> Markdown version of [/videos/1126-programming-secure-c-net-applications-dos-don-ts?t=1499](https://www.wearedevelopers.com/videos/1126-programming-secure-c-net-applications-dos-don-ts?t=1499). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Programming secure C#/.NET Applications: Dos & Don'ts

Did you know AI frequently injects deprecated crypto classes into C# code? Master secure .NET architecture and strict parameter validation to prevent critical system compromise.

- **Speakers:** [Sebastian Leuer](https://www.wearedevelopers.com/@sebastian-leuer)
- **Event:** World Congress 2024
- **Published:** August 20, 2024
- **Duration:** 33:29
- **URL:** https://www.wearedevelopers.com/videos/1126-programming-secure-c-net-applications-dos-don-ts

## Summary

While AI code generation promises speed and convenience, relying on it for security-sensitive logic often yields vulnerable outcomes. This session explores the critical importance of secure programming practices within C# and .NET environments, using the unreliability of AI-generated password logic as a cautionary starting point. The overarching directive for all application architecture is absolute: developers must adhere strictly to rigorous validation frameworks because relying on unverified user input is a primary driver of system compromise.

The discussion extensively maps out the nuances of character handling, string formatting, and cryptography. AI models regularly suggest deprecated classes, such as the obsolete RNGCryptoServiceProvider, or inadvertently introduce cryptographic modular bias. Additionally, improper application-level string normalization causes visual spoofing and best-fit mapping vulnerabilities, where malicious Unicode variations like the Kelvin symbol bypass naive filters. Addressing these threats requires executing ordinal byte-level string comparisons, maintaining strict data immutability after validation routines, and explicitly applying LPWStr marshaling when interfacing with native C runtimes.

Demonstrating foundational exploit mechanisms, the presentation dissects prevalent injection and parsing payloads while offering precise .NET remediation techniques. Resolving SQL injections demands mandatory utilization of parameterized query execution rather than string concatenation. Command injection attempts are effectively neutralized by leveraging the isolated ArgumentList property when spinning up process architectures. Furthermore, preventing path traversal loops outside of strict file sandboxes relies on utilizing absolute paths via Path.GetFullPath. Finally, the analysis warns against writing custom format parsers, highlighting severe remote code execution risks tied to improper Newtonsoft.Json type name handling and memory exhaustion scenarios rooted in permissive XML DTD processing.

**Keywords:** c# application security, .net secure programming, ai code generation risks, cryptographic modular bias, unicode best-fitting vulnerabilities, visual spoofing homograph attacks, string normalization pitfalls, native code string marshaling, sql injection prevention, explicitly parameterized queries, process command injection mitigation, sandbox path traversal validation, newtonsoft type name handling, xml dtd processing crashes, malicious user input sanitization

## Chapters

1. **Introduction to speaker and software security concepts** (00:03) — How static code analysis tooling and security training help developers eliminate false positives and build more secure .NET applications.
1. **Security risks of AI based code generation** (02:25) — Why relying on AI to generate cryptographic logic leads to deprecated APIs and insecure practices like missing special characters.
1. **Preventing visual spoofing and Unicode handling vulnerabilities** (06:57) — How visual spoofing and improper Unicode normalization can bypass validation logic and misroute sensitive platform data.
1. **Demonstrating and preventing SQL injection in .NET** (17:41) — Modifying inline SQL statements to use parameterized queries prevents malicious database manipulation by untrusted user input.
1. **Preventing command injection during system process execution** (21:31) — Safely passing user input to system processes using the ArgumentList property in .NET Core prevents arbitrary code execution.
1. **Securing file upload features against path traversal** (24:59) — Enforcing bounding sandbox directories and validating absolute paths stops attackers from using relative references to rewrite system files.
1. **Securing JSON and XML parsing against exploits** (30:02) — Disabling automatic type handling and DTD processing in parsers mitigates arbitrary code execution and system crashes from malformed inputs.

## Related Moments

- [Preventing application outages caused by unvetted AI generated code](https://www.wearedevelopers.com/videos/1365-wearedevelopers-live-the-weekly-developer-show-with-chris-heilmann-and-daniel-cranney) (from " WeAreDevelopers LIVE - the weekly developer show with Chris Heilmann and Daniel Cranney")
- [Security vulnerabilities introduced by frictionless AI code generation](https://www.wearedevelopers.com/videos/1267-exploring-ai-opportunities-and-risks-in-development) (from "Exploring AI: Opportunities and Risks in Development")
- [Security vulnerabilities hidden in elegant syntax](https://www.wearedevelopers.com/videos/1327-wearedevelopers-live-is-ai-replacing-developers-stopping-bots-ai-on-device-more) (from "WeAreDevelopers LIVE - Is AI replacing developers?, Stopping bots, AI on device & more")
- [Building a vulnerable application for security testing](https://www.wearedevelopers.com/videos/100052-spot-squash-secure-fighting-security-bugs-with-github-copilot) (from "Spot, Squash, Secure: Fighting Security Bugs with GitHub Copilot")
- [Addressing security flaws in AI-generated code](https://www.wearedevelopers.com/videos/715-a-hundred-ways-to-wreck-your-ai-the-in-security-of-machine-learning-systems) (from "A hundred ways to wreck your AI - the (in)security of machine learning systems")
- [The impact and risks of AI generated code](https://www.wearedevelopers.com/videos/1280-navigating-the-future-of-junior-developers-in-tech) (from "Navigating the Future of Junior Developers in Tech")

## Related Articles

- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)

## Related Jobs

- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Security Architect - AI](https://www.wearedevelopers.com/jobs/ext/1581899-security-architect-ai) at **ZEISS Group**
- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**
- [Principal Software Engineer, Enterprise AI Platform](https://www.wearedevelopers.com/jobs/ext/1467292-principal-software-engineer-enterprise-ai-platform) at **GitHub**
- [Senior Software Engineer](https://www.wearedevelopers.com/jobs/ext/15942-senior-software-engineer) at **GitHub**