UA-.NETStandard

GithubStar/UA-.NETStandard

Fork 0

mirror of https://github.com/OPCFoundation/UA-.NETStandard.git synced 2026-10-17 05:11:13 +08:00

Commit Graph

Author	SHA1	Message	Date
romanett	9b034f8291	Enable nullable reference types centrally; migrate all unset and annotations-only projects (#4700 ) # Description Nullable reference types are now enabled once, in `common.props`, and every project in the repository builds warning-clean with them. Configuration - `<Nullable>enable</Nullable>` lives in `common.props`. All per-project `<Nullable>` settings are removed: 178 project files (enable, annotations, and the `disable` in the three Aot test projects). - 419 per-file `#nullable enable`/`restore` directives and the 4 `#nullable disable` directives are removed. - Kept on purpose: - The 5 `<auto-generated>` schema files (`UANodeSet.cs`, `UA Type Dictionary.cs`, `OPCBinarySchema.cs`, `SecuredApplication.cs`, `PInvokeHelper.cs`) keep `#nullable enable`. The compiler ignores the project setting in generated code, so the directive is required there. - `tests/Opc.Ua.Interop.LegacyPeer` keeps `disable`. It builds against the 1.5.378 packages and does not import the repository props. - `docs/DeveloperGuide.md` and `.github/copilot-instructions.md` now describe the central setting. Migration (the 43 unset and 13 annotations-only projects, roughly 10k diagnostics) - Production code: annotated at the declarations. Covers `tools/Opc.Ua.SourceGeneration.Core`, `src/Opc.Ua.Lds.Server` and the LDS sample. - Members, parameters and returns are nullable where null actually flows. - Null-check helpers carry `[NotNullWhen]` (`IsNull`, `IsValidXmlName`, `IsMethodTypeDesign`). - `CoreUtils.Format`, `Utils.Format`, `ITemplateWriter.WriteLine` take `params object?[]`. `Template.AddReplacement` takes `string?` (rendering already skips null replacements). - `IRegisteredServerStore.RegisterAsync` returns `Task<RegistrationEntry?>`: it returns null when a registration is removed. - Dereferences backed by an invariant (for example, the validated model) use `!`, so runtime behaviour is unchanged. - Behavioural changes in production code (small, deliberate): - `NodeSetToModelDesign` throws `InvalidOperationException` when the file is not a NodeSet. Before, it threw a NullReferenceException on the next line. - `ModelDesignValidator` starts its lookup tables empty instead of null. A redundant `if (m_nodes == null) return;` guard is gone. - Test code: minimal annotations. - `?` on values that can be null, `!` where the test asserts non-null. - `= null!` for fixture members assigned in SetUp. - `TryGetStructure<T>(out T? x)` where the inferred `T?` broke the `IEncodeable` constraint. - A few redundant `== null` checks on structs (`NodeId`, `ArrayOf<T>`) folded into the adjacent `IsNull`/`Count` checks. Notes for reviewers - The diff is large (~1,500 files) but almost entirely mechanical: `?`, `!` and directive removal. The non-annotation changes are listed above. - Known follow-up, not done here: `IModelDesign.Namespaces/TargetNamespace/NamespaceUris` stay non-nullable even though the validator returns null before it loads a dictionary. Making them nullable would ripple through every generator call site. ## Related Issues - Fixes #4439 ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. The "no new warnings" box covers net10.0 and net48: full non-incremental builds of `UA.slnx`, `tools/SourceGeneration.slnx`, `tools/MigrationAnalyzer.slnx` and the Aot test projects finished with 0 warnings and 0 errors under the repository's warnings-as-errors settings. net9.0 and net8.0 also had no nullable diagnostics, but they were not rebuilt after the final fixes. Tests have not been run locally yet. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 08:48:13 +02:00
Klaus Landsdorf	f9a5e96600	OneFuzz validator: accept drop files reported through resolved links (#4640 ) # Description `ContractPaths.Relative` now also compares a path that seems to escape against the root's real location, with every link along it resolved. Links inside the drop are still rejected, because every caller resolves the returned relative path segment by segment. The new contract test `DropReachedThroughALinkedDirectoryIsValidatedAsync` validates a drop through a directory link and fails on every platform without the fix. Its link is created like the one in the existing link test (a junction on Windows, a symlink elsewhere), now through one shared helper, so it needs no privileges and is never skipped. Tests: - On macOS, master passes 53 of 209 contract tests; with the fix 210/210 on net10.0 (Release, 0 skipped). - Fork CI (full matrix incl. macOS) and CodeQL: green on `358eb33d5` (the same change on master `029ac0f33`) — [CI run 36892610480](https://github.com/biancode/UA-.NETStandard/actions/runs/36892610480) (189 jobs), [CodeQL run 36892614293](https://github.com/biancode/UA-.NETStandard/actions/runs/36892614293). The branch is now on a newer master with no overlapping files; the run on the current head is in progress: [CI run 37016188861](https://github.com/biancode/UA-.NETStandard/actions/runs/37016188861). ## Related Issues - Fixes #4639 ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. (Affected suites on net10.0 and net8.0 locally on macOS; .NET Framework is covered by the fork CI's Windows net48 legs.) - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received.	2026-10-03 05:42:35 +02:00
