Publishing issues in Razor templates with CrowdStrike Windows Sensor software update

Question

We are on SDL Web 8.5, There is a legacy implementation in some publications for which we are using razor templates.

Razor Mediator: Tridion.Extensions.Mediators.Razor, Version=1.3.3.0

Whenever there is an update in antivirus software(CrowdStrike Windows Sensor) in CMS windows servers, we are seeing publishing failures for the pages related to razor templates with below error in rendering state. May not be required to mention, same error while previewing.

(80040356) <tcm:Error ErrorCode="80040356" Category="18" Source="Kernel" xmlns:tcm="http://www.tridion.com/ContentManager/5.0"><tcm:Line ErrorCode="80040356" Cause="true"><![CDATA[TemplateCompileException: CS0006: Metadata file 'C:\Windows\System32\CrowdStrike.Sensor.ScriptControl9106.dll' could not be found
Line 0 Column 0: //------------------------------------------------------------------------------
// <auto-generated>
// This code was generated by a tool.
// Runtime Version:4.0.30319.42000
//

Stack Trace:
 at Tridion.Extensions.Mediators.Razor.Templating.Compiler.Compile(IEnumerable`1 entries, IEnumerable`1 assemblyReferences)
 at Tridion.Extensions.Mediators.Razor.Templating.RazorTemplateGenerator.CompileTemplates(IEnumerable`1 assemblyReferences)
 at Tridion.Extensions.Mediators.Razor.RazorHandler.Compile(DateTime revisionDate)]]></tcm:Line></tcm:Error>
TemplateCompileException: CS0006: Metadata file 'C:\Windows\System32\CrowdStrike.Sensor.ScriptControl9106.dll' could not be found
Line 0 Column 0: //------------------------------------------------------------------------------
// <auto-generated>

Crowdstrike will replace previous version dll every time with new version specified name(CrowdStrike.Sensor.ScriptControlXXXXX.dll) which is basically reason for failure.

Restarting Publisher, transporter & service host will solve this issue. I am trying to work with security team for a scheduled update of that software, so that we can plan for bouncing services after antivirus software update.

But my question is why is that Tridion.Extensions.Mediators.Razor is dependent on an antivirus dll in C:\Windows\System32\?

Answer 1

As far as I know the Razor mediator has no direct reference to CrowdStrike. It's an open source project, so you can inspect the code yourself at https://github.com/alex-klock/razor-mediator-4-tridion

A more likely source for your problem is your own templates. You could inspect the Razor code to see if there are any interesting "Using"s. Obviously anything you pull in with a using can have it's own dependencies.

Analysing this kind of problem can sometimes be made easier by logging the assembly binding process using FUSLOGVW.