Programming secure C#/.NET Applications: Dos & Don'ts
A user resets their password with an email containing a Kelvin symbol instead of a 'K'. This simple trick bypasses your security. Here's how to stop it.
#1about 5 minutes
AI-generated code can introduce security risks
AI tools can generate insecure code by using deprecated APIs, introducing biases like modulo bias, or having incomplete logic, requiring a manual security review.
#2about 11 minutes
Handling character encoding to prevent spoofing attacks
Visually similar Unicode characters can be used to spoof identities in attacks, which can be mitigated by using ordinal string comparison instead of culture-invariant comparison.
#3about 12 minutes
Mitigating SQL, command, and path traversal injections
Untrusted user input can lead to various injection attacks, which are prevented by using parameterized SQL queries, the ArgumentList property for processes, and robust path validation.
#4about 4 minutes
Avoiding deserialization vulnerabilities in JSON and XML
Insecure default settings in parsers, like TypeNameHandling in Newtonsoft.Json or DTD processing in XML readers, can lead to remote code execution vulnerabilities.
Related jobs
Jobs that call for the skills explored in this talk.
Dev Digest 138 - Are you secure about this?Hello there! This is the 2nd "out of the can" edition of 3 as I am on vacation in Greece eating lovely things on the beach. So, fewer news, but lots of great resources. Many around the topic of security. Enjoy! News and ArticlesGoogle Pixel phones t...
Daniel Cranney
Dev Digest 216: CyberSec + Mythos, Stack Overflow for Agents & DOOM in TTFInside last week’s Dev Digest 216 .
🧠 Prompts are now tools in Chrome
📜 The AI Coding Agent Manifesto
🔐 How Claude Mythos changes Cyber Security
🧱 GitHub Stacked PRs to battle AI slop
⚙️ Git commands to run before reading code
🐍 A Python framework f...
Daniel Cranney
Dev Digest 211: Securing Agents, Top AI Apps and Lost Readers…Inside last week’s Dev Digest 211 .
🏗️ Can the infrastructure keep up with AI growth?
📱 Top 100 GenAI consumer apps
🪱 Wikipedia hit by worm and AI slop
🔍 The results of Codex Security scanning 1.2M commits
🧹 Bye bye innerHTML, welcome setHTML()
🔄 Cl...
Daniel Cranney
Dev Digest 167: Open Source AI, Passwordless Microsoft and Vibe CodingInside last week’s Dev Digest 167 .
🖼️ Is vibe coding killing creativity?
🌳 Is ChatGPT not as bad for the environment as we think?
⚠️ 95% of AppSec fixes don’t reduce risks
🔑 Microsoft going passwordless
🧠 How to detect memory leaks in your apps
🟨 V...
From learning to earning
Jobs that call for the skills explored in this talk.
58:19
28:41
28:45
28:01
1:58:48
29:50
41:54
27:32
