Security: Block raw DLL references, enforce NuGet-only dependencies

This change prevents users from adding .dll files to job packages. All external dependencies must be declared as NuGet packages in the .nuspec file and resolved via NuGetResolverService.

Changes:

1. CodeExecutorService.cs (Core/Services)

   - Removed code that blindly loaded all .dll files from extracted packages

   - Added security check that rejects execution if any .dll files are found in the package

   - Removed secondary loop that pre-loaded package DLLs into the AppDomain

   - NuGet-resolved assemblies (via .nuspec) continue to work as before

2. JobManager.cs (Core)

   - Replaced the DLL scanning/loading loop with a security check

   - Throws InvalidOperationException if .dll files are found in the package

   - Logs a security-level error message identifying the rejected DLL files

3. NuGetPackageBuilderService.cs (Core/Services)

   - Added validation at the start of BuildPackageAsync()

   - Rejects the build if the source directory contains any .dll files

   - Returns a clear error message listing the offending files

4. PackageProcessorService.cs (Core/Services)

   - Added DLL detection to ValidateNuSpecAsync()

   - Packages containing .dll files now fail validation with a descriptive error

5. JobDetailsDialog.razor (Web/Components/Pages/Dialogs)

   - Added client-side validation during package upload (.nupkg/.zip)

   - Inspects zip archive entries for .dll files before uploading

   - Rejects upload with a user-friendly notification listing found DLLs

Defense in depth: The restriction is enforced at every layer - package build, package upload, package validation, and package execution.

Author: imsaadawais

src/BlazorDataOrchestrator.Core/JobManager.cs

@@ -494,12 +494,14 @@ public async Task RunJobAsync(int jobInstanceId)
 
                     var evaluator = CSScript.Evaluator;
 
-                    // Add references to all DLLs found in the package
+                    // Security: Reject packages that contain .dll files.
+                    // Only NuGet package dependencies (resolved via .nuspec) are allowed.
                     var dlls = Directory.GetFiles(tempDir, "*.dll", SearchOption.AllDirectories);
-                    foreach (var dll in dlls)
+                    if (dlls.Length > 0)
                     {
-                        evaluator.ReferenceAssembly(dll);
-                        await LogAsync("RunJob", $"Added reference: {Path.GetFileName(dll)}", "Debug");
+                        var dllNames = string.Join(", ", dlls.Select(System.IO.Path.GetFileName));
+                        await LogAsync("RunJob", $"Security: Rejected package containing .dll files: {dllNames}", "Error");
+                        throw new InvalidOperationException($"Package contains .dll files which are not allowed. Use NuGet packages instead. Found: {dllNames}");
                     }
 
                     // Load and execute

src/BlazorDataOrchestrator.Core/Services/CodeExecutorService.cs

@@ -177,19 +177,16 @@ private async Task<CodeExecutionResult> ExecuteCSharpAsync(string extractedPath,
                 }
             }
 
-            // Add references to DLLs found in the package
+            // Security: Reject packages that contain .dll files.
+            // Only NuGet package dependencies (resolved via .nuspec) are allowed.
             var dlls = Directory.GetFiles(extractedPath, "*.dll", SearchOption.AllDirectories);
-            foreach (var dll in dlls)
+            if (dlls.Length > 0)
             {
-                try
-                {
-                    evaluator.ReferenceAssembly(dll);
-                    result.Logs.Add($"Added reference: {Path.GetFileName(dll)}");
-                }
-                catch
-                {
-                    // Ignore DLLs that can't be loaded
-                }
+                var dllNames = string.Join(", ", dlls.Select(Path.GetFileName));
+                result.Success = false;
+                result.ErrorMessage = $"Package contains .dll files which are not allowed. Use NuGet packages instead. Found: {dllNames}";
+                result.Logs.Add($"Security: Rejected package containing .dll files: {dllNames}");
+                return result;
             }
 
             // Add common references
@@ -234,24 +231,6 @@ private async Task<CodeExecutionResult> ExecuteCSharpAsync(string extractedPath,
                 }
             }
 
