Security Advisory Notice for 16.6.2

CVE-2020-1108 / CVE-2020-1108.NET Core Denial of Service Vulnerability

To comprehensively address CVE-2020-1108, Microsoft has released updates for .NET Core 2.1 and .NET Core 3.1. Customers who use any of these versions of .NET Core should install the latest version of .NET Core. See the Release Notes for the latest version numbers and instructions for updating .NET Core.

CVE-2020-1202 / CVE-2020-1203 Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector fails to properly handle objects in memory.

CVE-2020-1293 / CVE-2020-1278 / CVE-2020-1257 Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations

Top Issues Fixed in Visual Studio 2019 version 16.6.2

• Visual Studio 2019 16.60 hang at run or build when modified not saved in C++/CLI project
• An unhandled exception of type 'System.NullReferenceException' occurred in Microsoft.VisualStudio.DesignTools.WpfTap.dll
• Recurring null reference when reopening documents
• "Create new project" dialog search does not find templates for third-party language providers
• IntelliSense shows that "tilde-slash" (~/) points to ASP .NET Core 3.1 project root instread of wwwroot subfolder after upgrading Visual Studio Enterprise 16.5.6->16.6.0
• Fixed a compiler error (error C2475: redefinition; 'constexpr' specifier mismatch) affecting std::atomic when compiled as C++/CX in C++17 mode.
• URL completion values and format was fixed in Razor views. App-relative URL format is now used again and the values in the URL completion list show files and folders rooted under app root, i.e. wwwroot.
• Fixed a crash when using snippets.
• Restore item templates that could be hidden by extensions.

The popular JavaScript transpiler now supports ECMAScript 2020 features by default with no plugins needed for nullish coalescing (??), optional chaining (?.) and dynamic import(). Work is also underway on Babel 8 with two upcoming issues outlined in this post too. 

that’s not a typo—today we’re shipping Bootstrap 3.4.0, a long overdue update to address some quality of life issues, XSS fixes , and build tooling updates to make it easier for us, and you, to develop. 

In 16.7 Preview 4, we added the new Razor editor for local development with MVC, Razor Pages, and Blazor. The new Razor editor has a ton of new tooling support surpassing the functionality of the existing editor.

• Fixed known issue: Fixed VSiX Installer throwing an IOException when executed from Visual Studio installation folder.
• Fixed known issue: Removed double-prompting for survey on uninstall.
• Enabled a help link for new users to get help choosing a workload. 

var product = {
    ProductId: 1001,
    ProductName: "Product 1001",
    Available: true,
    Filename: "Image02.png"
};

        var productCount = 100;
        var products = [];

        function datasourceFilling() {
            for (var i = 0; i < productCount; i++) {
                var product = {
                    ProductId: i,
                    ProductName: "Product " + i + " Name",
                    Available: i % 2 == 0 ? true: false,
                    Filename: i % 2 == 0 ? "Image01.png" : "Image02.png"
                };
                products.push(product);
            }
        }

        function makekendoGrid() {

            $("#grid").kendoGrid({
                dataSource: {
                    data: products,
                    schema: {
                        model:
                        {
                            //id: "ProductId",
                            fields:
                            {
                                ProductId: { editable: false, nullable: true },
                                ProductName: { validation: { required: true } },
                                Available: { type: "boolean" },
                                ImageName: { type: "string", editable: false },
                                Filename: { type: "string", validation: { required: true } }
                            }
                        }
                    },
                    pageSize: 20
                },
                height: 550,
                scrollable: true,
                sortable: true,
                filterable: true,
                pageable: {
                    input: true,
                    numeric: false
                },
                editable: {
                    mode: "popup",
                },
                columns: [
                    { field: "ProductName", title: "Product Name" },
                    { field: "Available", width: "100px", template: '<input type="checkbox" #= Available ? checked="checked" : "" # disabled="disabled" ></input>' },
                    { field: "ImageName", width: "150px", template: "<img src='/img/#=Filename#' alt='#=Filename #' Title='#=Filename #' height='80' width='80'/>" },
                    { field: "Filename", width: "100px", editor: fileEditor },
                    { command: ["edit"], title: "&nbsp;", width: "200px" }
                ]
            });

            var grid = $('#grid').data('kendoGrid');
            grid.hideColumn(3);
        }

        function fileEditor(container, options) {

            $('<input type="file" name="file"/>')
                .appendTo(container)
                .kendoUpload({
                    multiple: false,
                    async: {
                        saveUrl: "@Url.Action("Save", "Home")",
                        removeUrl: "@Url.Action("Remove", "Home")",
                        autoUpload: true,
                    },
                    upload: function (e) {
                        alert("upload");
                        e.data = { Id: options.model.Id };
                    },
                    success: function (e) {
                        alert("success");
                        options.model.set("ImageName", e.response.ImageUrl);
                    },
                    error: function (e) {
                        alert("error");
                        alert("Failed to upload " + e.files.length + " files " + e.XMLHttpRequest.status + " " + e.XMLHttpRequest.responseText);
                    }
                });
        }

        [System.Web.Mvc.HttpPost]
        public virtual ActionResult Save(HttpPostedFileBase file)
        {
            var exName = Path.GetExtension(file.FileName);
            var totalFileName = System.Guid.NewGuid().ToString().ToLower().Replace("-", "") + exName;
            var physicalPath = Path.Combine(Server.MapPath("/img"), totalFileName);
            file.SaveAs(physicalPath);
            return Json(new { ImageUrl = totalFileName }, "text/plain");
        }

        [System.Web.Mvc.HttpPost]
        public virtual ContentResult Remove(string fileName)
        {
            if (fileName != null)
            {
                var physicalPath = Path.Combine(Server.MapPath("/img"), fileName);
                System.IO.File.Delete(physicalPath);
            }

            // Return an empty string to signify success
            return Content("");
        }

OData v4 support
Bug fixes

• We have two new refactorings for global usings, Extract Global Using and Inline Global Using, with Find Usages support for this feature.
• For nullable reference types, we’ve split the “should never be null” warning into two categories: one for those who look at NRT annotation and one for those who have a runtime check for null. We’ve also added a setting to enable runtime enforced not null warnings only, and supported [MemberNotNull] and [MemberNotNullWhen] annotations.
• We’ve implemented generic attributes support for C#11. 

Editor.js is a block-styled editor for rich media stories. It outputs clean data in JSON instead of heavy HTML-markup. And more important thing is that Editor.js is designed to be API extendable and pluggable.

This release contains some minor bug fixes and a couple of new features specifically targeted at enabling .NET Standard support for the ASP.NET Web API Client.