is being thrown on this code scriptsBundle.WithMinifier\<NullMinifier>();

This was working before the update.

AlexCuse commented 4 years ago

Cool - which version were you updating from?

Our minimum version for the YUI library is 2.3 you may want to try walking back towards that and see what version it resolves at.

If they have changed something to make that constructor security critical I will need to think a bit on how to proceed here. That brings some baggage that I'd like to avoid forcing on the entire library.

uniezuka commented 4 years ago

I am upgrading from 0.9.7.

I'll try downgrading the YUI library.

AlexCuse commented 4 years ago

Thanks let me know how it goes - if you can let me know what the highest version you don't get the error with I can push an update to nuget specifying an upper bound for YUI in the meantime.

uniezuka commented 4 years ago

It works! The highest version of the YUI library that I used without runtime errors was 2.7.0.0

Thanks for looking in to this.

AlexCuse commented 4 years ago

Great thank you for the update. I will try to get the package metadata updated shortly.

AlexCuse commented 4 years ago

just pushed 1.0.4 that should resolve this issue temporarily by preventing update past 2.7. I'll try to look into the underlying issue eventually but it sounds like a wontfix to be honest.