Fix CodeQL SM02211 alert - SerializationBinder

[sw-joelmut]

Fixes #6515 #6516 #6517 #6519 #6520

Description

This PR fixes the CodeQL SM02211 alert related to unsafe JsonSerializer TypeNameHandling usage.
For these cases, it implements a custom SerializationBinder, allowing only the types that are defined in the configuration or related ones.

Specific Changes

• Adds the AllowedTypesSerializationBinder class to allow only types that are defined in the instance.
• Adds tests for the AllowedTypesSerializationBinder class.
• Updated BlobsStorage, AzureBlobStorage, and CosmosDbPartitionedStorage classes to implement the binder.
• Updated BlobsTranscriptStore setting the TypeNameHandling to None.

Testing

The following image shows the tests passing successfully and the error message when a type isn't allowed by the process.

[tracyboehrer]

@sw-joelmut This is getting some test failures in the storage tests. Here is one:

  Failed Microsoft.Bot.Builder.Azure.Tests.CosmosDbPartitionedStorageTests.WriteAsyncFailure [357 ms]
  Error Message:
   Assert.Throws() Failure
Expected: typeof(Microsoft.Azure.Cosmos.CosmosException)
Actual:   typeof(System.InvalidOperationException): Unable to find the following types in the 'AllowedTypes' collection.
  - <>f__AnonymousType0, Microsoft.Bot.Builder.Azure.Tests, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null

Please provide the 'AllowedTypesSerializationBinder' in the custom 'JsonSerializerSettings' instance, with the list of types to allow.

Example:
    new JsonSerializerSettings
    {
        SerializationBinder = new AllowedTypesSerializationBinder(
            new List<Type>
            {
                typeof(<>f__AnonymousType0),
            }),
    }
---- System.InvalidOperationException : Unable to find the following types in the 'AllowedTypes' collection.
  - <>f__AnonymousType0, Microsoft.Bot.Builder.Azure.Tests, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null

Please provide the 'AllowedTypesSerializationBinder' in the custom 'JsonSerializerSettings' instance, with the list of types to allow.

Example:
    new JsonSerializerSettings
    {
        SerializationBinder = new AllowedTypesSerializationBinder(
            new List<Type>
            {
                typeof(<>f__AnonymousType0),
            }),
    }
  Stack Trace:
     at Microsoft.Bot.Builder.AllowedTypesSerializationBinder.ThrowDisallowedTypesError(List`1 types) in /Users/runner/work/1/s/libraries/Microsoft.Bot.Builder/AllowedTypesSerializationBinder.cs:line 170
   at Microsoft.Bot.Builder.AllowedTypesSerializationBinder.CleanupTypes(JContainer json) in /Users/runner/work/1/s/libraries/Microsoft.Bot.Builder/AllowedTypesSerializationBinder.cs:line 148
   at Microsoft.Bot.Builder.Azure.CosmosDbPartitionedStorage.WriteAsync(IDictionary`2 changes, CancellationToken cancellationToken) in /Users/runner/work/1/s/libraries/Microsoft.Bot.Builder.Azure/CosmosDbPartitionedStorage.cs:line 220
----- Inner Stack Trace -----
   at Microsoft.Bot.Builder.AllowedTypesSerializationBinder.ThrowDisallowedTypesError(List`1 types) in /Users/runner/work/1/s/libraries/Microsoft.Bot.Builder/AllowedTypesSerializationBinder.cs:line 170
   at Microsoft.Bot.Builder.AllowedTypesSerializationBinder.CleanupTypes(JContainer json) in /Users/runner/work/1/s/libraries/Microsoft.Bot.Builder/AllowedTypesSerializationBinder.cs:line 148
   at Microsoft.Bot.Builder.Azure.CosmosDbPartitionedStorage.WriteAsync(IDictionary`2 changes, CancellationToken cancellationToken) in /Users/runner/work/1/s/libraries/Microsoft.Bot.Builder.Azure/CosmosDbPartitionedStorage.cs:line 220

[sw-joelmut]

@sw-joelmut This is getting some test failures in the storage tests. Here is one:

  Failed Microsoft.Bot.Builder.Azure.Tests.CosmosDbPartitionedStorageTests.WriteAsyncFailure [357 ms]
  Error Message:
   Assert.Throws() Failure
Expected: typeof(Microsoft.Azure.Cosmos.CosmosException)
Actual:   typeof(System.InvalidOperationException): Unable to find the following types in the 'AllowedTypes' collection.
  - <>f__AnonymousType0, Microsoft.Bot.Builder.Azure.Tests, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null

Please provide the 'AllowedTypesSerializationBinder' in the custom 'JsonSerializerSettings' instance, with the list of types to allow.

