secure-rules-files — Windsurf Rules

Summary: XSS occurs when an application includes untrusted data in a web page without proper neutralization, allowing malicious scripts to execute in the user's browser. Mitigation Rule: Always HTML-encode all untrusted input before rendering it in HTML using System.Text.Encodings.Web.HtmlEncoder.Default or Razor's automatic encoding. Ensure all data passed into JavaScript contexts is JSON-encoded using JsonSerializer.Serialize or URL-encoded using Uri.EscapeDataString as appropriate.

Summary: SQL Injection occurs when untrusted input is improperly concatenated into a SQL query, allowing attackers to manipulate the query and access or modify unauthorized data. Mitigation Rule: Use parameterized queries (e.g., SqlCommand with SqlParameter, Entity Framework Core LINQ queries, or Dapper with anonymous objects) for all database interactions. Never concatenate user-supplied input directly into SQL statements.

Summary: Path Traversal allows an attacker to access files and directories outside of the intended directory by manipulating file paths. Mitigation Rule: Validate and sanitize all user-supplied file paths and names. Use System.IO.Path.GetFullPath and System.IO.Path.Combine to create safe, canonical paths, and explicitly verify that the resulting path is strictly within an allowed base directory by checking for prefixes or direct equality.

Summary: Deserializing untrusted or malicious data can lead to remote code execution, denial-of-service, or data tampering. Mitigation Rule: Avoid deserializing untrusted data, especially complex object graphs, from unknown or untrusted sources. If deserialization is unavoidable, use secure serializers like System.Text.Json with appropriate JsonSerializerOptions (e.g., DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingDefault and AllowTrailingCommas = false) and consider JsonStringEnumConverter for enums. Never use insecure formatters like BinaryFormatter or NetDataContractSerializer with untrusted inputs.