Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update DotNet_Security_Cheat_Sheet.md #1352

Merged
merged 4 commits into from
Mar 6, 2024
Merged

Update DotNet_Security_Cheat_Sheet.md #1352

Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a2a6e04
Update DotNet_Security_Cheat_Sheet.md
fcerullo-cycubix Mar 4, 2024
edc23fc
Update cheatsheets/DotNet_Security_Cheat_Sheet.md
jmanico Mar 6, 2024
649ac55
Update cheatsheets/DotNet_Security_Cheat_Sheet.md
jmanico Mar 6, 2024
55298a0
Update DotNet_Security_Cheat_Sheet.md
jmanico Mar 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions cheatsheets/DotNet_Security_Cheat_Sheet.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -794,6 +794,12 @@ DO NOT: Send unsigned or unencrypted serialized objects over the network
DO: Perform integrity checks or validate digital signatures on serialized
objects received from the network

DO NOT: Use the BinaryFormatter type which is dangerous and [not recommended](https://learn.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide) for data processing.
.NET offers several in-box serializers that can handle untrusted data safely:
- XmlSerializer and DataContractSerializer to serialize object graphs into and from XML. Do not confuse DataContractSerializer with NetDataContractSerializer.
- BinaryReader and BinaryWriter for XML and JSON.
- The System.Text.Json APIs to serialize object graphs into JSON.

### A09 Security Logging and Monitoring Failures

DO: Ensure all login, access control, and server-side input validation failures are logged with sufficient user context to identify suspicious or malicious accounts.
Expand Down
Loading