Marc Schier	f5ad124891	Additional fuzzing plus fixes for every defect the campaigns found (#4459 ) # Description Brings the stack's fuzz testing to parity with the fork (`aio-opcua-sdk`), then fixes every defect the resulting campaigns exposed. The fork's fuzzing was used as the behavioural baseline: all 28 fork-local callbacks and 13 OneFuzz registrations are now accounted for by an explicit mapping, not just by a larger target count. The work extends the existing SharpFuzz/NUnit infrastructure rather than introducing another framework. ### Coverage - 84 continuous libFuzzer targets and 81 AFL adapters across Encoders, Certificates, Network and PubSub. - PubSub area integrated (Corpus/Tools/Tests siblings, solution entries) — it previously had host source only and was absent from the solution and replay infrastructure. - Segmented binary adapters, binary-to-JSON and XML-to-JSON conversions, standalone certificate loading, both chain-parser variants, CRL encoding and canonical TBS round-trips. - The 12 original fork message inputs are retained byte-identically alongside richer deterministic generators; the three historical crash/slow/timeout reproducers are unchanged (verified identical by SHA-256). ### Production fixes found by fuzzing These are real robustness and data-integrity bugs, each with a retained regression input: - `UadpBinaryReader.Advance` accepted attacker-controlled lengths on the receive path. Declared payload sizes are now authoritative bounded sections, with negative-count rejection and overflow-safe reassembly arithmetic. - PubSub JSON decoding leaked `InvalidOperationException` for invalid UTF-8. - `JsonEncoder.WriteExtensionObject` leaked `System.Text.Json.JsonReaderException`. - `JsonEncoder` silently emitted a lossy `{}` for an `ExtensionObject` whose TypeId could not be represented in JSON. - `JsonDecoder` wrapped a bodyless `ExtensionObject` envelope as a raw JSON body instead of preserving `ExtensionObjectEncoding.None`. - `Node.Encode` lost the null/empty collection distinction. - Binary/XML Variant matrix dimensions are prevalidated rather than relying on a caught `ArgumentException`. - `X509CRL.ReadTime` pre-validates strict RFC 5280 whole-second Zulu time forms. - `Utils.ParseCertificateChainBlob` disposes correctly on partial-chain failure. - `nodeid.dict` was unloadable by libFuzzer (empty token, unescaped quote). libFuzzer rejects the whole file on one bad line, so four parser targets silently executed zero inputs. Fixed and now guarded by dictionary validation. ### Infrastructure - `fuzzing/fuzz-targets.json` manifest recording adapters, corpora, dictionaries, oracles and fork-behaviour mappings, with `validate-fuzz-manifest.ps1` and 27 negative controls. - Strict host/tools discovery and replay: `--list`, `--replay`, non-zero exits on unknown targets, missing or empty corpora, and failed callbacks (playback previously logged failures and returned success). - A real process watchdog for the timeout/slow regressions — NUnit `CancelAfter` cannot interrupt a synchronous fuzz callback. - Runner scripts made non-destructive (unique work directories, no generic `bin`/findings deletion) and corrected to the native driver's single-`--target_arg` apphost contract. - Opt-in `OneFuzz=true` class-library publication producing a relocatable, uninstrumented drop, validated by exact callback discovery, dependency closure, corpora and dictionaries. - CI: fuzz replay matrix plus a public drop gate, triggered by corpus-, dictionary- and script-only changes. ### Verification \| Gate \| Result \| \|---\|---\| \| Bounded campaigns, all 84 targets (1,000 inputs, seed 1) \| 84/84, 84,000 executions, zero findings \| \| OneFuzz drop \| 84/84 published callbacks replayed, zero skips \| \| Fuzz replay net10.0 / net8.0 / net9.0 \| 9,470 passed each, 0 failed \| \| Fuzz replay net48 \| 8,996 passed, 0 failed (Network/PubSub are modern-only) \| \| `Opc.Ua.Types.Tests` / `Opc.Ua.Core.Tests` \| 9,800 and 4,442 passed, 0 failed \| \| Retained regression assets \| 132 `crash-` inputs replayed by every target each run \| ### Known gaps (deliberately not closed) - Fidelity is not enforced against the pipeline crash corpus.* The differential binary-to-JSON targets assert both robustness (no unhandled exception, expected of arbitrary bytes) and fidelity (a decoded value re-encodes equivalently, a property of well formed values). The pipeline supplies 22,293 blobs collected for the targets that existed before this PR, none of which asserted fidelity; 522 of them violate it, and that count did not move across two rounds of genuine fixes because each fix only lets the mutator reach the next representability gap. Rather than weaken the assertion, the two contracts are separated: fidelity failures raise `EncodingFidelityException`; curated assets under `Assets/Repo`, the curated `Testcases` corpus and every continuous libFuzzer campaign stay strictly enforced, while externally supplied assets are gated on robustness only and their fidelity findings are reported with counts and bounded base64 reproducers. - Internal MSFT OneFuzz canary has not been run. It needs an owner-supplied ownership profile, pipeline authorisation and corpus snapshot; none were available. The drop builds and validates locally and records `serviceCanaryPerformed: false`. A build or upload is not a successful worker run. - Legacy JSON wire forms are a partial mapping. The fork accepts its four original `TypeId`/`Body` messages; this stack rejects that retired envelope (measured JSON-only control: fork `JsonEncoder` 630/1356 lines vs 0/1007 here). Recorded as an explicit unresolved mapping rather than an exemption. `LegacyNonReversible` is a RawData-derived profile and is not counted as independent coverage. ## Related Issues _No tracking issue was supplied for this work; happy to open one and link it if maintainers prefer._ - Fixes #github-issue-number, ... ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. > Note on the checklist: the fuzz replay matrix, `Opc.Ua.Types.Tests` and `Opc.Ua.Core.Tests` were run locally on net48 and net10.0 (plus net8.0/net9.0) and all passed. CI and CodeQL results are not yet available for this branch, so those boxes are left unchecked. The CLA box is for the author to confirm.	2026-09-10 05:56:31 +02:00

