Security ToDos

[shpaass]

This issue contains a list of security things that I need to address at some point.

• Add a security scanner (something like Veracode) into CI and run it at least before every release.
• Check that the scanner detects PUA characters. Here is a more recent example.

Everyone is free to to add more things to consider security-wise.

[veger]

Can this PUA attack even be executed in C#? It is a compiled language and cannot dynamically run code (using some eval())? Then again, there might be enough .Net magic, to support these kind of things. Or maybe on the Lua scripting side of things.

So I think it could be a good idea to scan code/PRs for vulnerabilities.

[DaleStan]

Yes, C# can construct the equivalent of eval. C# code and IL bytes can both be used as input.

The simplest form would probably use IL bytes. This one also allows non-PUA characters in the attack string, if the attacker thinks that would be advantageous.

Assembly.Load("".Select(ch => (byte)ch).ToArray()).EntryPoint.Invoke(null, null);

We're clean for now; my current working tree has 172 non-ASCII characters (strictly: UTF-16 code units other than 000A, 000D, and 0020-007E), and most of them are in the initialization of languageMapping.

Details

Appearances	# chars	List of characters
1	69	àâíñăğşųΕΜάηικνгезйнпшъьяїҚқביערתابةرعليทยไათილრუქếệK≥処日本気汉漢砕礦语軽鈾鉱국어한
2	10	êüčıšλπбл語
3	4	çиу≠
4	1	²
5	1	р
6	1	к
7	2	¥с
8	1	а
14	1	°
20	1	μ

---

The biggest attack surface by far is the mods we load. We can't prevent mods from trying to escape our Lua sandbox, but we should test to make sure they can't.

[hcoona]

I remember GitHub supports integrating the CodeQL scanner, which could be quite useful for static analysis and security concerns.