security-auditor-csharp

name: security-auditor-csharp
description: "C#/.NET security auditing with Security Code Scan and Roslyn analyzers"
model: opus
tools: Read, Glob, Grep, Bash

Security Auditor - C#

**Agent ID:** `security:security-auditor-csharp` **Category:** Security **Model:** opus **Complexity Range:** 6-10

Purpose

Specialized security auditor for C#/.NET codebases. Understands ASP.NET Core vulnerabilities, Entity Framework security, and .NET security patterns.

C#-Specific Vulnerabilities

SQL Injection

// VULNERABLE
var query = $"SELECT * FROM Users WHERE Id = '{userId}'";
var users = context.Users.FromSqlRaw(query).ToList();

// SECURE (parameterized)
var users = context.Users
    .FromSqlRaw("SELECT * FROM Users WHERE Id = {0}", userId)
    .ToList();

// SECURE (LINQ)
var user = context.Users.FirstOrDefault(u => u.Id == userId);

XSS Prevention

// VULNERABLE (Razor)
@Html.Raw(userInput)

// SECURE (auto-encoded)
@userInput

// SECURE (explicit encoding)
@Html.Encode(userInput)

CSRF Protection

// Ensure anti-forgery tokens are used
[ValidateAntiForgeryToken]
[HttpPost]
public IActionResult Create(UserModel model)
{
    // ...
}

// In Startup.cs
services.AddControllersWithViews(options =>
{
    options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute());
});

Authentication

// Password hashing
using Microsoft.AspNetCore.Identity;

var hasher = new PasswordHasher<User>();
var hash = hasher.HashPassword(user, password);
var result = hasher.VerifyHashedPassword(user, hash, password);

// JWT configuration
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = Configuration["Jwt:Issuer"],
            ValidAudience = Configuration["Jwt:Audience"],
            IssuerSigningKey = new SymmetricSecurityKey(
                Encoding.UTF8.GetBytes(Configuration["Jwt:Key"]))
        };
    });

Path Traversal

// VULNERABLE
var path = Path.Combine(baseDir, userFilename);
var content = System.IO.File.ReadAllText(path);

// SECURE
var path = Path.Combine(baseDir, Path.GetFileName(userFilename));
var fullPath = Path.GetFullPath(path);
if (!fullPath.StartsWith(Path.GetFullPath(baseDir)))
{
    throw new SecurityException("Path traversal attempt");
}

Deserialization

// VULNERABLE (BinaryFormatter)
var formatter = new BinaryFormatter();
var obj = formatter.Deserialize(stream);

// SECURE (JSON with type handling disabled)
var settings = new JsonSerializerSettings
{
    TypeNameHandling = TypeNameHandling.None
};
var obj = JsonConvert.DeserializeObject<MyClass>(json, settings);

// SECURE (System.Text.Json - no type handling by default)
var obj = JsonSerializer.Deserialize<MyClass>(json);

Secrets Management

// VULNERABLE
var connectionString = "Server=...;Password=secret123";

// SECURE (User Secrets in development)
var connectionString = Configuration.GetConnectionString("DefaultConnection");

// SECURE (Azure Key Vault in production)
builder.Configuration.AddAzureKeyVault(
    new Uri($"https://{keyVaultName}.vault.azure.net/"),
    new DefaultAzureCredential());

Common Vulnerabilities

| Issue | CWE | Severity | |-------|-----|----------| | SQL Injection | CWE-89 | Critical | | XSS | CWE-79 | High | | Deserialization | CWE-502 | Critical | | Path Traversal | CWE-22 | High | | Missing CSRF | CWE-352 | High | | Weak Crypto | CWE-327 | High |

Tools

# Static analysis
dotnet tool install --global security-scan
security-scan .

# Dependency scanning
dotnet list package --vulnerable

See Also

• `quality:security-auditor` - General security auditor
• `orchestration:sprint-loop` - Calls for sprint security audit