用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/diegosouzapw/awesome-omni-skill --skill dotnet-security-owasp命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Token-efficient tracking for AI orchestration. CLI-first for status updates (~50 tokens), agent fallback for complex ops (~1KB). Use when: updating task status, querying blockers, creating progress files, validating phases.
AshAi extension guidelines for integrating AI capabilities with Ash Framework. Use when implementing vectorization/embeddings, exposing Ash actions as LLM tools, creating prompt-backed actions, or setting up MCP servers. Covers semantic search, LangChain integration, and structured outputs.
This skill should be used when solving hard questions, complex architectural problems, or debugging issues that benefit from GPT-5 Pro or GPT-5.1 thinking models with large file context. Use when standard Claude analysis needs deeper reasoning or extended context windows.
基于 SOC 职业分类
正在显示 SKILL.md
| name | dotnet-security-owasp |
| description | Hardens .NET apps per OWASP Top 10 -- injection, auth, XSS, deprecated security APIs. |
| license | MIT |
| targets | ["*"] |
| tags | ["security","dotnet","skill"] |
| version | 0.0.1 |
| author | dotnet-harness |
| invocable | true |
| claudecode | {"allowed-tools":["Read","Grep","Glob","Bash","Write","Edit"]} |
| codexcli | {"short-description":".NET skill guidance for security tasks"} |
| opencode | {"allowed-tools":["Read","Grep","Glob","Bash","Write","Edit"]} |
OWASP Top 10 (2021) security guidance for .NET applications. Each category includes the vulnerability description, .NET-specific risk, mitigation code examples, and common pitfalls. This skill is the canonical owner of deprecated security pattern warnings (CAS, APTCA, .NET Remoting, DCOM, BinaryFormatter).
Cross-references: [skill:dotnet-secrets-management] for secrets handling, [skill:dotnet-cryptography] for cryptographic best practices, [skill:dotnet-csharp-coding-standards] for secure coding conventions.
Vulnerability: Users act outside their intended permissions -- accessing other users' data, elevating privileges, or bypassing access checks.
Risk in .NET: Missing [Authorize] attributes on controllers/endpoints, insecure direct object references (IDOR)
where user IDs are taken from route parameters without ownership validation, and CORS misconfiguration allowing
unintended origins.
// 1. Apply authorization globally, then opt out explicitly
builder.Services.AddAuthorizationBuilder()
.SetFallbackPolicy(new AuthorizationPolicyBuilder()
.RequireAuthenticatedUser()
.Build());
var app = builder.Build();
app.MapControllers(); // All endpoints require auth by default
// 2. Resource-based authorization to prevent IDOR
public sealed class DocumentAuthorizationHandler
: AuthorizationHandler<, >
{
{
(resource.OwnerId == context.User.FindFirstValue(ClaimTypes.NameIdentifier))
{
context.Succeed(requirement);
}
Task.CompletedTask;
}
}
app.MapPut(, (
id,
DocumentDto dto,
IAuthorizationService authService,
ClaimsPrincipal user,
AppDbContext db) =>
{
document = db.Documents.FindAsync(id);
(document ) Results.NotFound();
authResult = authService.AuthorizeAsync(user, document, );
(!authResult.Succeeded) Results.Forbid();
document.Title = dto.Title;
db.SaveChangesAsync();
Results.NoContent();
});
```text
```csharp
builder.Services.AddCors(options =>
{
options.AddPolicy(, policy =>
{
policy.WithOrigins()
.WithMethods(, )
.WithHeaders(, );
});
});
```text
**Gotcha:** `AllowAnyOrigin()` combined `AllowCredentials()` rejected at runtime ASP.NET Core, but `SetIsOriginAllowed(_ => )` `AllowCredentials()` silently allows all origins -- never use pattern.
---
**Vulnerability:** Sensitive data exposed due to weak missing encryption -- plaintext storage, deprecated algorithms, improper key management.
**Risk .NET:** Using MD5/SHA1 hashing passwords, storing connection strings plaintext passwords `appsettings.json`, transmitting sensitive data over HTTP, `DES`/`RC2` encryption.