Author

SHA1

Message

Date

romanett

9b034f8291

Enable nullable reference types centrally; migrate all unset and annotations-only projects (#4700 )

# Description

Nullable reference types are now enabled once, in `common.props`, and
every project in the repository builds warning-clean with them.

**Configuration**
- `<Nullable>enable</Nullable>` lives in `common.props`. All per-project
`<Nullable>` settings are removed: 178 project files (enable,
annotations, and the `disable` in the three Aot test projects).
- 419 per-file `#nullable enable`/`restore` directives and the 4
`#nullable disable` directives are removed.
- Kept on purpose:
- The 5 `<auto-generated>` schema files (`UANodeSet.cs`, `UA Type
Dictionary.cs`, `OPCBinarySchema.cs`, `SecuredApplication.cs`,
`PInvokeHelper.cs`) keep `#nullable enable`. The compiler ignores the
project setting in generated code, so the directive is required there.
- `tests/Opc.Ua.Interop.LegacyPeer` keeps `disable`. It builds against
the 1.5.378 packages and does not import the repository props.
- `docs/DeveloperGuide.md` and `.github/copilot-instructions.md` now
describe the central setting.

**Migration** (the 43 unset and 13 annotations-only projects, roughly
10k diagnostics)
- **Production code: annotated at the declarations.** Covers
`tools/Opc.Ua.SourceGeneration.Core`, `src/Opc.Ua.Lds.Server` and the
LDS sample.
- Members, parameters and returns are nullable where null actually
flows.
- Null-check helpers carry `[NotNullWhen]` (`IsNull`, `IsValidXmlName`,
`IsMethodTypeDesign`).
- `CoreUtils.Format`, `Utils.Format`, `ITemplateWriter.WriteLine` take
`params object?[]`. `Template.AddReplacement` takes `string?` (rendering
already skips null replacements).
- `IRegisteredServerStore.RegisterAsync` returns
`Task<RegistrationEntry?>`: it returns null when a registration is
removed.
- Dereferences backed by an invariant (for example, the validated model)
use `!`, so runtime behaviour is unchanged.
- **Behavioural changes in production code** (small, deliberate):
- `NodeSetToModelDesign` throws `InvalidOperationException` when the
file is not a NodeSet. Before, it threw a NullReferenceException on the
next line.
- `ModelDesignValidator` starts its lookup tables empty instead of null.
A redundant `if (m_nodes == null) return;` guard is gone.
- **Test code: minimal annotations.**
  - `?` on values that can be null, `!` where the test asserts non-null.
  - `= null!` for fixture members assigned in SetUp.
- `TryGetStructure<T>(out T? x)` where the inferred `T?` broke the
`IEncodeable` constraint.
- A few redundant `== null` checks on structs (`NodeId`, `ArrayOf<T>`)
folded into the adjacent `IsNull`/`Count` checks.

