{
  "resource_type": "assessment_script",
  "name": "csharp-deserialization-security-assessment",
  "version": "1.0",
  "purpose": "Assess .NET deserialization paths for remote code execution risk and control gaps.",
  "usage": {
    "input": {
      "path": "./inputs/deserialization-surface.json"
    },
    "output": {
      "path": "./outputs/deserialization-assessment-report.json"
    }
  },
  "parameters": {
    "application_name": {
      "type": "string",
      "required": true,
      "description": "Name of the application, service, or worker being reviewed."
    },
    "component_name": {
      "type": "string",
      "required": true,
      "description": "Endpoint, queue consumer, job, or library path under review."
    },
    "serializer": {
      "type": "string",
      "required": true,
      "description": "Serializer or format in use, such as System.Text.Json, Newtonsoft.Json, XML, or a legacy binary mechanism."
    },
    "trust_boundary": {
      "type": "string",
      "required": true,
      "description": "Source trust level, such as public, partner, internal, or fully controlled."
    }
  },
  "checks": [
    {
      "id": "CHK-001",
      "name": "Identify trust boundary",
      "description": "Confirm whether the payload can be influenced by an untrusted or partially trusted source.",
      "inputs": ["trust_boundary"],
      "pass_criteria": "The input source is documented and treated as untrusted unless proven otherwise."
    },
    {
      "id": "CHK-002",
      "name": "Review serializer capabilities",
      "description": "Determine whether the serializer supports polymorphic type resolution, custom binders, or legacy runtime behavior.",
      "inputs": ["serializer"],
      "pass_criteria": "No unrestricted payload-driven type selection is enabled for untrusted input."
    },
    {
      "id": "CHK-003",
      "name": "Inspect activation paths",
      "description": "Verify whether constructors, property setters, callbacks, custom converters, or post-deserialization hooks can execute logic.",
      "pass_criteria": "Deserialized types are data-only DTOs and do not execute business logic during materialization."
    },
    {
      "id": "CHK-004",
      "name": "Constrain the type surface",
      "description": "Confirm that the payload cannot choose arbitrary runtime types or load unknown object graphs.",
      "pass_criteria": "Allowed types are explicitly allowlisted and mapped to known contracts."
    },
    {
      "id": "CHK-005",
      "name": "Validate fail-closed behavior",
      "description": "Check that malformed, unexpected, or version-mismatched input is rejected rather than permissively interpreted.",
      "pass_criteria": "Invalid input fails closed with no fallback to a more permissive parsing mode."
    },
    {
      "id": "CHK-006",
      "name": "Confirm isolation and observability",
      "description": "Validate logging, rate limiting, alerting, and containment for the deserialization boundary.",
      "pass_criteria": "Failures are observable and the component is isolated enough to reduce blast radius."
    }
  ],
  "risk_signals": [
    "Payload-controlled type metadata",
    "Legacy binary serialization for untrusted data",
    "Direct deserialization into behavior-bearing domain objects",
    "Fallback to permissive settings for compatibility",
    "Unexpected constructors, callbacks, or converters"
  ],
  "recommended_controls": [
    "Deserialize into sealed, known DTOs only",
    "Use explicit allowlists for allowed message shapes and types",
    "Reject unknown or unexpected fields when practical",
    "Separate deserialization from business execution",
    "Version the contract instead of relaxing security settings",
    "Log and monitor deserialization failures as security signals"
  ],
  "report_template": {
    "summary": "",
    "findings": [
      {
        "check_id": "CHK-001",
        "status": "pass",
        "notes": ""
      }
    ],
    "overall_risk": "low",
    "decision": "approve",
    "next_steps": []
  },
  "output_rules": {
    "status_values": ["pass", "fail", "warning", "not_applicable"],
    "overall_risk_values": ["low", "medium", "high", "critical"],
    "decision_values": ["approve", "approve_with_conditions", "reject"],
    "validation": [
      "Do not accept unknown control gaps as pass",
      "Fail any unreviewed deserialization path that crosses a trust boundary",
      "Record compensating controls when a risky pattern cannot be removed immediately"
    ]
  }
}