Sandboxing .NET assemblies for fun, profit and of course security!
summary
Shows a concrete method to limit a NuGet library without changing its source by loading it into a separate folder via AssemblyLoadContext, publishing it self-contained and applying runtime patches with Harmony. Demo patches File.Copy to enforce a canonical output folder and throws on HttpClient.GetStreamAsync so remote fetches fail; patches successfully stop file writes outside the allowed folder and block HTTP in the demo. Notes this is an extra layer of defense not a full security boundary and adds complexity.
AI-written summary · about
chapters (17)
- 0:00Start
- 0:29Background
- 2:10Third-Party Libraries
- 10:09Sandboxing Net Assemblies
- 10:48Goals
- 11:24Sandboxing
- 14:27Webassembly System Interface
- 16:12Code Access Security
- 17:02Stack Walks
- 21:47Write Full Files to Other Folders
- 22:15Pet Reversal
- 24:31Server Side Request Forwarder
- 27:07Assembly Load Context
- 29:02Self-Contained Deployment
- 33:53Managed Libraries
- 39:04Plugins Manager
- 41:03Apply Patches
related talks
59mReducing Third-Party Security Risk in .NET Core Applications
09mLightning Talk: Enabling “Safe” Use of Untrusted Open Source Dependencies with Sandboxing
49mReducing Third-Party Security Risk in .NET Core Applications
45mThe Windows Sandbox Paradox
56mHacking .NET(C#) Applications: The Black Arts (ASM attacks)
56m.NET supply chain: Protecting against hidden threats
36mSandboxing Your Sandbox: Leveraging Hypervisors for WebAssembly Security
38mSandboxing in Linux with zero lines of code