Configurable rejection of packages with <license> (#6562)

* Added the RejectPackagesWithLicense configuration item that enables rejecting any package that contains <license> metadata in it.

* Addressed feedback.

* empty line removed.

Author: agr

src/NuGetGallery/Configuration/AppConfiguration.cs

@@ -352,5 +352,8 @@ public string ExternalBrandingMessage
         [DefaultValue(null)]
         [TypeConverter(typeof(StringArrayConverter))]
         public string[] RedirectedCuratedFeeds { get; set; }
+
+        [DefaultValue(false)]
+        public bool RejectPackagesWithLicense { get; set; }
     }
 }

src/NuGetGallery/Configuration/IAppConfiguration.cs

@@ -360,5 +360,10 @@ public interface IAppConfiguration : IMessageServiceConfiguration
         /// The name of zero or more curated feeds that are redirected to the main feed.
         /// </summary>
         string[] RedirectedCuratedFeeds { get; set; }
+
+        /// <summary>
+        /// Flag that indicates whether packages with `license` node in them should be rejected.
+        /// </summary>
+        bool RejectPackagesWithLicense { get; set; }
     }
 }

src/NuGetGallery/Services/PackageUploadService.cs

@@ -17,6 +17,7 @@ namespace NuGetGallery
 {
     public class PackageUploadService : IPackageUploadService
     {
+        private const string LicenseNodeName = "license";
         private readonly IPackageService _packageService;
         private readonly IPackageFileService _packageFileService;
         private readonly IEntitiesContext _entitiesContext;
@@ -70,8 +71,51 @@ public async Task<PackageValidationResult> ValidateBeforeGeneratePackageAsync(Pa
                 return result;
             }
 
+            result = CheckLicenseMetadata(nuGetPackage);
+
+            if (result != null)
+            {
+                return result;
+            }
+
             return PackageValidationResult.AcceptedWithWarnings(warnings);
         }
+        
+        private class LicenseCheckingNuspecReader : NuspecReader
+        {
+            public LicenseCheckingNuspecReader(Stream stream)
+                : base(stream)
+            {
+
+            }
+
+            public bool HasLicenseMetadata()
+                => MetadataNode
+                    .Elements()
+                    .Any(e => LicenseNodeName == e.Name.LocalName);
+        }
+
+        private PackageValidationResult CheckLicenseMetadata(PackageArchiveReader nuGetPackage)
+        {
+            if (!_config.RejectPackagesWithLicense)
+            {
+                return null;
+            }
+
+            LicenseCheckingNuspecReader nuspecReader = null;
+
+            using (var nuspec = nuGetPackage.GetNuspec())
+            {
+                nuspecReader = new LicenseCheckingNuspecReader(nuspec);
+            }
+
+            if (nuspecReader.HasLicenseMetadata())
+            {
+                return PackageValidationResult.Invalid(Strings.UploadPackage_NotAcceptingPackagesWithLicense);
+            }
+
+            return null;
+        }
 
         private async Task<PackageValidationResult> CheckPackageEntryCountAsync(
             PackageArchiveReader nuGetPackage,

src/NuGetGallery/Strings.Designer.cs

@@ -996,4 +996,7 @@ Note that NuGet.org password login is deprecated. Please use Microsoft account t
 Thanks,
 The {1} Team</value>
   </data>
+  <data name="UploadPackage_NotAcceptingPackagesWithLicense" xml:space="preserve">
+    <value>This package contains a &lt;license&gt; metadata which is currently not supported.</value>
+  </data>
 </root>

src/NuGetGallery/Strings.resx

@@ -179,6 +179,8 @@
     <add key="PackageDelete.StatisticsUpdateFrequencyInHours" value=""/>
     <add key="PackageDelete.HourLimitWithMaximumDownloads" value=""/>
     <add key="PackageDelete.MaximumDownloadsForPackageVersion" value=""/>
+
+    <add key="Gallery.RejectPackagesWithLicense" value="true" />
   </appSettings>
   <connectionStrings>
     <add name="Gallery.SqlServer" connectionString="Data Source=(localdb)\mssqllocaldb; Initial Catalog=NuGetGallery; Integrated Security=True; MultipleActiveResultSets=True" providerName="System.Data.SqlClient"/>

src/NuGetGallery/Web.config

@@ -4,7 +4,6 @@
 using System;
 using System.Collections.Generic;
 using System.IO;
-using System.IO.Compression;
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
@@ -441,6 +440,49 @@ public async Task WithNotTooManyPackageEntries_WhenRejectPackagesWithTooManyPack
                 Assert.Empty(result.Warnings);
             }
 
