Do not allow "Unsupported" framework in package dependencies

E.g. https://www.nuget.org/packages/Castle.Core/4.0.0-alpha001 should be blocked
AtwoodTM · Apr 15, 2016 · 71c57c4 · 71c57c4
1 parent 4d91074
commit 71c57c4
Show file tree

Hide file tree

Showing 2 changed files with 45 additions and 1 deletion.
diff --git a/src/NuGetGallery.Core/Packaging/ManifestValidator.cs b/src/NuGetGallery.Core/Packaging/ManifestValidator.cs
@@ -113,6 +113,16 @@ private static IEnumerable<ValidationResult> ValidateCore(PackageMetadata packag
                     // Keep track of duplicates
                     var dependencyIds = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
 
+                    // Verify frameworks
+                    var isUnsupportedFramework = dependencyGroup.TargetFramework?.IsUnsupported;
+                    if (isUnsupportedFramework.HasValue && isUnsupportedFramework.Value)
+                    {
+                        yield return new ValidationResult(String.Format(
+                            CultureInfo.CurrentCulture,
+                            Strings.Manifest_TargetFrameworkNotSupported,
+                            dependencyGroup.TargetFramework?.ToString()));
+                    }
+
                     // Verify package id's
                     foreach (var dependency in dependencyGroup.Packages)
                     {

diff --git a/tests/NuGetGallery.Core.Facts/Packaging/ManifestValidatorFacts.cs b/tests/NuGetGallery.Core.Facts/Packaging/ManifestValidatorFacts.cs
@@ -277,6 +277,32 @@ public class ManifestValidatorFacts
                   </metadata>
                 </package>";
 
+        private const string NuSpecDependenciesContainsUnsupportedTargetFramework = @"<?xml version=""1.0""?>
+                <package xmlns=""http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd"">
+                  <metadata>
+                    <id>packageA</id>
+                    <version>1.0.1-alpha</version>
+                    <title>Package A</title>
+                    <authors>ownera, ownerb</authors>
+                    <owners>ownera, ownerb</owners>
+                    <requireLicenseAcceptance>false</requireLicenseAcceptance>
+                    <description>package A description.</description>
+                    <language>en-US</language>
+                    <dependencies>
+                        <group targetFramework=""net40"">
+                          <dependency id=""SomeDependency"" version=""1.0.0-alpha1"" />
+                          <dependency id=""WebActivator"" version=""1.1.0"" />
+                          <dependency id=""PackageC"" version=""[1.1.0, 2.0.1)"" />
+                        </group>
+                        <group targetFramework=""Unsupported0.0"">
+                          <dependency id=""SomeDependency"" version=""1.0.0-alpha1"" />
+                          <dependency id=""WebActivator"" version=""1.1.0"" />
+                          <dependency id=""PackageC"" version=""[1.1.0, 2.0.1)"" />
+                        </group>
+                    </dependencies>
+                  </metadata>
+                </package>";
+
         [Fact]
         public void ReturnsErrorIfIdNotPresent()
         {
@@ -349,6 +375,14 @@ public void ReturnsErrorIfVersionIsSemVer200()
             Assert.Equal(new[] { String.Format(Strings.Manifest_InvalidVersionSemVer200, "2.0.0+123") }, GetErrors(nuspecStream));
         }
 
+        [Fact]
+        public void ReturnsErrorIfFrameworkAssemblyReferenceContainsUnsupportedTargetFramework()
+        {
+            var nuspecStream = CreateNuspecStream(NuSpecFrameworkAssemblyReferenceContainsUnsupportedTargetFramework);
+
+            Assert.Equal(new[] { String.Format(Strings.Manifest_TargetFrameworkNotSupported, "Unsupported,Version=v0.0") }, GetErrors(nuspecStream));
+        }
+
         [Fact]
         public void ReturnsErrorIfDependencySetContainsInvalidId()
         {
@@ -368,7 +402,7 @@ public void NoErrorIfDependencySetContainsEmptyTargetFramework()
         [Fact]
         public void ReturnsErrorIfDependencySetContainsUnsupportedTargetFramework()
         {
-            var nuspecStream = CreateNuspecStream(NuSpecFrameworkAssemblyReferenceContainsUnsupportedTargetFramework);
+            var nuspecStream = CreateNuspecStream(NuSpecDependenciesContainsUnsupportedTargetFramework);
 
             Assert.Equal(new[] { String.Format(Strings.Manifest_TargetFrameworkNotSupported, "Unsupported,Version=v0.0") }, GetErrors(nuspecStream));
         }