/*
 * DANGER: This code is highly vulnerable to SQL Injection.
 * NEVER use string concatenation to build SQL queries with user input.
 */
public class VulnerableDataAccess
{
    private readonly string _connectionString;

    public VulnerableDataAccess(string connectionString)
    {
        _connectionString = connectionString;
    }

    public List<User> GetUserByName(string userName)
    {
        List<User> users = new List<User>();
        // Simulate a common SQL Injection payload: ' OR '1'='1
        // If userName is "' OR '1'='1", the query becomes:
        // SELECT Id, Name, Email FROM Users WHERE Name = '' OR '1'='1'
        // This returns ALL users, bypassing authentication or exposing sensitive data.
        string sqlQuery = $"SELECT Id, Name, Email FROM Users WHERE Name = '{userName}'";

        using (SqlConnection connection = new SqlConnection(_connectionString))
        {
            connection.Open();
            using (SqlCommand command = new SqlCommand(sqlQuery, connection))
            {
                using (SqlDataReader reader = command.ExecuteReader())
                {
                    while (reader.Read())
                    {
                        users.Add(new User
                        {
                            Id = reader.GetInt32(0),
                            Name = reader.GetString(1),
                            Email = reader.GetString(2)
                        });
                    }
                }
            }
        }
        return users;
    }
}

public class User
{
    public int Id { get; set; }
    public string Name { get; set; }
    public string Email { get; set; }
}

using System.Data.SqlClient;
using System.Collections.Generic;

public class SecureDataAccess
{
    private readonly string _connectionString;

    public SecureDataAccess(string connectionString)
    {
        _connectionString = connectionString;
    }

    /*
     * SECURE: This method uses parameterized queries to prevent SQL Injection.
     * User input is treated as data, not executable code.
     */
    public List<User> GetUserByNameSecure(string userName)
    {
        List<User> users = new List<User>();
        // Define the SQL query with placeholders for parameters (e.g., @userName)
        string sqlQuery = "SELECT Id, Name, Email FROM Users WHERE Name = @userName";

        using (SqlConnection connection = new SqlConnection(_connectionString))
        {
            connection.Open();
            using (SqlCommand command = new SqlCommand(sqlQuery, connection))
            {
                // Add parameters, specifying their name and value.
                // The database engine correctly separates the query logic from the input data.
                command.Parameters.AddWithValue("@userName", userName);

                using (SqlDataReader reader = command.ExecuteReader())
                {
                    while (reader.Read())
                    {
                        users.Add(new User
                        {
                            Id = reader.GetInt32(0),
                            Name = reader.GetString(1),
                            Email = reader.GetString(2)
                        });
                    }
                }
            }
        }
        return users;
    }

    /*
     * SECURE: Example using Entity Framework Core for secure data access.
     * EF Core automatically uses parameterized queries, abstracting away the manual process.
     */
    public class ApplicationDbContext : DbContext
    {
        public DbSet<User> Users { get; set; }

        public ApplicationDbContext(DbContextOptions<ApplicationDbContext> options) : base(options) { }

        public List<User> GetUserByNameEF(string userName)
        {
            // EF Core generates parameterized queries automatically for LINQ expressions.
            // This is the recommended modern approach in .NET applications.
            return Users.Where(u => u.Name == userName).ToList();
        }
    }
}

using Microsoft.AspNetCore.Mvc;
using System.Web;

namespace SecureWebApp.Controllers
{
    public class VulnerableController : Controller
    {
        // DANGER: This action is vulnerable to Reflected XSS.
        // It directly outputs user-controlled data without proper encoding.
        public IActionResult GreetVulnerable(string name)
        {
            // If 'name' is "<script>alert('XSS!')</script>", it will execute in the browser.
            ViewBag.UserName = name;
            return View("Greet");
        }

        // DANGER: Simulating a Stored XSS scenario (though typically happens via database).
        // Imagine 'comment' is retrieved from a database where it was previously stored unsanitized.
        public IActionResult DisplayCommentVulnerable(string comment)
        {
            // If 'comment' contains HTML/JS, it will render and execute.
            ViewBag.UserComment = comment;
            return View("Comment");
        }
    }
}
/*
 * DANGER: Example Razor View (Greet.cshtml) vulnerable to XSS
 * This directly injects user input into the HTML, allowing script execution.

    <h1>Hello @ViewBag.UserName</h1>

 * DANGER: Example Razor View (Comment.cshtml) vulnerable to XSS
 * If UserComment contains <script> tags, they will execute.

    <p>User Comment: @Html.Raw(ViewBag.UserComment)</p>

 * NOTE: @Html.Raw() explicitly tells Razor to NOT HTML-encode the output.
 * Use with extreme caution and ONLY when you are absolutely certain the content is safe.
 */

using Microsoft.AspNetCore.Mvc;
using System.Web;
using System.Net;

namespace SecureWebApp.Controllers
{
    public class SecureController : Controller
    {
        // SECURE: Example of input validation (server-side) for a name.
        // Combined with output encoding, this provides robust defense.
        public IActionResult GreetSecure(string name)
        {
            if (string.IsNullOrWhiteSpace(name))
            {
                return BadRequest("Name cannot be empty.");
            }
            // Example: Basic sanitization - remove potential script tags (though encoding is primary).
            string sanitizedName = name.Replace("<script>", "").Replace("</script>", "");
            ViewBag.UserName = sanitizedName;
            return View("GreetSecure"); // Renders to GreetSecure.cshtml
        }

        // SECURE: Demonstrates explicit HTML encoding for user-supplied comments.
        // ASP.NET Core Razor typically does this automatically, but explicit use is informative.
        public IActionResult DisplayCommentSecure(string comment)
        {
            // Always HTML encode untrusted data before rendering it to the browser.
            // HttpUtility.HtmlEncode converts characters like '<' to '&lt;', preventing script execution.
            ViewBag.UserComment = HttpUtility.HtmlEncode(comment);
            return View("CommentSecure"); // Renders to CommentSecure.cshtml
        }
    }
}

/*
 * SECURE: Example Razor View (GreetSecure.cshtml) with implicit HTML encoding by Razor.
 * The @ symbol by default HTML-encodes its output, protecting against XSS.

    <h1>Hello @ViewBag.UserName</h1>

 * SECURE: Example Razor View (CommentSecure.cshtml) demonstrating explicit encoding, if needed.
 * While @ViewBag.UserComment alone would be encoded, explicity encoding ensures it.

    <p>User Comment: @ViewBag.UserComment</p>

 * Enabling Content Security Policy (CSP) in Startup.cs or Program.cs (for .NET 6+):

// Add to Program.cs (or Startup.cs Configure method in older ASP.NET Core)
app.Use(async (context, next) =>
{
    // Define a strict CSP. This example allows scripts only from the same origin ('self').
    // For production, customize this to include all necessary domains for scripts, styles, etc.
    // Example: "default-src 'self'; script-src 'self' https://trustedcdn.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests; block-all-mixed-content;"
    string cspValue = "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests; block-all-mixed-content;";
    context.Response.Headers.Add("Content-Security-Policy", cspValue);
    await next.Invoke();
});

// Ensure this middleware is placed early in the pipeline (e.g., after app.UseExceptionHandler but before app.UseRouting)
*/