**Notes for reviewers**
- The diff is large (~1,500 files) but almost entirely mechanical: `?`,
`!` and directive removal. The non-annotation changes are listed above.
- Known follow-up, not done here:
`IModelDesign.Namespaces/TargetNamespace/NamespaceUris` stay
non-nullable even though the validator returns null before it loads a
dictionary. Making them nullable would ripple through every generator
call site.

## Related Issues

- Fixes #4439

## Checklist

- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [ ] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

The "no new warnings" box covers net10.0 and net48: full non-incremental
builds of `UA.slnx`, `tools/SourceGeneration.slnx`,
`tools/MigrationAnalyzer.slnx` and the Aot test projects finished with 0
warnings and 0 errors under the repository's warnings-as-errors
settings. net9.0 and net8.0 also had no nullable diagnostics, but they
were not rebuilt after the final fixes. Tests have not been run locally
yet.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-08 08:48:13 +02:00

Klaus Landsdorf

f9a5e96600

OneFuzz validator: accept drop files reported through resolved links (#4640 )

# Description

`ContractPaths.Relative` now also compares a path that seems to escape
against the root's real location, with every link along it resolved.
Links inside the drop are still rejected, because every caller resolves
the returned relative path segment by segment.

The new contract test
`DropReachedThroughALinkedDirectoryIsValidatedAsync` validates a drop
through a directory link and fails on every platform without the fix.
Its link is created like the one in the existing link test (a junction
on Windows, a symlink elsewhere), now through one shared helper, so it
needs no privileges and is never skipped.

Tests:

- On macOS, master passes 53 of 209 contract tests; with the fix 210/210
on net10.0 (Release, 0 skipped).
- Fork CI (full matrix incl. macOS) and CodeQL: green on `358eb33d5`
(the same change on master `029ac0f33`) — [CI run
36892610480](https://github.com/biancode/UA-.NETStandard/actions/runs/36892610480)
(189 jobs), [CodeQL run
36892614293](https://github.com/biancode/UA-.NETStandard/actions/runs/36892614293).
The branch is now on a newer master with no overlapping files; the run
on the current head is in progress: [CI run
37016188861](https://github.com/biancode/UA-.NETStandard/actions/runs/37016188861).

## Related Issues

- Fixes #4639

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed. (Affected
suites on net10.0 and net8.0 locally on macOS; .NET Framework is covered
by the fork CI's Windows net48 legs.)
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

2026-10-03 05:42:35 +02:00

Marc Schier

f5ad124891

Additional fuzzing plus fixes for every defect the campaigns found (#4459 )

# Description

Brings the stack's fuzz testing to parity with the fork
(`aio-opcua-sdk`), then fixes every defect the resulting campaigns
exposed.

The fork's fuzzing was used as the behavioural baseline: all **28
fork-local callbacks** and **13 OneFuzz registrations** are now
accounted for by an explicit mapping, not just by a larger target count.
The work extends the existing SharpFuzz/NUnit infrastructure rather than
introducing another framework.

### Coverage

- **84 continuous libFuzzer targets** and **81 AFL adapters** across
Encoders, Certificates, Network and PubSub.
- **PubSub area integrated** (Corpus/Tools/Tests siblings, solution
entries) — it previously had host source only and was absent from the
solution and replay infrastructure.
- Segmented binary adapters, binary-to-JSON and XML-to-JSON conversions,
standalone certificate loading, both chain-parser variants, CRL encoding
and canonical TBS round-trips.
- The 12 original fork message inputs are retained byte-identically
alongside richer deterministic generators; the three historical
crash/slow/timeout reproducers are unchanged (verified identical by
SHA-256).

