sc-lang-csharp

SC: C#/.NET Security Deep Scan

Purpose

Detects C#/.NET-specific security anti-patterns including BinaryFormatter deserialization, ASP.NET Core misconfigurations, Entity Framework raw SQL injection, Blazor/SignalR vulnerabilities, and unsafe code risks. Covers the .NET ecosystem's unique attack surface.

Activation

Activates when C# or .NET is detected in security-report/architecture.md.

Checklist Reference

References references/csharp-security-checklist.md.

C#/.NET-Specific Vulnerability Patterns

Category 1: BinaryFormatter Deserialization RCE

// VULNERABLE: BinaryFormatter is ALWAYS dangerous — Microsoft deprecated it
BinaryFormatter bf = new BinaryFormatter();
var obj = bf.Deserialize(stream); // Gadget chain → RCE guaranteed

// Also dangerous: SoapFormatter, NetDataContractSerializer, LosFormatter,
// ObjectStateFormatter

// SAFE: Use System.Text.Json or JsonSerializer
var obj = JsonSerializer.Deserialize<MyType>(jsonString);

Category 2: ASP.NET Model Binding Mass Assignment

// VULNERABLE: Binding all properties
[HttpPost]
public IActionResult Create(User user) {
    _context.Users.Add(user); // IsAdmin, Role settable!
}

// SAFE: Use [Bind] or DTO
[HttpPost]
public IActionResult Create([Bind("Name,Email")] User user) { }

// Or DTO pattern
public IActionResult Create(CreateUserDto dto) {
    var user = new User { Name = dto.Name, Email = dto.Email };
}

Category 3: ViewState Tampering (Legacy WebForms)

// VULNERABLE: ViewState without MAC validation (legacy ASP.NET)
// web.config: <pages enableViewStateMac="false" />

// SAFE: Always enable MAC (default in modern ASP.NET)
// <pages enableViewStateMac="true" />

Category 4: Entity Framework Raw SQL Injection

// VULNERABLE: String interpolation in raw SQL
var users = context.Users
    .FromSqlRaw($"SELECT * FROM Users WHERE Name = '{name}'")
    .ToList();

// SAFE: Parameterized
var users = context.Users
    .FromSqlRaw("SELECT * FROM Users WHERE Name = {0}", name)
    .ToList();

// SAFE: FromSqlInterpolated (auto-parameterizes)
var users = context.Users
    .FromSqlInterpolated($"SELECT * FROM Users WHERE Name = {name}")
    .ToList();