rules-fsharp

Usage of deprecated 'System.Net.WebClient' detected. 'WebClient' is an older API and is not recommended for new development due to its limited features and potential security implications (e.g., default TLS versions). Consider using 'System.Net.Http.HttpClient' for modern, more secure, and flexible HTTP communication.

Insecure Deserialization detected. Using 'BinaryFormatter' to deserialize untrusted data can lead to arbitrary code execution (Remote Code Execution). This API is considered highly insecure. Prefer safer serialization formats like JSON (e.g., 'System.Text.Json' or Newtonsoft.Json) or Protocol Buffers, and ensure deserialization only occurs from trusted sources with strict type constraints.

Usage of 'System.Text.Encoding.ASCII' detected. ASCII encoding can lead to data loss or incorrect interpretation for non-ASCII characters, which are common in internationalized applications. It's generally safer and more robust to use 'System.Text.Encoding.UTF8' for text encoding, as it supports a much wider range of characters and is the de-facto standard for web and modern applications.

Potential Path Traversal vulnerability detected. Using 'sprintf' or string concatenation to construct file paths for 'System.IO.File' operations without proper sanitization or validation can allow an attacker to access or modify arbitrary files outside the intended directory. Always validate and sanitize user-supplied path components, or use 'Path.GetFullPath' combined with strict directory checks, or whitelist allowed file names.

Potential SQL or Command Injection vulnerability detected. Using 'sprintf' or string concatenation directly within 'SqlCommand' or 'Process.Start' can allow untrusted input to modify queries or execute arbitrary commands. Always use parameterized queries for database access (e.g., 'SqlCommand.Parameters.AddWithValue') and 'ProcessStartInfo' with 'UseShellExecute = false' and arguments passed as a list, not a single formatted string, to prevent injection.

Weak Cryptographic Hash Algorithm detected. MD5 and SHA1 are cryptographically broken and should not be used for security-sensitive operations like password hashing, digital signatures, or integrity checks. Use stronger algorithms like SHA256 or SHA512 (e.g., 'System.Security.Cryptography.SHA256.Create()'). For password hashing, use 'Rfc2898DeriveBytes' or Argon2.