Initial secure coding examples project

Author: rafaelg-security

Dockerfile

@@ -0,0 +1,13 @@
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+
+COPY . .
+RUN dotnet restore
+RUN dotnet publish src/SecureCodingExamples.Api/SecureCodingExamples.Api.csproj -c Release -o /app/publish
+
+FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
+WORKDIR /app
+COPY --from=build /app/publish .
+
+EXPOSE 8080
+ENTRYPOINT ["dotnet", "SecureCodingExamples.Api.dll"]

README.md

@@ -0,0 +1,62 @@
+# secure-coding-examples-dotnet
+
+A .NET 10 secure coding portfolio project demonstrating common enterprise AppSec mistakes and safer implementation patterns.
+
+## Purpose
+
+This repository supports a cybersecurity transition profile focused on:
+
+- secure engineering
+- Application Security
+- OWASP Top 10
+- OWASP API Top 10
+- secure SDLC
+- regulated-system thinking
+- enterprise .NET security
+
+## Safety Note
+
+The intentionally insecure examples are educational and isolated. They demonstrate anti-patterns so the secure version can be compared clearly. Do not reuse insecure examples in production.
+
+## What This Project Demonstrates
+
+- input validation
+- SQL injection prevention
+- secure authentication patterns
+- secure password hashing
+- secure logging
+- safe error handling
+- mass assignment prevention
+- secure file upload validation
+- dependency and CI security awareness
+
+## Tech Stack
+
+- .NET 10
+- ASP.NET Core 10 Web API
+- SQLite
+- Dapper
+- FluentValidation
+- BCrypt.Net
+- xUnit
+- GitHub Actions
+- Docker
+
+## Run Locally
+
+```bash
+dotnet restore
+dotnet build
+dotnet test
+dotnet run --project src/SecureCodingExamples.Api
+```
+
+Swagger:
+
+```text
+https://localhost:5001/swagger
+```
+
+## Portfolio Positioning
+
+This project shows security reasoning from a software engineering perspective: identifying risky implementation patterns and applying secure coding practices in enterprise .NET systems.

SecureCodingExamples.sln

@@ -0,0 +1,10 @@
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.0.31903.59
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SecureCodingExamples.Api", "src\SecureCodingExamples.Api\SecureCodingExamples.Api.csproj", "{11111111-1111-1111-1111-111111111111}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SecureCodingExamples.Tests", "tests\SecureCodingExamples.Tests\SecureCodingExamples.Tests.csproj", "{22222222-2222-2222-2222-222222222222}"
+EndProject
+Global
+EndGlobal

docs/OWASP_MAPPING.md

@@ -0,0 +1,22 @@
+# OWASP Mapping
+
+## OWASP Top 10
+
+| Area | Example |
+|---|---|
+| A01 Broken Access Control | Role and mass-assignment examples |
+| A02 Cryptographic Failures | Password hashing examples |
+| A03 Injection | SQL injection vulnerable vs secure examples |
+| A04 Insecure Design | Threat-aware notes and mitigations |
+| A05 Security Misconfiguration | Secure headers and safe defaults |
+| A07 Identification and Authentication Failures | Password verification patterns |
+| A09 Security Logging and Monitoring Failures | Audit-style logging examples |
+
+## OWASP API Top 10
+
+| Area | Example |
+|---|---|
+| Broken Object Property Level Authorization | DTO allow-listing |
+| Broken Authentication | Password handling examples |
+| Unrestricted Resource Consumption | File upload size validation |
+| Security Misconfiguration | Secure headers |

docs/SECURE_CODING_NOTES.md

@@ -0,0 +1,22 @@
+# Secure Coding Notes
+
+## Core Principles
+
+- validate input at boundaries
+- never trust client-supplied identifiers or roles
+- use parameterized queries
+- avoid leaking stack traces
+- do not log secrets, tokens, passwords, or sensitive medical data
+- use DTOs instead of binding directly to domain entities
+- use least privilege
+- make security controls visible in code and documentation
+
+## AppSec Review Questions
+
+- What input can an attacker control?
+- What data is sensitive?
+- Where are authorization decisions made?
+- Can users access another user's data?
+- Are secrets exposed in logs or configuration?
+- Is error handling leaking implementation details?
+- Are dependencies scanned?