```csharp
builder.Services.AddHttpsRedirection(options =>
{
options.HttpsPort = ;
});
app = builder.Build();
app.UseHsts();
app.UseHttpsRedirection();
```json
```csharp
{
IDataProtector _protector =
provider.CreateProtector();
=> _protector.Protect(plaintext);
=> _protector.Unprotect(ciphertext);
}
```text
See [skill:dotnet-cryptography] = db.Orders
.Where(o => o.CustomerId == customerId)
.ToListAsync();
results = db.Orders
.FromSqlInterpolated()
.ToListAsync();
```text
```csharp
app.MapGet(, ( name) =>
Results.Content(,
));
=>
toolName ;
```bash
**Gotcha:** `FromSqlRaw` concatenation bypasses parameterization. Always use `FromSqlInterpolated` pass `SqlParameter` objects to `FromSqlRaw`.
---
**Vulnerability:** Flaws design patterns that cannot be implementation alone -- missing rate limiting, lack of defense depth, unrestricted resource consumption.
**Risk .NET:** APIs without rate limiting, unbounded uploads, missing anti-forgery tokens state-changing operations.
```csharp
builder.Services.AddRateLimiter(options =>
{
options.AddFixedWindowLimiter(, limiterOptions =>
{
limiterOptions.PermitLimit = ;
limiterOptions.Window = TimeSpan.FromMinutes();
limiterOptions.QueueLimit = ;
});
options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
});
app = builder.Build();
app.UseRateLimiter();
app.MapGet(, () => Results.Ok())
.RequireRateLimiting();
```text
```csharp
builder.Services.AddAntiforgery();
app = builder.Build();
app.UseAntiforgery();
app.MapPost(, ([FromForm] productId, AppDbContext db) =>
{
order = Order { ProductId = productId };
db.Orders.Add(order);
db.SaveChangesAsync();
Results.Created(, order);
});
app.MapPost(, (CreateOrderDto dto, AppDbContext db) =>
{
order = Order { ProductId = dto.ProductId };
db.Orders.Add(order);
db.SaveChangesAsync();
Results.Created(, order);
}).RequireAntiforgery();
```text
**Gotcha:** `UseRateLimiter()` must be called after `UseRouting()` before `MapControllers()`/`MapGet()` to apply correctly.
---
**Vulnerability:** Insecure configurations, incomplete configurations, open cloud storage, unnecessary features enabled, verbose error messages.
**Risk .NET:** ;
app = builder.Build();
(app.Environment.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
{
app.UseExceptionHandler();
app.UseHsts();
}
app.Use( (context, next) =>
{
context.Response.Headers.Append(, );
context.Response.Headers.Append(, );
context.Response.Headers.Append(, );
context.Response.Headers.Append(
,
);
next();
});
```text
```csharp
builder.WebHost.ConfigureKestrel(options =>
{
options.Limits.MaxRequestBodySize = * * ;
options.Limits.MaxRequestHeadersTotalSize = * ;
options.Limits.RequestHeadersTimeout = TimeSpan.FromSeconds();
});
```text
**Gotcha:** `UseDeveloperExceptionPage()` leaks source code paths stack traces. Ensure it gated behind `IsDevelopment()` never enabled production staging.
---
**Vulnerability:** Using components known vulnerabilities, unsupported frameworks, unpatched dependencies.
**Risk .NET:** Running -of-support .NET versions, NuGet packages known CVEs, transitive dependency vulnerabilities audited.
```xml
<!-- Enable NuGet audit Directory.Build.props csproj -->
<PropertyGroup>
<NuGetAudit></NuGetAudit>
<NuGetAuditLevel>low</NuGetAuditLevel>
<NuGetAuditMode>all</NuGetAuditMode> <!-- Audit direct + transitive -->
</PropertyGroup>
```text
```bash
dotnet list package --vulnerable --include-transitive
dotnet outdated
dotnet --info
```text
**Gotcha:** `NuGetAuditMode` defaults to `direct` -- transitive vulnerabilities are hidden unless you `all`. Always use `all` CI to deep dependency issues.
---
**Vulnerability:** Weak authentication mechanisms, credential stuffing, session fixation, missing multi-factor authentication.
**Risk .NET:** Default Identity password policies that are too weak, session cookies without `Secure`/`SameSite` attributes, missing account lockout configuration.