### Production fixes found by fuzzing

These are real robustness and data-integrity bugs, each with a retained
regression input:

- `UadpBinaryReader.Advance` accepted attacker-controlled lengths on the
receive path. Declared payload sizes are now authoritative bounded
sections, with negative-count rejection and overflow-safe reassembly
arithmetic.
- PubSub JSON decoding leaked `InvalidOperationException` for invalid
UTF-8.
- `JsonEncoder.WriteExtensionObject` leaked
`System.Text.Json.JsonReaderException`.
- `JsonEncoder` silently emitted a lossy `{}` for an `ExtensionObject`
whose TypeId could not be represented in JSON.
- `JsonDecoder` wrapped a bodyless `ExtensionObject` envelope as a raw
JSON body instead of preserving `ExtensionObjectEncoding.None`.
- `Node.Encode` lost the null/empty collection distinction.
- Binary/XML Variant matrix dimensions are prevalidated rather than
relying on a caught `ArgumentException`.
- `X509CRL.ReadTime` pre-validates strict RFC 5280 whole-second Zulu
time forms.
- `Utils.ParseCertificateChainBlob` disposes correctly on partial-chain
failure.
- **`nodeid.dict` was unloadable by libFuzzer** (empty token, unescaped
quote). libFuzzer rejects the whole file on one bad line, so four parser
targets silently executed **zero** inputs. Fixed and now guarded by
dictionary validation.

### Infrastructure

- `fuzzing/fuzz-targets.json` manifest recording adapters, corpora,
dictionaries, oracles and fork-behaviour mappings, with
`validate-fuzz-manifest.ps1` and **27 negative controls**.
- Strict host/tools discovery and replay: `--list`, `--replay`, non-zero
exits on unknown targets, missing or empty corpora, and failed callbacks
(playback previously logged failures and returned success).
- A real process watchdog for the timeout/slow regressions — NUnit
`CancelAfter` cannot interrupt a synchronous fuzz callback.
- Runner scripts made non-destructive (unique work directories, no
generic `bin`/findings deletion) and corrected to the native driver's
single-`--target_arg` apphost contract.
- Opt-in `OneFuzz=true` class-library publication producing a
relocatable, **uninstrumented** drop, validated by exact callback
discovery, dependency closure, corpora and dictionaries.
- CI: fuzz replay matrix plus a public drop gate, triggered by corpus-,
dictionary- and script-only changes.

### Verification

| Gate | Result |
|---|---|
| Bounded campaigns, all 84 targets (1,000 inputs, seed 1) | 84/84,
84,000 executions, zero findings |
| OneFuzz drop | 84/84 published callbacks replayed, zero skips |
| Fuzz replay net10.0 / net8.0 / net9.0 | 9,470 passed each, 0 failed |
| Fuzz replay net48 | 8,996 passed, 0 failed (Network/PubSub are
modern-only) |
| `Opc.Ua.Types.Tests` / `Opc.Ua.Core.Tests` | 9,800 and 4,442 passed, 0
failed |
| Retained regression assets | 132 `crash-*` inputs replayed by every
target each run |

### Known gaps (deliberately not closed)

- **Fidelity is not enforced against the pipeline crash corpus.** The
differential binary-to-JSON targets assert both robustness (no unhandled
exception, expected of arbitrary bytes) and fidelity (a decoded value
re-encodes equivalently, a property of well formed values). The pipeline
supplies 22,293 blobs collected for the targets that existed before this
PR, none of which asserted fidelity; 522 of them violate it, and that
count did not move across two rounds of genuine fixes because each fix
only lets the mutator reach the next representability gap. Rather than
weaken the assertion, the two contracts are separated: fidelity failures
raise `EncodingFidelityException`; curated assets under `Assets/Repo`,
the curated `Testcases` corpus and every continuous libFuzzer campaign
stay strictly enforced, while externally supplied assets are gated on
robustness only and their fidelity findings are reported with counts and
bounded base64 reproducers.
- **Internal MSFT OneFuzz canary has not been run.** It needs an
owner-supplied ownership profile, pipeline authorisation and corpus
snapshot; none were available. The drop builds and validates locally and
records `serviceCanaryPerformed: false`. A build or upload is not a
successful worker run.
- **Legacy JSON wire forms are a partial mapping.** The fork accepts its
four original `TypeId`/`Body` messages; this stack rejects that retired
envelope (measured JSON-only control: fork `JsonEncoder` 630/1356 lines
vs 0/1007 here). Recorded as an explicit unresolved mapping rather than
an exemption. `LegacyNonReversible` is a RawData-derived profile and is
not counted as independent coverage.

## Related Issues

_No tracking issue was supplied for this work; happy to open one and
link it if maintainers prefer._

- Fixes #github-issue-number, ...

## Checklist

- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

> Note on the checklist: the fuzz replay matrix, `Opc.Ua.Types.Tests`
and `Opc.Ua.Core.Tests` were run locally on **net48** and **net10.0**
(plus net8.0/net9.0) and all passed. CI and CodeQL results are not yet
available for this branch, so those boxes are left unchecked. The CLA
box is for the author to confirm.

2026-09-10 05:56:31 +02:00

3 Commits