Restrict sensitive APIs to reviewed components

Rule ND3138 Security

Matches application methods that call a sensitive API directly, while not being declared in one of the reviewed components named in the rule source: process execution (Process.Start()), dynamic loading (Assembly.Load(), Activator.CreateInstance(string), Type.GetType(string)), raw SQL (DbCommand.CommandText, EF Core Raw entry points, Dapper) and cryptographic primitives (Aes, RSA, HMAC, RandomNumberGenerator, Rfc2898DeriveBytes...).

This rule expresses an architectural policy rather than a defect: the few places allowed to touch such APIs are known, reviewed and kept small, so that argument escaping, path validation, parameterization and key management are implemented once. Every other call site is a bypass to review. The rule ships inactive: edit the reviewedTypes and reviewedNamespaces lists at the top of the query with the names of your wrappers, trim the API families you don't care about, then activate it. Until the lists are filled, every direct call would be reported.

Flagged Code
public class ReportExporter {
   public void OpenInViewer(string reportPath) {
      Process.Start("viewer.exe", reportPath);           // flagged: direct call outside wrappers
   }
}
Fixed Code
public class ReportExporter {
   public void OpenInViewer(string reportPath) {
      _processRunner.Run("viewer.exe", reportPath);      // reviewed wrapper listed in the rule
   }
}
namespace MyCompany.Infrastructure.Security {
   public sealed class ProcessRunner {                    // validates and escapes arguments once
      public void Run(string exe, params string[] args) { /* ArgumentList, no shell */ }
   }
}

How to fix

Route the call through the reviewed wrapper that centralizes the safety checks for that API family. When the calling type is itself a legitimate wrapper, add its full name to the reviewedTypes list (or its namespace to reviewedNamespaces) in the rule source.

When an API family is not a concern for the application, remove it from the sensitiveMembers definition rather than suppressing issues one by one.

CQLinq source

This rule is written in CQLinq, C# LINQ over the NDepend code model. It ships with every new NDepend project: you can read it, adapt it, or use it as a starting point for your own custom rules.

// <Name>Restrict sensitive APIs to reviewed components</Name>
// <Id>ND3138:RestrictSensitiveApisToReviewedComponents</Id>
warnif count > 0

//------------------------------------------------------------------------------------
// CONFIGURATION: name here the reviewed components (types or namespaces) that are
// allowed to call the sensitive APIs directly. Every other application method calling
// one of these APIs is reported. Activate the rule once this list is filled.
//------------------------------------------------------------------------------------
let reviewedTypes = Application.Types.WithFullNameIn(
  "MyCompany.Infrastructure.Security.ProcessRunner",
  "MyCompany.Infrastructure.Security.PluginLoader",
  "MyCompany.Infrastructure.Security.CryptoService").ToHashSetEx()

let reviewedNamespaces = Application.Namespaces.WithNameIn(
  "MyCompany.Infrastructure.Data").ToHashSetEx()

//------------------------------------------------------------------------------------
// SENSITIVE APIS: each family can be trimmed or extended.
// Third-party members are part of the code model only when the application uses them.
//------------------------------------------------------------------------------------
let sensitiveMembers = ThirdParty.Methods.Where(m =>

   // Process execution
   (m.ParentType.FullName == "System.Diagnostics.Process" && m.SimpleName == "Start") ||
   (m.ParentType.FullName == "System.Diagnostics.ProcessStartInfo" && m.IsConstructor) ||

   // Dynamic code loading and late-bound instantiation
   (m.ParentType.FullName == "System.Reflection.Assembly" && m.SimpleName.StartsWithAny("Load", "ReflectionOnlyLoad", "UnsafeLoadFrom")) ||
   (m.ParentType.FullName == "System.Runtime.Loader.AssemblyLoadContext" && m.SimpleName.StartsWith("LoadFrom")) ||
   (m.ParentType.FullName == "System.Activator" && m.SimpleName.StartsWith("CreateInstance") && m.Name.Contains("String")) ||
   (m.ParentType.FullName == "System.Type" && m.SimpleName == "GetType" && m.Name.Contains("String")) ||

   // Raw SQL
   (m.ParentType.FullName.EndsWithAny("DbCommand", "SqlCommand", "OracleCommand", "NpgsqlCommand", "MySqlCommand", "SqliteCommand") &&
    (m.SimpleName == "set_CommandText" || (m.IsConstructor && m.Name.Contains("String")))) ||
    m.SimpleNameEqualsAny("FromSqlRaw", "ExecuteSqlRaw", "ExecuteSqlRawAsync", "SqlQueryRaw", "ExecuteSqlCommand", "ExecuteSqlCommandAsync") ||
   (m.ParentType.FullName.StartsWith("Dapper.") && m.SimpleName.StartsWithAny("Query", "Execute")) ||