-            // Also load DLLs from the package
-            foreach (var dll in dlls)
-            {
-                try
-                {
-                    var loadedAsm = Assembly.LoadFrom(dll);
-                    var asmName = loadedAsm.GetName().Name;
-                    if (asmName != null && !loadedAssemblies.ContainsKey(asmName))
-                    {
-                        loadedAssemblies[asmName] = loadedAsm;
-                    }
-                }
-                catch
-                {
-                    // Ignore DLLs that can't be loaded
-                }
-            }
-
             result.Logs.Add($"Pre-loaded {loadedAssemblies.Count} assemblies for runtime resolution.");
 
             // Set up assembly resolve handler for the compiled script

src/BlazorDataOrchestrator.Core/Services/NuGetPackageBuilderService.cs

@@ -125,6 +125,21 @@ public async Task<PackageBuildResult> BuildPackageAsync(PackageBuildConfiguratio
             var csharpFolder = Path.Combine(config.CodeRootPath, "CodeCSharp");
             var pythonFolder = Path.Combine(config.CodeRootPath, "CodePython");
 
+            // Security: Reject source directories that contain .dll files.
+            // Users must use NuGet package dependencies declared in .nuspec instead.
+            if (Directory.Exists(config.CodeRootPath))
+            {
+                var dllFiles = Directory.GetFiles(config.CodeRootPath, "*.dll", SearchOption.AllDirectories);
+                if (dllFiles.Length > 0)
+                {
+                    var dllNames = string.Join(", ", dllFiles.Select(Path.GetFileName));
+                    result.Success = false;
+                    result.ErrorMessage = $"Source directory contains .dll files which are not allowed in packages. Use NuGet packages instead. Found: {dllNames}";
+                    result.Logs.Add($"Security: Rejected build due to .dll files: {dllNames}");
+                    return result;
+                }
+            }
+
             // Copy JSON files from the root Code folder
             if (Directory.Exists(config.CodeRootPath))
             {

src/BlazorDataOrchestrator.Core/Services/PackageProcessorService.cs

@@ -140,6 +140,15 @@ public async Task<PackageValidationResult> ValidateNuSpecAsync(string extractedP
             }
         }
 
+        // Security: Reject packages containing .dll files.
+        // Users must use NuGet package dependencies declared in .nuspec instead.
+        var dllFiles = Directory.GetFiles(extractedPath, "*.dll", SearchOption.AllDirectories);
+        if (dllFiles.Length > 0)
+        {
+            var dllNames = string.Join(", ", dllFiles.Select(Path.GetFileName));
+            result.Errors.Add($"Package contains .dll files which are not allowed. Only NuGet package dependencies (declared in .nuspec) are permitted. Found: {dllNames}");
+        }
+
         result.IsValid = result.Errors.Count == 0;
         return result;
     }

src/BlazorOrchestrator.Web/Components/Pages/Dialogs/JobDetailsDialog.razor

@@ -803,6 +803,25 @@ Content-Type: application/json
             await stream.CopyToAsync(memoryStream);
             memoryStream.Position = 0;
 
+            // Security: Validate that the package does not contain .dll files.
+            // Users must use NuGet package dependencies declared in .nuspec instead.
+            using (var archive = new System.IO.Compression.ZipArchive(memoryStream, System.IO.Compression.ZipArchiveMode.Read, leaveOpen: true))
+            {
+                var dllEntries = archive.Entries
+                    .Where(e => e.FullName.EndsWith(".dll", StringComparison.OrdinalIgnoreCase))
+                    .Select(e => e.FullName)
+                    .ToList();
+
+                if (dllEntries.Count > 0)
+                {
+                    var dllNames = string.Join(", ", dllEntries.Select(Path.GetFileName));
+                    NotificationService.Notify(NotificationSeverity.Error, "Upload Rejected",
+                        $"Package contains .dll files which are not allowed. Use NuGet packages instead. Found: {dllNames}");
+                    return;
+                }
+            }
+            memoryStream.Position = 0;
+
             // Upload package using JobManager - this updates Job.JobCodeFile automatically
             var blobName = await JobManager.UploadJobPackageAsync(JobId, memoryStream, SelectedFile.Name);