Update MessagePack version (#47790)

eng/Versions.props

@@ -268,7 +268,7 @@
     <DuendeIdentityServerVersion>6.0.4</DuendeIdentityServerVersion>
     <DuendeIdentityServerStorageVersion>6.0.4</DuendeIdentityServerStorageVersion>
     <DuendeIdentityServerEntityFrameworkStorageVersion>6.0.4</DuendeIdentityServerEntityFrameworkStorageVersion>
-    <MessagePackVersion>2.1.90</MessagePackVersion>
+    <MessagePackVersion>2.5.108</MessagePackVersion>
     <MicrosoftIdentityWebVersion>1.16.0</MicrosoftIdentityWebVersion>
     <MicrosoftIdentityWebMicrosoftGraphVersion>1.16.0</MicrosoftIdentityWebMicrosoftGraphVersion>
     <MicrosoftIdentityWebUIVersion>1.16.0</MicrosoftIdentityWebUIVersion>

src/Components/Server/src/BlazorPack/BlazorPackHubProtocolWorker.cs

@@ -10,7 +10,7 @@ namespace Microsoft.AspNetCore.Components.Server.BlazorPack;
 
 internal sealed class BlazorPackHubProtocolWorker : MessagePackHubProtocolWorker
 {
-    protected override object DeserializeObject(ref MessagePackReader reader, Type type, string field)
+    protected override object? DeserializeObject(ref MessagePackReader reader, Type type, string field)
     {
         try
         {

src/SignalR/common/Protocols.MessagePack/src/Protocol/DefaultMessagePackHubProtocolWorker.cs

@@ -16,7 +16,7 @@ internal sealed class DefaultMessagePackHubProtocolWorker : MessagePackHubProtoc
         _messagePackSerializerOptions = messagePackSerializerOptions;
     }
 
-    protected override object DeserializeObject(ref MessagePackReader reader, Type type, string field)
+    protected override object? DeserializeObject(ref MessagePackReader reader, Type type, string field)
     {
         try
         {

src/SignalR/common/Protocols.MessagePack/src/Protocol/MessagePackHubProtocolWorker.cs

@@ -79,8 +79,9 @@ internal abstract class MessagePackHubProtocolWorker
         }
 
         var target = ReadString(ref reader, binder, "target");
+        ThrowIfNullOrEmpty(target, "target for Invocation message");
 
-        object[]? arguments;
+        object?[]? arguments;
         try
         {
             var parameterTypes = binder.GetParameterTypes(target);
@@ -105,9 +106,12 @@ internal abstract class MessagePackHubProtocolWorker
     {
         var headers = ReadHeaders(ref reader);
         var invocationId = ReadInvocationId(ref reader);
-        var target = ReadString(ref reader, "target");
+        ThrowIfNullOrEmpty(invocationId, "invocation ID for StreamInvocation message");
 
-        object[] arguments;
+        var target = ReadString(ref reader, "target");
+        ThrowIfNullOrEmpty(target, "target for StreamInvocation message");
+
+        object?[] arguments;
         try
         {
             var parameterTypes = binder.GetParameterTypes(target);
@@ -132,7 +136,9 @@ internal abstract class MessagePackHubProtocolWorker
     {
         var headers = ReadHeaders(ref reader);
         var invocationId = ReadInvocationId(ref reader);
-        object value;
+        ThrowIfNullOrEmpty(invocationId, "invocation ID for StreamItem message");
+
+        object? value;
         try
         {
             var itemType = binder.GetStreamItemType(invocationId);
@@ -150,6 +156,8 @@ internal abstract class MessagePackHubProtocolWorker
     {
         var headers = ReadHeaders(ref reader);
         var invocationId = ReadInvocationId(ref reader);
+        ThrowIfNullOrEmpty(invocationId, "invocation ID for Completion message");
+
         var resultKind = ReadInt32(ref reader, "resultKind");
 
         string? error = null;
@@ -202,6 +210,8 @@ internal abstract class MessagePackHubProtocolWorker
     {
         var headers = ReadHeaders(ref reader);
         var invocationId = ReadInvocationId(ref reader);
+        ThrowIfNullOrEmpty(invocationId, "invocation ID for CancelInvocation message");
+
         return ApplyHeaders(headers, new CancelInvocationMessage(invocationId));
     }
 
