repository·main·Indexed 12 days ago
https://github.com/dotnet/efcoreA modern object-database mapper for .NET. It supports LINQ queries, change tracking, and schema migrations via a DbContext. The ecosystem includes the dotnet-ef CLI tool, various database providers (SQL Server, SQLite, Azure Cosmos DB, In-Memory), and specialized packages for design-time tooling, abstractions, and proxies for lazy-loading and change-tracking.
The Microsoft.EntityFrameworkCore.InMemory package is a database provider that allows Entity Framework Core to operate against an in-memory database.
Note: While commonly used for testing, using the in-memory provider for testing is generally discouraged. For recommended testing patterns, refer to the official Testing EF Core Applications guide.
ApiChief is a tool for EF Core used to manage public API baselines and review artifacts for compiled assemblies. It helps track breaking changes and generate API summaries.
When analyzing an assembly, ApiChief applies the following filtering logic:
.Internal.[EntityFrameworkInternal] attribute.name=MyConnection, EF Core will use the IConfiguration service from the service provider to resolve the actual connection string. It looks for the key "MyConnection" or "ConnectionStrings:MyConnection" within your configuration.Migration APIs are designed for trusted values that are compiled into your application. They are not intended to handle untrusted input from end users.
Warning: Certain migration APIs are 'pass-thru' in nature and do not perform validation or escaping. This includes:
Sql(string) method.defaultValueSql parameter.Guidance: If you must pass input from an untrusted source to migration APIs, you must perform explicit validation to protect against SQL injection.
Arcade's template architecture is divided into three functional types to manage the difference between standard and 1ES pipelines:
templates/ or templates-official/) that acts as an entry point. It defines the is1ESPipeline parameter (set to true for templates-official and false for templates) and redirects to the actual logic.core-templates/ folder.core-templates/ that redirects back to the specific logic file in either templates/ or templates-official when the logic is dependent on the shim entry point used.Key structural rule: Templates at the stages, jobs, and job levels are implemented as shims. Templates at the steps and variables levels typically contain direct logic because they are too granular to require shims.
Relational database JOINs can cause a "cartesian explosion," where the number of rows returned is the product of the rows in the joined tables, potentially leading to Denial of Service (DoS) through massive result sets.
To mitigate this, use the .AsSplitQuery() method to instruct EF Core to execute multiple queries instead of a single large join.
To use EF Core, you must create a class that inherits from DbContext, which represents your database session. You also define classes (entities) that represent the data structures in your database. Use DbSet<TEntity> properties within your DbContext to expose these entities for querying and saving.
using Microsoft.EntityFrameworkCore;
public class MyDbContext : DbContext
{
public DbSet<Customer> Customers { get; set; }
}
public class Customer
{
public int Id { get; set; }
public string Name { get; set; }
}EF Core relational providers provide built-in protection against SQL injection through automatic parameterization and escaping:
.Where() clause) are automatically parameterized or escaped.Add() and SaveChanges().This ensures that even if values originate from untrusted end-user input, they are handled safely by the underlying database provider.
// LINQ query example: lastName is automatically parameterized
public IEnumerable<Customer> FindCustomers(string lastName)
{
using (var context = new CustomerContext())
{
return context.Customers
.Where(c => c.LastName == lastName)
.ToList();
}
}
// Update example: firstName and lastName are automatically parameterized
public Customer CreateCustomer(string firstName, string lastName)
{
using (var context = new CustomerContext())
{
var customer = new Customer
{
FirstName = firstName,
LastName = lastName
};
context.Customers.Add(customer);
context.SaveChanges();
return customer;
}
}By default, EF Core provides the following security guarantees to prevent data leakage:
Exception.Message, Exception.ToString, and ILogger.Write strings) do not contain application data (e.g., query results, entity values) by default.ILogger.Write does not contain references to application data or objects from which application data can be obtained.WARNING: These guarantees are void if the IncludeSensitiveDataInLog flag is enabled.
EF Core is designed to handle untrusted result sets from a database. It does not load, construct, or execute code dynamically based on the data received; all types must be specified in the EF model in advance.
Key security behaviors include:
$type) is serialized first, followed by keys, in a deterministic order.Deciding between the two SQLite provider packages depends on your requirement for the native SQLite binary:
Microsoft.EntityFrameworkCore.Sqlite: Use this for most standard applications. It automatically includes the necessary SQLite native binaries.Microsoft.EntityFrameworkCore.Sqlite.Core: Use this only if you need to swap out the default SQLite binary for a different one. This requires manual installation of a binary package and manual initialization via SQLitePCL.Batteries_V2.Init();.