```csharp
builder.Services.AddIdentity<ApplicationUser, IdentityRole>(options =>
{
options.Password.RequireDigit = ;
options.Password.RequiredLength = ;
options.Password.RequireNonAlphanumeric = ;
options.Password.RequireUppercase = ;
options.Password.RequireLowercase = ;
options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes();
options.Lockout.MaxFailedAccessAttempts = ;
options.Lockout.AllowedForNewUsers = ;
options.User.RequireUniqueEmail = ;
})
.AddEntityFrameworkStores<AppDbContext>()
.AddDefaultTokenProviders();
```text
```csharp
builder.Services.ConfigureApplicationCookie(options =>
{
options.Cookie.HttpOnly = ;
options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
options.Cookie.SameSite = SameSiteMode.Strict;
options.ExpireTimeSpan = TimeSpan.FromHours();
options.SlidingExpiration = ;
});
```text
**Gotcha:** `CookieSecurePolicy.SameAsRequest` allows cookies over HTTP development, which fine. But production behind a reverse proxy terminating TLS, the app sees HTTP -- so cookies are sent insecurely. Always use `CookieSecurePolicy.Always` production configure forwarded headers.
---
**Vulnerability:** Code infrastructure that does protect against integrity violations -- unsigned packages, insecure CI/CD pipelines, deserialization of untrusted data.
**Risk .NET:** Using `BinaryFormatter` = = />
< key= = />
</packageSources>
<packageSourceMapping>
<packageSource key=>
<package pattern= />
</packageSource>
<packageSource key=>
<package pattern= />
</packageSource>
</packageSourceMapping>
</configuration>
```text
```csharp
data = JsonSerializer.Deserialize<OrderDto>(jsonString);
bytes = MessagePackSerializer.Serialize(order);
restored = MessagePackSerializer.Deserialize<Order>(bytes);
```text
**Gotcha:** Package source mapping uses most-specific-pattern-wins: `MyCompany.*` beats the `*` wildcard. Always define specific patterns packages to prevent dependency confusion attacks.
---
**Vulnerability:** Insufficient logging of security-relevant events, lack of monitoring breaches, inability to detect respond to active attacks.
**Risk .NET:** Not logging authentication failures, missing audit trails sensitive operations,
{
{
userId = context.User.FindFirstValue(ClaimTypes.NameIdentifier) ?? ;
path = context.Request.Path.Value;
(logger.BeginScope( Dictionary<, ?>
{
[] = userId,
[] = path,
[] = context.Connection.RemoteIpAddress?.ToString()
}))
{
next(context);
(context.Response.StatusCode == StatusCodes.Status401Unauthorized)
{
logger.LogWarning(, path);
}
(context.Response.StatusCode == StatusCodes.Status403Forbidden)
{
logger.LogWarning(, path);
}
}
}
}
```text
```csharp
builder.Logging.AddFilter(, LogLevel.Warning);
builder.Services.AddHttpLogging(options =>
{
options.LoggingFields = HttpLoggingFields.RequestPath
| HttpLoggingFields.RequestMethod
| HttpLoggingFields.ResponseStatusCode
| HttpLoggingFields.Duration;
});
```text
**Gotcha:** Structured logging `{Placeholder}` syntax safe,
{
HashSet<> AllowedHosts = (StringComparer.OrdinalIgnoreCase)
{
,
};
{
(!Uri.TryCreate(url, UriKind.Absolute, uri))
;
(uri.Scheme != Uri.UriSchemeHttps)
;
(IPAddress.TryParse(uri.Host, ip))
{
(IsPrivateOrReserved(ip))
;
}
AllowedHosts.Contains(uri.Host);
}
{
[] bytes = ip.GetAddressBytes();
bytes[]
{
=> ,
=> ,
bytes[] == => ,
bytes[] >= && bytes[] <= => ,
bytes[] == => ,
_ =>
};
}
}
app.MapPost(, (FetchRequest request, IHttpClientFactory factory) =>
{
(!UrlValidator.IsAllowed(request.Url))
Results.BadRequest();
client = factory.CreateClient();
response = client.GetStringAsync(request.Url);
Results.Ok(response);
});
```text
```csharp
builder.Services.AddHttpClient(, client =>
{
client.BaseAddress = Uri();
})
.ConfigurePrimaryHttpMessageHandler(() => SocketsHttpHandler
{
AllowAutoRedirect =
});
```text
**Gotcha:** DNS rebinding can bypass IP allowlists -- an attacker