secure-dev-c-sharp

Secure C#/.NET Development

These rules apply to all C#/.NET code in the repository and aim to prevent common security risks through disciplined use of input validation and deserialization, output encoding, and safe APIs.

All violations must include a clear explanation of which rule was triggered and why, to help developers understand and fix the issue effectively.
Generated code must not violate these rules. If a rule is violated, a comment must be added explaining the issue and suggesting a correction.

1. Validate All external inputs

• Rule: Validate all external inputs by manually checking the type, format and size of the input manually or by using libraries like FluentValidation. For file validation, utilize MIME Type Validation libraries, like MimeDetective or HeyRed.Mime to check whether a file's type and content actually matches the expected type.

2. Use Parameterized Queries in EntityFramework

• Rule: Parameterize queries in EntityFramework using LINQ and FromSqlInterpolated.
• Unsafe:

  // Vulnerable to SQL Injection
  var user = dbContext.Users
    .FromSqlRaw($"SELECT * FROM Users WHERE Username = '{userInput}'")
    .FirstOrDefault();
  

• Safe:

  //Input is interpolated and parameterized internally
  var user = dbContext.Users
    .FromSqlInterpolated($"SELECT * FROM Users WHERE Username = {userInput}")
    .FirstOrDefault();
  

• Safe:

  //LINQ is translated into parameterized SQL query
  var user = dbContext.Users
      .Where(u => u.Username == userInput)
      .FirstOrDefault();
  

3. Avoid Singleton Dependency Injection On User-Specific Services

• Rule: When registering services in ASP.NET Dependency Injection, choose the correct service lifetime to avoid exposing unauthorized users to other users' requests.

• Unsafe:

  var builder = WebApplication.CreateBuilder(args);
  // One instance is shared for all users - sensitive data is exposed to others
  builder.Services.AddSingleton<UserAuthService>();
  

• Safe:

  var builder = WebApplication.CreateBuilder(args);
  // Each created instance is scoped for a single request
  builder.Services.AddScoped<UserAuthService>();