E会场-邹溪源-DotNET企业应用安全开发动向.pdf

1、.NET?=?or?or?可信软件架构安全性设备安全数据安全内容安全行为安全高性能可用性韧性容错性弹性恢复质量可靠CIA?机密性Confidentiality完整性Integrity可用性Availability?Twitter?Log4shell?Sqlite?Fastjson?以系统为中心以攻击者为中心以资产为中心1?TVRA?Threat,Vulnerability And Risk Assessment?/TARA?Threat Analysis and Risk Assessment?2?/?3?STRIDE?TARATARA?=?STRIDESTRIDE?制定数据流图分析威胁评估风

2、险制定消减措施落实消减措施STRIDE=Spooling+Tampering+Repudiation+InformationDisclosure+Dos+Evelation Of Privilege (?)?外部实体处理过程数据存储数据流?STRIDE?.NET.NET?-?CVE-2023-36038-.NET Denial of Service Vulnerability?IIS?CVE-2023-36049-.NET Elevation of Privilege Vulnerability?FTP?CVE-2023-36558-.NET Security Feature Bypass V

3、ulnerability?Blazor Server?.NET.NET?1?Systemd?Windows Service?IHost host=Host.CreateDefaultBuilder(args).UseSystemd()/?Linux Systemd?.UseWindowsService()/?Windows?.ConfigureServices(services=services.AddHostedService();).Build();host.Run();2?Docker?FROM AS build WORKDIR/source.NET?root?Chiseled Ubun

4、tu?5?Bug?OpenEuler?OpenEuler?.NET?1?AspNetCore Ratelimiting,?Microsoft.AspNetCore.RateLimiting?using Microsoft.AspNetCore.RateLimiting;using System.Threading.RateLimiting;var builder=WebApplication.CreateBuilder(args);builder.Services.AddRateLimiter(_=_.AddFixedWindowLimiter(policyName:fixed,options

5、=options.PermitLimit=4;options.Window=TimeSpan.FromSeconds(12);options.QueueProcessingOrder=QueueProcessingOrder.OldestFirst;options.QueueLimit=2;);var app=builder.Build();app.UseRateLimiter();static string GetTicks()=(DateTime.Now.Ticks&0 x11111).ToString(00000);app.MapGet(/,()=Results.Ok($Hello Ge

6、tTicks().RequireRateLimiting(fixed);app.Run();https:/ Core Identity?Cookie?Windows?.NET8?SPA?Blazor?1?class MyUser:IdentityUser 2?Identity?builder.Services.AddAuthentication(IdentityConstants.ApplicationScheme).AddIdentityCookies();builder.Services.AddAuthoriz