+            private static string[] LicenseNodeVariants => new string[]
+            {
+                "<license/>",
+                "<license></license>",
+                "<license> </license>",
+                "<license>ttt</license>",
+                "<license type='file'>fff</license>",
+                "<license type='expression'>ee</license>",
+                "<license type='foobar'>ttt</license>",
+            };
+
+            public static IEnumerable<object[]> RejectsLicensedPackagesWhenConfigured_Input =>
+                from licenseNode in LicenseNodeVariants
+                from rejectLicenseSetting in new[] { false, true }
+                select new object[] { licenseNode, rejectLicenseSetting, !rejectLicenseSetting };
+
+            [Theory]
+            [MemberData(nameof(RejectsLicensedPackagesWhenConfigured_Input))]
+            public async Task RejectsLicensedPackagesWhenConfigured(string licenseNode, bool rejectPackagesWithLicense, bool expectedSuccess)
+            {
+                _config
+                    .SetupGet(x => x.RejectPackagesWithLicense)
+                    .Returns(rejectPackagesWithLicense);
+                _nuGetPackage = GeneratePackage(getCustomNuspecNodes: () => licenseNode);
+
+                var result = await _target.ValidateBeforeGeneratePackageAsync(
+                    _nuGetPackage.Object,
+                    GetPackageMetadata(_nuGetPackage));
+
+                if (expectedSuccess)
+                {
+                    Assert.Equal(PackageValidationResultType.Accepted, result.Type);
+                    Assert.Null(result.Message);
+                    Assert.Empty(result.Warnings);
+                }
+                else
+                {
+                    Assert.Equal(PackageValidationResultType.Invalid, result.Type);
+                    Assert.Contains("license", result.Message);
+                    Assert.Empty(result.Warnings);
+                }
+            }
+
             private PackageMetadata GetPackageMetadata(Mock<TestPackageReader> mockPackage)
             {
                 return PackageMetadata.FromNuspecReader(mockPackage.Object.GetNuspecReader(), strict: true);
@@ -1100,14 +1142,16 @@ protected static Mock<TestPackageReader> GeneratePackage(
                 string version = "1.2.3-alpha.0",
                 RepositoryMetadata repositoryMetadata = null,
                 bool isSigned = true,
-                int? desiredTotalEntryCount = null)
+                int? desiredTotalEntryCount = null,
+                Func<string> getCustomNuspecNodes = null)
             {
                 return PackageServiceUtility.CreateNuGetPackage(
                     id: "theId",
                     version: version,
                     repositoryMetadata: repositoryMetadata,
                     isSigned: isSigned,
-                    desiredTotalEntryCount: desiredTotalEntryCount);
+                    desiredTotalEntryCount: desiredTotalEntryCount,
+                    getCustomNuspecNodes: getCustomNuspecNodes);
             }
         }
     }

tests/NuGetGallery.Facts/Services/PackageUploadServiceFacts.cs

@@ -37,7 +37,8 @@ public static void WriteNuspec(
             IEnumerable<PackageDependencyGroup> packageDependencyGroups = null,
             IEnumerable<ClientPackageType> packageTypes = null,
             bool isSymbolPackage = false,
-            RepositoryMetadata repositoryMetadata = null)
+            RepositoryMetadata repositoryMetadata = null,
+            Func<string> getCustomNodes = null)
         {
             var fullNuspec = (@"<?xml version=""1.0""?>
                 <package xmlns=""http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd"">
@@ -60,6 +61,7 @@ public static void WriteNuspec(
                         <packageTypes>" + WritePackageTypes(packageTypes) + @"</packageTypes>
                         <dependencies>" + WriteDependencies(packageDependencyGroups) + @"</dependencies>
                         " + WriteRepositoryMetadata(repositoryMetadata) + @"
+                        " + (getCustomNodes != null ? getCustomNodes() : "") + @"
                     </metadata>
                 </package>");
 
@@ -172,7 +174,8 @@ public static Stream CreateTestPackageStream(
             RepositoryMetadata repositoryMetadata = null,
             Action<ZipArchive> populatePackage = null,
             bool isSymbolPackage = false,
-            int? desiredTotalEntryCount = null)
+            int? desiredTotalEntryCount = null,
+            Func<string> getCustomNuspecNodes = null)
         {
             return CreateTestPackageStream(packageArchive =>
             {
@@ -181,7 +184,8 @@ public static Stream CreateTestPackageStream(
                 {
                     WriteNuspec(stream, true, id, version, title, summary, authors, owners, description, tags, language,
                         copyright, releaseNotes, minClientVersion, licenseUrl, projectUrl, iconUrl,
-                        requireLicenseAcceptance, packageDependencyGroups, packageTypes, isSymbolPackage, repositoryMetadata);
+                        requireLicenseAcceptance, packageDependencyGroups, packageTypes, isSymbolPackage, repositoryMetadata,
+                        getCustomNuspecNodes);
                 }
 
                 if (populatePackage != null)

tests/NuGetGallery.Facts/TestPackage.cs

@@ -81,7 +81,8 @@ public static Mock<TestPackageReader> CreateNuGetPackage(
             IEnumerable<NuGet.Packaging.Core.PackageType> packageTypes = null,
             RepositoryMetadata repositoryMetadata = null,
             bool isSigned = false,
-            int? desiredTotalEntryCount = null)
+            int? desiredTotalEntryCount = null,
+            Func<string> getCustomNuspecNodes = null)
         {
             if (packageDependencyGroups == null)
             {
@@ -139,7 +140,9 @@ public static Mock<TestPackageReader> CreateNuGetPackage(
                             writer.Write("Fake signature file.");
                         }
                     }
-                }, desiredTotalEntryCount: desiredTotalEntryCount);
+                },
+                desiredTotalEntryCount: desiredTotalEntryCount,
+                getCustomNuspecNodes: getCustomNuspecNodes);
 
             var mock = new Mock<TestPackageReader>(testPackage);
             mock.CallBase = true;