@@ -234,7 +244,11 @@ internal abstract class MessagePackHubProtocolWorker
             for (var i = 0; i < headerCount; i++)
             {
                 var key = ReadString(ref reader, $"headers[{i}].Key");
+                ThrowIfNullOrEmpty(key, "key in header");
+
                 var value = ReadString(ref reader, $"headers[{i}].Value");
+                ThrowIfNullOrEmpty(value, "value in header");
+
                 headers.Add(key, value);
             }
             return headers;
@@ -255,14 +269,17 @@ internal abstract class MessagePackHubProtocolWorker
             streams = new List<string>();
             for (var i = 0; i < streamIdCount; i++)
             {
-                streams.Add(reader.ReadString());
+                var id = reader.ReadString();
+                ThrowIfNullOrEmpty(id, "value in streamIds received");
+
+                streams.Add(id);
             }
         }
 
         return streams?.ToArray();
     }
 
-    private object[] BindArguments(ref MessagePackReader reader, IReadOnlyList<Type> parameterTypes)
+    private object?[] BindArguments(ref MessagePackReader reader, IReadOnlyList<Type> parameterTypes)
     {
         var argumentCount = ReadArrayLength(ref reader, "arguments");
 
@@ -274,7 +291,7 @@ internal abstract class MessagePackHubProtocolWorker
 
         try
         {
-            var arguments = new object[argumentCount];
+            var arguments = new object?[argumentCount];
             for (var i = 0; i < argumentCount; i++)
             {
                 arguments[i] = DeserializeObject(ref reader, parameterTypes[i], "argument");
@@ -288,7 +305,7 @@ internal abstract class MessagePackHubProtocolWorker
         }
     }
 
-    protected abstract object DeserializeObject(ref MessagePackReader reader, Type type, string field);
+    protected abstract object? DeserializeObject(ref MessagePackReader reader, Type type, string field);
 
     private static T ApplyHeaders<T>(IDictionary<string, string>? source, T destination) where T : HubInvocationMessage
     {
@@ -558,7 +575,7 @@ internal abstract class MessagePackHubProtocolWorker
         }
     }
 
-    private static string ReadInvocationId(ref MessagePackReader reader) =>
+    private static string? ReadInvocationId(ref MessagePackReader reader) =>
         ReadString(ref reader, "invocationId");
 
     private static bool ReadBoolean(ref MessagePackReader reader, string field)
@@ -585,7 +602,7 @@ internal abstract class MessagePackHubProtocolWorker
         }
     }
 
-    protected static string ReadString(ref MessagePackReader reader, IInvocationBinder binder, string field)
+    protected static string? ReadString(ref MessagePackReader reader, IInvocationBinder binder, string field)
     {
         try
         {
@@ -605,7 +622,7 @@ internal abstract class MessagePackHubProtocolWorker
         }
     }
 
-    protected static string ReadString(ref MessagePackReader reader, string field)
+    protected static string? ReadString(ref MessagePackReader reader, string field)
     {
         try
         {
@@ -640,4 +657,12 @@ internal abstract class MessagePackHubProtocolWorker
             throw new InvalidDataException($"Reading array length for '{field}' failed.", ex);
         }
     }
+
+    private static void ThrowIfNullOrEmpty([NotNull] string? target, string message)
+    {
+        if (string.IsNullOrEmpty(target))
+        {
+            throw new InvalidDataException($"Null or empty {message}.");
+        }
+    }
 }

src/SignalR/common/SignalR.Common/test/Internal/Protocol/MessagePackHubProtocolTestBase.cs

@@ -279,21 +279,28 @@ public abstract class MessagePackHubProtocolTestBase
             new InvalidMessageData("HeaderValueInt", new byte[] { 0x92, 1, 0x82, 0xa3, (byte)'f', (byte)'o', (byte)'o', 42 }, "Reading 'headers[0].Value' as String failed."),
             new InvalidMessageData("HeaderKeyArray", new byte[] { 0x92, 1, 0x84, 0xa3, (byte)'f', (byte)'o', (byte)'o', 0xa3, (byte)'f', (byte)'o', (byte)'o', 0x90, 0xa3, (byte)'f', (byte)'o', (byte)'o' }, "Reading 'headers[1].Key' as String failed."),
             new InvalidMessageData("HeaderValueArray", new byte[] { 0x92, 1, 0x84, 0xa3, (byte)'f', (byte)'o', (byte)'o', 0xa3, (byte)'f', (byte)'o', (byte)'o', 0xa3, (byte)'f', (byte)'o', (byte)'o', 0x90 }, "Reading 'headers[1].Value' as String failed."),
+            new InvalidMessageData("HeaderKeyEmptyString", new byte[] { 0x92, 1, 0x82, 0xa0, 0xa3, (byte)'f', (byte)'o', (byte)'o' }, "Null or empty key in header."),
+            new InvalidMessageData("HeaderValueEmptyString", new byte[] { 0x92, 1, 0x82, 0xa3, (byte)'f', (byte)'o', (byte)'o', 0xa0 }, "Null or empty value in header."),
 
