-
-
-
-
-
----
-
# System.Linq.Dynamic.Core
This is a **.NET Core / Standard port** of the Microsoft assembly for the .Net 4.0 Dynamic language functionality.
+---
+
## Overview
With this library it's possible to write Dynamic LINQ queries (string based) on an `IQueryable`:
``` c#
@@ -30,10 +20,24 @@ int c = 10;
db.Customers.WhereInterpolated($"City == {cityName} and Orders.Count >= {c}");
```
+---
+
+## Sponsors
+
+ZZZ Projects owns and maintains **System.Linq.Dynamic.Core** as part of our [mission](https://zzzprojects.com/mission) to add value to the .NET community
+
+Through [Entity Framework Extensions](https://entityframework-extensions.net/?utm_source=zzzprojects&utm_medium=systemlinqdynamiccore) and [Dapper Plus](https://dapper-plus.net/?utm_source=zzzprojects&utm_medium=systemlinqdynamiccore), we actively sponsor and help key open-source libraries grow.
+
+[](https://entityframework-extensions.net/bulk-insert?utm_source=zzzprojects&utm_medium=systemlinqdynamiccore)
+
+[](https://dapper-plus.net/bulk-insert?utm_source=zzzprojects&utm_medium=systemlinqdynamiccore)
+
+---
+
## :exclamation: Breaking changes
### v1.3.0
-A breaking change is introduced in version 1.3.0 which is related to calling methods on classes.
+A breaking change is introduced in this version which is related to calling methods on classes.
Due to security reasons, it's now only allowed to call methods on the standard predefined classes like (`bool`, `int`, `string` ...).
If you want to call a method on an own custom class, annotate that class with the [DynamicLinqType](https://dynamic-linq.net/advanced-extending#dynamiclinqtype-attribute).
Example:
@@ -44,11 +48,29 @@ public class MyCustomClass
public int GetAge(int x) => x;
}
```
+If it's not possible to add that attribute, you need to implement a custom [CustomTypeProvider](https://dynamic-linq.net/advanced-configuration#customtypeprovider) and set this to the `ParsingConfig` and provide that config to all dynamic calls.
+Or provide a list of additional types in the [DefaultDynamicLinqCustomTypeProvider.cs](https://github.com/zzzprojects/System.Linq.Dynamic.Core/blob/master/src/System.Linq.Dynamic.Core/CustomTypeProviders/DefaultDynamicLinqCustomTypeProvider.cs).
+
+### v1.6.0
+#### Change 1
+It's not allowed anymore to call any methods on the `object` type. By default also the `ToString` and `Equals` methods are not allowed.
+This is done to mitigate the risk of calling methods on the `object` type which could lead to security issues (CVE-2024-51417).
+To allow these methods set `AllowEqualsAndToStringMethodsOnObject` to `true` in the `ParsingConfig` and provide that config to all dynamic calls.
+
+#### Change 2
+By default the `RestrictOrderByToPropertyOrField` is now set to `true` in the `ParsingConfig`.
+Which means that only properties and fields can be used in the `OrderBy` / `ThenBy`.
+This is done to mitigate the risk of calling methods or other expressions in the `OrderBy` / `ThenBy` which could lead to security issues.
+To allow these methods set `RestrictOrderByToPropertyOrField` to `false` in the `ParsingConfig` and provide that config to all dynamic calls.
+
+#### Change 3
+The `DefaultDynamicLinqCustomTypeProvider` has been changed to only return types which have the `[DynamicLinqType]` attribute applied.
+If it's not possible to add that attribute, you need to implement a custom [CustomTypeProvider](https://dynamic-linq.net/advanced-configuration#customtypeprovider) and set this to the `ParsingConfig` and provide that config to all dynamic calls.
+Or provide a list of additional types in the [DefaultDynamicLinqCustomTypeProvider.cs](https://github.com/zzzprojects/System.Linq.Dynamic.Core/blob/master/src/System.Linq.Dynamic.Core/CustomTypeProviders/DefaultDynamicLinqCustomTypeProvider.cs).
-If it's not possible to add that attribute, you need to implement a custom [CustomTypeProvider](https://dynamic-linq.net/advanced-configuration#customtypeprovider) and set this to the `ParsingConfig` and provide that config to the dynamic call.
+---
## Useful links
-
- [Website](https://dynamic-linq.net)
- [Documentation](https://dynamic-linq.net/overview)
- [Online examples](https://dynamic-linq.net/online-examples)
@@ -62,13 +84,16 @@ If it's not possible to add that attribute, you need to implement a custom [Cust
| **Issues** | [](https://github.com/StefH/System.Linq.Dynamic.Core/issues) |
| | |
| ***Quality*** | |
-| **CI Workflow** |  |
+| **CI Workflow** | [](https://github.com/zzzprojects/System.Linq.Dynamic.Core/actions/workflows/ci.yml) |
+| **SonarCloud** | [](https://sonarcloud.io/summary/new_code?id=zzzprojects_System.Linq.Dynamic.Core) |
| |
| ***NuGet*** | |
-| **System.Linq.Dynamic.Core** | [](https://www.nuget.org/packages/System.Linq.Dynamic.Core) |
-| **EntityFramework.DynamicLinq** | [](https://www.nuget.org/packages/EntityFramework.DynamicLinq) |
-| **Microsoft.EntityFrameworkCore.DynamicLinq** | [](https://www.nuget.org/packages/Microsoft.EntityFrameworkCore.DynamicLinq) |
-| **Z.EntityFramework.Classic.DynamicLinq** | [](https://www.nuget.org/packages/Z.EntityFramework.Classic.DynamicLinq) |
+| **System.Linq.Dynamic.Core** | [](https://www.nuget.org/packages/System.Linq.Dynamic.Core) |
+| **EntityFramework.DynamicLinq** | [](https://www.nuget.org/packages/EntityFramework.DynamicLinq) |
+| **Microsoft.EntityFrameworkCore.DynamicLinq** | [](https://www.nuget.org/packages/Microsoft.EntityFrameworkCore.DynamicLinq) |
+| **Z.EntityFramework.Classic.DynamicLinq** | [](https://www.nuget.org/packages/Z.EntityFramework.Classic.DynamicLinq) |
+| **Z.DynamicLinq.SystemTextJson** | [](https://www.nuget.org/packages/Z.DynamicLinq.SystemTextJson) |
+| **Z.DynamicLinq.NewtonsoftJson** | [](https://www.nuget.org/packages/Z.DynamicLinq.NewtonsoftJson) |
## Development Details
@@ -76,14 +101,14 @@ If it's not possible to add that attribute, you need to implement a custom [Cust
The following frameworks are supported:
- net35, net40, net45, net46 and up
- netstandard1.3, netstandard2.0 and netstandard2.1
-- netcoreapp3.1, net5.0, net6.0 and net7.0
+- netcoreapp3.1, net5.0, net6.0, net7.0, net8.0 and net9.0
- uap10.0
### Fork details
-This fork takes the basic library to a new level. Contains XML Documentation and examples on how to use it. Also adds unit testing to help ensure that it works properly.
+This fork takes the basic library to a new level. Also adds unit tests to help ensure that it works properly.
Some background:
-I forked from https://github.com/NArnott/System.Linq.Dynamic and added some more functionality there.