   // Cryptographic primitives
   (m.ParentType.FullName.StartsWith("System.Security.Cryptography.") &&
    m.ParentType.SimpleNameEqualsAny("Aes", "AesGcm", "AesCcm", "ChaCha20Poly1305", "TripleDES", "DES", "RC2", "Rijndael",
                                       "RSA", "ECDsa", "ECDiffieHellman", "DSA", "HMAC", "HashAlgorithm", "SymmetricAlgorithm",
                                       "AsymmetricAlgorithm", "RandomNumberGenerator", "ProtectedData", "Rfc2898DeriveBytes") &&
    (m.IsConstructor || (m.IsStatic && m.SimpleName.StartsWithAny("Create", "Protect", "Unprotect", "Pbkdf2")))))
   .ToHashSetEx()

where sensitiveMembers.Any()

from m in Application.Methods.UsingAny(sensitiveMembers)

// The method's type (or the reviewed type it is nested in: lambda closures, nested helpers)
// or its namespace is a reviewed component.
let reviewedTypesAndNested = reviewedTypes.Concat(reviewedTypes.SelectMany(t => t.NestedTypes)).ToHashSetEx()
where !reviewedTypesAndNested.Contains(m.ParentType) &&
      !reviewedNamespaces.Contains(m.ParentNamespace)

let sensitiveMembersUsed = m.MethodsCalled.Intersect(sensitiveMembers).ToArray()
select new {
  m,
  sensitiveMembersUsed,
  Debt = (10 + 5 * sensitiveMembersUsed.Length).ToMinutes().ToDebt(),
  Severity = Severity.Medium
}

//<Expl>
// The method *{0}* calls the sensitive API *{1}* directly, outside of the
// reviewed components listed in the rule. Route the call through the
// reviewed wrapper, or add the declaring type to the list once it has
// been reviewed.
//</Expl>

// <Desc>
// Matches application methods that call a sensitive API directly, while
// not being declared in one of the reviewed components named in the
// rule source: process execution (*Process.Start()*), dynamic loading
// (*Assembly.Load()*, *Activator.CreateInstance(string)*,
// *Type.GetType(string)*), raw SQL (*DbCommand.CommandText*, EF Core
// *Raw* entry points, Dapper) and cryptographic primitives (*Aes*, *RSA*,
// *HMAC*, *RandomNumberGenerator*, *Rfc2898DeriveBytes*...).
//
// This rule expresses an **architectural policy** rather than a defect:
// the few places allowed to touch such APIs are known, reviewed and kept
// small, so that argument escaping, path validation, parameterization
// and key management are implemented once. Every other call site is a
// bypass to review. The rule ships **inactive**: edit the *reviewedTypes*
// and *reviewedNamespaces* lists at the top of the query with the names
// of your wrappers, trim the API families you don't care about, then
// activate it. Until the lists are filled, every direct call would be
// reported.
//
// **Flagged Code**
// ```csharp
// public class ReportExporter {
//    public void OpenInViewer(string reportPath) {
//       Process.Start("viewer.exe", reportPath);           // flagged: direct call outside wrappers
//    }
// }
// ```
//
// **Fixed Code**
// ```csharp
// public class ReportExporter {
//    public void OpenInViewer(string reportPath) {
//       _processRunner.Run("viewer.exe", reportPath);      // reviewed wrapper listed in the rule
//    }
// }
// namespace MyCompany.Infrastructure.Security {
//    public sealed class ProcessRunner {                    // validates and escapes arguments once
//       public void Run(string exe, params string[] args) { /* ArgumentList, no shell */ }
//    }
// }
// ```
// </Desc>

// <HowToFix>
// Route the call through the reviewed wrapper that centralizes the
// safety checks for that API family. When the calling type is itself a
// legitimate wrapper, add its full name to the *reviewedTypes* list (or
// its namespace to *reviewedNamespaces*) in the rule source.
//
// When an API family is not a concern for the application, remove it
// from the *sensitiveMembers* definition rather than suppressing issues
// one by one.
// </HowToFix>

Open in the interactive Rules Explorer · All default rules

Security: all 39 items