             // InvocationMessage
             new InvalidMessageData("InvocationMissingId", new byte[] { 0x92, 1, 0x80 }, "Reading 'invocationId' as String failed."),
             new InvalidMessageData("InvocationIdBoolean", new byte[] { 0x91, 1, 0x80, 0xc2 }, "Reading 'invocationId' as String failed."),
             new InvalidMessageData("InvocationTargetMissing", new byte[] { 0x93, 1, 0x80, 0xa3, (byte)'a', (byte)'b', (byte)'c' }, "Reading 'target' as String failed."),
             new InvalidMessageData("InvocationTargetInt", new byte[] { 0x94, 1, 0x80, 0xa3, (byte)'a', (byte)'b', (byte)'c', 42 }, "Reading 'target' as String failed."),
+            new InvalidMessageData("InvocationTargetEmptyString", new byte[] { 0x94, 1, 0x80, 0xa3, (byte)'a', (byte)'b', (byte)'c', 0xa0 }, "Null or empty target for Invocation message."),
+            new InvalidMessageData("InvocationEmptyStringStreamId", new byte[] { 0x96, 1, 0x80, 0xa3, (byte)'a', (byte)'b', (byte)'c', 0xa1, (byte)'T', 0x91, 0xa0, 0x91, 0xa0 }, "Null or empty value in streamIds received."),
 
             // StreamInvocationMessage
             new InvalidMessageData("StreamInvocationMissingId", new byte[] { 0x92, 4, 0x80 }, "Reading 'invocationId' as String failed."),
+            new InvalidMessageData("StreamInvocationEmptyStringId", new byte[] { 0x93, 4, 0x80, 0xa0 }, "Null or empty invocation ID for StreamInvocation message."),
             new InvalidMessageData("StreamInvocationIdBoolean", new byte[] { 0x93, 4, 0x80, 0xc2 }, "Reading 'invocationId' as String failed."),
             new InvalidMessageData("StreamInvocationTargetMissing", new byte[] { 0x93, 4, 0x80, 0xa3, (byte)'a', (byte)'b', (byte)'c' }, "Reading 'target' as String failed."),
             new InvalidMessageData("StreamInvocationTargetInt", new byte[] { 0x94, 4, 0x80, 0xa3, (byte)'a', (byte)'b', (byte)'c', 42 }, "Reading 'target' as String failed."),
+            new InvalidMessageData("StreamInvocationTargetEmptyString", new byte[] { 0x94, 4, 0x80, 0xa3, (byte)'a', (byte)'b', (byte)'c', 0xa0 }, "Null or empty target for StreamInvocation message."),
 
             // StreamItemMessage
             new InvalidMessageData("StreamItemMissingId", new byte[] { 0x92, 2, 0x80 }, "Reading 'invocationId' as String failed."),
+            new InvalidMessageData("StreamItemEmptyStringId", new byte[] { 0x93, 2, 0x80, 0xa0 }, "Null or empty invocation ID for StreamItem message."),
             new InvalidMessageData("StreamItemInvocationIdBoolean", new byte[] { 0x93, 2, 0x80, 0xc2 }, "Reading 'invocationId' as String failed."),
 
             // These now trigger StreamBindingInvocationFailureMessages
@@ -302,6 +309,7 @@ public abstract class MessagePackHubProtocolTestBase
 