global.json

@@ -0,0 +1,6 @@
+{
+  "sdk": {
+    "version": "10.0.100",
+    "rollForward": "latestFeature"
+  }
+}

src/SecureCodingExamples.Api/Controllers/FileUploadExamplesController.cs

@@ -0,0 +1,34 @@
+using Microsoft.AspNetCore.Mvc;
+using SecureCodingExamples.Api.Services;
+
+namespace SecureCodingExamples.Api.Controllers;
+
+[ApiController]
+[Route("api/examples/file-upload")]
+public class FileUploadExamplesController : ControllerBase
+{
+    private readonly FileUploadSecurityService _service;
+
+    public FileUploadExamplesController(FileUploadSecurityService service)
+    {
+        _service = service;
+    }
+
+    [HttpPost("validate")]
+    public IActionResult ValidateUpload(IFormFile file)
+    {
+        if (!_service.IsAllowedFile(file))
+        {
+            return BadRequest(new
+            {
+                error = "File type or size not allowed."
+            });
+        }
+
+        return Ok(new
+        {
+            accepted = true,
+            safeStorageName = _service.CreateSafeStorageName(file)
+        });
+    }
+}

src/SecureCodingExamples.Api/Controllers/InjectionExamplesController.cs

@@ -0,0 +1,34 @@
+using Microsoft.AspNetCore.Mvc;
+using SecureCodingExamples.Api.Services;
+
+namespace SecureCodingExamples.Api.Controllers;
+
+[ApiController]
+[Route("api/examples/injection")]
+public class InjectionExamplesController : ControllerBase
+{
+    private readonly SqlInjectionExampleService _service;
+
+    public InjectionExamplesController(SqlInjectionExampleService service)
+    {
+        _service = service;
+    }
+
+    [HttpGet("insecure-search")]
+    public async Task<IActionResult> InsecureSearch([FromQuery] string email)
+    {
+        var users = await _service.InsecureSearchByEmailAsync(email);
+        return Ok(new
+        {
+            warning = "Educational anti-pattern: vulnerable query construction.",
+            users
+        });
+    }
+
+    [HttpGet("secure-search")]
+    public async Task<IActionResult> SecureSearch([FromQuery] string email)
+    {
+        var users = await _service.SecureSearchByEmailAsync(email);
+        return Ok(users);
+    }
+}

src/SecureCodingExamples.Api/Controllers/MassAssignmentExamplesController.cs

@@ -0,0 +1,41 @@
+using Microsoft.AspNetCore.Mvc;
+using SecureCodingExamples.Api.Dtos;
+using SecureCodingExamples.Api.Services;
+
+namespace SecureCodingExamples.Api.Controllers;
+
+[ApiController]
+[Route("api/examples/mass-assignment")]
+public class MassAssignmentExamplesController : ControllerBase
+{
+    private readonly MassAssignmentService _service;
+
+    public MassAssignmentExamplesController(MassAssignmentService service)
+    {
+        _service = service;
+    }
+
+    [HttpPost("insecure-create-user")]
+    public async Task<IActionResult> InsecureCreateUser(InsecureCreateUserRequest request)
+    {
+        var id = await _service.InsecureCreateUserAsync(request);
+
+        return Ok(new
+        {
+            warning = "Educational anti-pattern: client can control Role.",
+            id
+        });
+    }
+
+    [HttpPost("secure-create-user")]
+    public async Task<IActionResult> SecureCreateUser(CreateUserRequest request)
+    {
+        var id = await _service.SecureCreateUserAsync(request);
+
+        return Ok(new
+        {
+            id,
+            roleAssignedByServer = "User"
+        });
+    }
+}

src/SecureCodingExamples.Api/Controllers/PasswordExamplesController.cs

@@ -0,0 +1,29 @@
+using Microsoft.AspNetCore.Mvc;
+using SecureCodingExamples.Api.Dtos;
+using SecureCodingExamples.Api.Services;
+
+namespace SecureCodingExamples.Api.Controllers;
+
+[ApiController]
+[Route("api/examples/passwords")]
+public class PasswordExamplesController : ControllerBase
+{
+    private readonly PasswordSecurityService _service;
+
+    public PasswordExamplesController(PasswordSecurityService service)
+    {
+        _service = service;
+    }
+
+    [HttpPost("secure-login-check")]
+    public async Task<IActionResult> SecureLoginCheck(LoginRequest request)
+    {
+        var isValid = await _service.SecureVerifyPasswordAsync(request);
+
+        return Ok(new
+        {
+            authenticated = isValid,
+            note = "Uses BCrypt verification and does not expose password hashes."
+        });
+    }
+}