Tag: security

W^X (write xor execute) is the rule that no memory page is writable and executable at the same time. In .NET it is the DOTNET_EnableWriteXorExecute knob, on by default since .NET 7, and it exists entirely for the JIT. Native AOT never reads it. Here is how the runtime implements it, what it costs, and when turning it off is a legitimate fix.

Until now the only way to hand every developer the same MCP servers was managed-mcp.json, a file at a system path that takes exclusive control of MCP. Claude Code 2.1.259 adds a managedMcpServers setting for HTTP and SSE servers, and quietly narrows what allowedMcpServers governs.

Defensive system prompts are heuristic. Information-flow control is not: label every piece of content with integrity and confidentiality, propagate most-restrictive-wins through every tool call, and check the label at the sink before it runs. An 80-line runnable harness, the Agent Framework FIDES implementation, and the false positives the pattern buys you.

BinaryFormatter's implementation was deleted in .NET 9 and still throws PlatformNotSupportedException on .NET 10 and .NET 11: how to choose a replacement serializer, read already-persisted NRBF blobs with NrbfDecoder, and what breaks in WinForms, WPF, and ResX.

A symlink swapped after the check, deny rules that stopped applying through a symlinked search path, a marketplace command pointing outside its plugin, and a workflow script read before approval. Four fixes in one release, all the same bug.

A headersHelper field on url marketplaces and catalog entries runs a local command that prints HTTP headers, so an internal plugin catalog behind S3 or an artifact repo can authenticate with a short-lived token. Here is the schema, the consent prompt, and the header names Claude Code drops.

The 3.47.1 hotfix validates plugin class and package identifiers before they land in GeneratedPluginRegistrant. Here is the hole it closes, the regex that closes it, and the other 11 fixes in the release.

Semantic Kernel .NET 1.80.0 ships a breaking change: the OpenAPI plugin's default HttpClient no longer follows redirects, closing an SSRF bypass. Here is what changes and why your own HttpClient reopens the hole.

Claude Code and GitHub Copilot both ship allowedMcpServers and deniedMcpServers, but the matchers behave differently. serverName is a fallback that a single serverCommand entry silently disables, deny is a union while allow is not, and an invalid allowlist locks everything out.

A complete guide to redacting classified data in source-generated logs: build a taxonomy, write a Redactor, wire EnableRedaction and AddRedaction, and understand the discriminator that silently breaks partial masking. With real output from Microsoft.Extensions.Compliance.Redaction 10.9.0.