             // CompletionMessage
             new InvalidMessageData("CompletionMissingId", new byte[] { 0x92, 3, 0x80 }, "Reading 'invocationId' as String failed."),
+            new InvalidMessageData("CompletionEmptyStringId", new byte[] { 0x93, 3, 0x80, 0xa0 }, "Null or empty invocation ID for Completion message."),
             new InvalidMessageData("CompletionIdBoolean", new byte[] { 0x93, 3, 0x80, 0xc2 }, "Reading 'invocationId' as String failed."),
             new InvalidMessageData("CompletionResultKindString", new byte[] { 0x94, 3, 0x80, 0xa3, (byte)'x', (byte)'y', (byte)'z', 0xa3, (byte)'x', (byte)'y', (byte)'z' }, "Reading 'resultKind' as Int32 failed."),
             new InvalidMessageData("CompletionResultKindOutOfRange", new byte[] { 0x94, 3, 0x80, 0xa3, (byte)'x', (byte)'y', (byte)'z', 42 }, "Invalid invocation result kind."),
@@ -311,6 +319,10 @@ public abstract class MessagePackHubProtocolTestBase
             // These now result in CompletionMessages with the error field set
             //new InvalidMessageData("CompletionResultMissing", new byte[] { 0x94, 3, 0x80, 0xa3, (byte)'x', (byte)'y', (byte)'z', 0x03 }, "Deserializing object of the `String` type for 'argument' failed."),
             //new InvalidMessageData("CompletionResultTypeMismatch", new byte[] { 0x95, 3, 0x80, 0xa3, (byte)'x', (byte)'y', (byte)'z', 0x03, 42 }, "Deserializing object of the `String` type for 'argument' failed."),
+
+            // CancelInvocationMessage
+            new InvalidMessageData("CancelInvocationMissingId", new byte[] { 0x92, 5, 0x80 }, "Reading 'invocationId' as String failed."),
+            new InvalidMessageData("CancelInvocationEmptyStringId", new byte[] { 0x93, 5, 0x80, 0xa0 }, "Null or empty invocation ID for CancelInvocation message."),
         }.ToDictionary(t => t.Name);
 
     public static IEnumerable<object[]> BaseInvalidPayloadNames => BaseInvalidPayloads.Keys.Select(name => new object[] { name });

src/SignalR/server/SignalR/test/HubConnectionHandlerTests.cs

@@ -2592,8 +2592,7 @@ public partial class HubConnectionHandlerTests : VerifiableLoggedTest
         {
             public T Deserialize(ref MessagePackReader reader, MessagePackSerializerOptions options)
             {
-                // this method isn't used in our tests
-                return default;
+                return (T)(object)reader.ReadString();
             }
 
             public void Serialize(ref MessagePackWriter writer, T value, MessagePackSerializerOptions options)

src/SignalR/server/StackExchangeRedis/src/Internal/RedisProtocol.cs

@@ -184,7 +184,7 @@ internal sealed class RedisProtocol
             var ids = new string[idCount];
             for (var i = 0; i < idCount; i++)
             {
-                ids[i] = reader.ReadString();
+                ids[i] = reader.ReadString()!;
             }
 
             excludedConnectionIds = ids;
@@ -210,10 +210,10 @@ internal sealed class RedisProtocol
         ValidateArraySize(ref reader, 5, "GroupCommand");
 
         var id = reader.ReadInt32();
-        var serverName = reader.ReadString();
+        var serverName = reader.ReadString()!;
         var action = (GroupAction)reader.ReadByte();
-        var groupName = reader.ReadString();
-        var connectionId = reader.ReadString();
+        var groupName = reader.ReadString()!;
+        var connectionId = reader.ReadString()!;
 
         return new RedisGroupCommand(id, serverName, action, groupName, connectionId);
     }
@@ -252,7 +252,7 @@ internal sealed class RedisProtocol
         var serializations = new SerializedMessage[count];
         for (var i = 0; i < count; i++)
         {
-            var protocol = reader.ReadString();
+            var protocol = reader.ReadString()!;
             var serialized = reader.ReadBytes()?.ToArray() ?? Array.Empty<byte>();
 
             serializations[i] = new SerializedMessage(protocol, serialized);
@@ -267,7 +267,7 @@ internal sealed class RedisProtocol
         var reader = new MessagePackReader(data);
         ValidateArraySize(ref reader, 2, "CompletionMessage");
 
-        var protocolName = reader.ReadString();
+        var protocolName = reader.ReadString()!;
         var ros = reader.ReadBytes();
         return new RedisCompletion(protocolName, ros ?? new ReadOnlySequence<byte>());
     }