Application insight upgrade in .net

Question

I have a web application developed in MVC. It's an existing application. While doing the SAST testing, we got some security issues under critical status like Insecure Randomness, CRSF (DOM), OPen indirect.

This issue is happening due to the javascript function ai.0.22.9-build00167.js. please someone can explain to me what is the use of this script. Also, I can find the new version after this.

Let clarify if I might update to the new version it will help me to fix the issue. If yes, please let to know how to update this version. Because I tried to update from Nuget from visual studio it's not helping me also I tried to download from other sites. but the file format is not supported.

If no, please someone can help me to resolve this.

The same issue I am facing in the below files also since its inbuild scripts I don't know how to handle.

jquery-1.10.2-vsdoc.js,
jquery.unobtrusive-ajax,
jquery.unobtrusive-ajax.min.js,
jquery.validate-vsdoc.js,
jquery.validate.js,
jquery.validate.min.js

Thanks

Answer 1

ai.0.22.9-build00167.js is Microsoft Azure Application Insights JavaScript library.

Not sure why your MVC project is using App Insights JavaScript library, On top, this library is not updated since Aug. 2018 so surely there are latest/new library from Microsoft.

These are few points to help you decide:

1. Remove/Uninstall NuGet package

If your project is NOT not using any of the JavaScript framework (like Angular, ReactJS, VueJS, etc), you can remove/uninstall App Insights - JavaScript NuGet package.

This will also stop collecting your application health data in Azure App Insights.

---

2. For JavaScript Framework

If your project is using JavaScript framework (like Angular, Vue, etc) - you can install latest version of App Insights - Web library and configured accordingly.

It is NOT a NuGet package, instead it is NPM package.

3. For MVC Application

If there is a need to collect your MVC application health data in App Insights, you can install Application Insights SDK and configured accordingly.