LuckyPennySoftware/AutoMapper v15.1.4

on GitHub

Security

This release fixes two denial-of-service vulnerabilities. In both, deeply nested input could bypass MaxDepth and exhaust the stack. The resulting StackOverflowException can't be caught, so it ends the process. Please upgrade if your application maps untrusted, deeply nested data.

• GHSA-6vhm-j9h7-f9gh: MaxDepth wasn't enforced when mapping through constructor parameters, including positional records. Thanks to @mcambria for the report.
• GHSA-gpwp-5797-mjff: other recursion paths bypassed MaxDepth: derived maps, object and interface members, dictionary and dynamic sources, and recursive type converters.

CVE IDs have been requested and will be added here once they're assigned.

Behavior changes

• Recursion that MaxDepth can't limit now throws a catchable InsufficientExecutionStackException instead of crashing the process.
• Derived maps (Include / IncludeBase) now inherit MaxDepth and get the default limit of 64 for self-referential maps. If your polymorphic graphs legitimately go deeper, set MaxDepth explicitly.
• Constructor mapping now stops at the same depth as property mapping.

Other fixes

• Fixed Context.Items are only available... exceptions with MaxDepth, which depended on registration or warmup order (#4651, backported in #4676)

What's Changed

• [15.x] Fail the release when the tag is not on its release branch by @jbogard in #4669
• [15.x] Emit the context check for the containing type map in CollectionMapper by @jbogard in #4676
• [15.x] Run unit tests on .NET Framework in CI by @jbogard in #4678

Full Changelog: v15.1.3...v15.1.4