Example:
    new JsonSerializerSettings
    {
        SerializationBinder = new AllowedTypesSerializationBinder(
            new List<Type>
            {
                typeof(<>f__AnonymousType0),
            }),
    }
---- System.InvalidOperationException : Unable to find the following types in the 'AllowedTypes' collection.
  - <>f__AnonymousType0, Microsoft.Bot.Builder.Azure.Tests, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null

Please provide the 'AllowedTypesSerializationBinder' in the custom 'JsonSerializerSettings' instance, with the list of types to allow.

Example:
    new JsonSerializerSettings
    {
        SerializationBinder = new AllowedTypesSerializationBinder(
            new List<Type>
            {
                typeof(<>f__AnonymousType0),
            }),
    }
  Stack Trace:
     at Microsoft.Bot.Builder.AllowedTypesSerializationBinder.ThrowDisallowedTypesError(List`1 types) in /Users/runner/work/1/s/libraries/Microsoft.Bot.Builder/AllowedTypesSerializationBinder.cs:line 170
   at Microsoft.Bot.Builder.AllowedTypesSerializationBinder.CleanupTypes(JContainer json) in /Users/runner/work/1/s/libraries/Microsoft.Bot.Builder/AllowedTypesSerializationBinder.cs:line 148
   at Microsoft.Bot.Builder.Azure.CosmosDbPartitionedStorage.WriteAsync(IDictionary`2 changes, CancellationToken cancellationToken) in /Users/runner/work/1/s/libraries/Microsoft.Bot.Builder.Azure/CosmosDbPartitionedStorage.cs:line 220
----- Inner Stack Trace -----
   at Microsoft.Bot.Builder.AllowedTypesSerializationBinder.ThrowDisallowedTypesError(List`1 types) in /Users/runner/work/1/s/libraries/Microsoft.Bot.Builder/AllowedTypesSerializationBinder.cs:line 170
   at Microsoft.Bot.Builder.AllowedTypesSerializationBinder.CleanupTypes(JContainer json) in /Users/runner/work/1/s/libraries/Microsoft.Bot.Builder/AllowedTypesSerializationBinder.cs:line 148
   at Microsoft.Bot.Builder.Azure.CosmosDbPartitionedStorage.WriteAsync(IDictionary`2 changes, CancellationToken cancellationToken) in /Users/runner/work/1/s/libraries/Microsoft.Bot.Builder.Azure/CosmosDbPartitionedStorage.cs:line 220

@tracyboehrer, we will review them and let you know once we fix them.

Thanks!

[coveralls]

Pull Request Test Coverage Report for Build 329473

• 0 of 0 changed or added relevant lines in 0 files are covered.
• 128 unchanged lines in 9 files lost coverage.
• Overall coverage decreased (-0.0007%) to 79.057%

---

Files with Coverage Reduction	New Missed Lines	%
/libraries/AdaptiveExpressions/BuiltinFunctions/StringTransformEvaluator.cs	1	83.33%
/libraries/integration/Microsoft.Bot.Builder.Integration.AspNet.Core/ServiceCollectionExtensions.cs	1	93.55%
/libraries/Microsoft.Bot.Builder.LanguageGeneration/Evaluator.cs	1	95.42%
/libraries/Microsoft.Bot.Connector.Streaming/TaskExtensions.cs	1	82.61%
/libraries/Microsoft.Bot.Connector.Streaming/Transport/TransportHandler.cs	2	96.39%
/libraries/Microsoft.Bot.Connector/Authentication/SkillValidation.cs	7	47.3%
/libraries/Microsoft.Bot.Connector.Streaming/Session/StreamingSession.cs	8	89.62%
/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs	35	32.35%
/libraries/Microsoft.Bot.Connector/Authentication/ParameterizedBotFrameworkAuthentication.cs	72	0%

Totals
Change from base Build 328982:	-0.0007%
Covered Lines:	25696
Relevant Lines:	32503

---

💛 - Coveralls

[BruceHaley]

✔️ No Binary Compatibility issues for Microsoft.Bot.Builder.dll
✔️ No Binary Compatibility issues for Microsoft.Bot.Builder.Azure.dll

[sw-joelmut]

@tracyboehrer, we updated the failing tests to include the new custom SerializationBinder, and now they are all passing.