THREAT_MODEL.md

# Security Threat Model

## Asset Definition & Scope

This threat model covers the **`Appsheet.DotNetFrameworkUriEscaping`**
repository
(`sso://gnocchi-internal/third_party/dot-net-framework-uri-escaping`), a C#
shared library targeting `.NET Standard 2.0`. The repository contains a custom
fork of Microsoft .NET Framework 4.6.2 Reference Source (`NetFrameworkUri.cs`)
configured to execute in legacy V2 quirks mode (RFC 2396). It provides
`NetFrameworkUri.EscapeDataString()` to escape query parameters identically to
legacy .NET Framework (notably preserving unreserved characters such as `(` and
`)`), which is utilized by AppSheet to verify cryptographic signatures on legacy
image URLs generated prior to AppSheet's migration to .NET Core.

## Prioritization Signals

-   **1P OSS:** No
-   **1P Proprietary Shipped Software:** No (Server-side library powering
    AppSheet cloud services)
-   **High-Risk Code Surface:** Yes. Utilizes C# `unsafe` pointer operations,
    stack allocations (`stackalloc`), raw buffer copying (`Buffer.BlockCopy`),
    and custom Unicode surrogate/UTF-8 byte processing on untrusted external URL
    strings.
-   **Perimeter Exposure:** Yes (Exposed via AppSheet public-facing internet
    service and customer endpoints).
-   **Data Sensitivity:** Medium/High (Processes customer image URLs, query
    parameters, HMAC/signature tokens, and customer data identifiers).
-   **Untrusted Input Handling:** Yes (Consumes raw, untrusted URI strings and
    query parameters from external HTTP requests).
-   **Business Value:** Critical for preserving backwards compatibility and
    security of AppSheet's legacy image URL signature verification pipeline,
    preventing unauthorized access to customer image assets.

## Scanning Harness Prompts

-   Focus on pointer arithmetic, buffer boundary calculations, and array
    allocations in `NetFrameworkUri.EscapeString` and
    `NetFrameworkUri.EnsureDestinationSize`. Check for potential off-by-one or
    integer overflow vulnerabilities when indexing characters, calculating
    surrogate pair offsets (`pStr[i + count - 1]`), or converting UTF-8 bytes
    (`Encoding.UTF8.GetBytes`).
-   Inspect unsafe stack allocation `stackalloc byte[160]`
    (`c_MaxUnicodeCharsReallocate * c_MaxUTF_8BytesPerUnicodeChar`) and verify
    whether input strings with surrogate pairs or long sequences of non-ASCII
    characters can cause buffer overruns in `Encoding.UTF8.GetBytes(pStr + i,
    count, bytes, 160)`.
-   Analyze surrogate pair handling (`0xD800` to `0xDBFF`) for malformed Unicode
    inputs (e.g., truncated high surrogates, unpaired surrogates, non-shortest
    form UTF-8) to ensure `UriFormatException` is reliably thrown without memory
    corruption or infinite loops (`for (; count < maxSize && pStr[i + count] >
    '\x7f'; ++count)`).
-   Evaluate differential URI escaping/unescaping behavior between RFC 2396 (V2
    quirks mode) and modern RFC 3986 / .NET Core parsers to ensure that
    canonicalization differences cannot be exploited for signature validation
    bypass or request spoofing in downstream AppSheet components.

## Entry Points and Untrusted Inputs

| Entry Point                              | Type     | Trusted?   | Validation           |
| ---------------------------------------- | -------- | ---------- | -------------------- |
| `NetFrameworkUri.EscapeDataString(string | Public   | No         | Validates null,      |
: stringToEscape)`                         : C#       : (Untrusted : empty string,        :
:                                          : Static   : query      : surrogate pairs,     :
:                                          : Method   : parameters : UTF-8 encodability,  :
:                                          :          : and URLs   : and enforces         :
:                                          :          : from       : `c_MaxUriBufferSize` :
:                                          :          : external   : (65,520 chars)       :
:                                          :          : users)     :                      :
| `NetFrameworkUri.EscapeString(...)`      | Internal | No (Raw    | Enforces `end -      |
:                                          : Unsafe   : string and : start <              :
:                                          : Static   : substring  : c_MaxUriBufferSize`; :
:                                          : Method   : bounds)    : validates high/low   :
:                                          :          :            : surrogates and UTF-8 :
:                                          :          :            : byte conversion      :

## Trust Boundaries and Auth Assumptions

-   **Authentication**: None within this library (assumed to be invoked by
    AppSheet backend during authentication and signature verification
    pipelines).
-   **Authorization**: None within this library.
-   **Implicit trust**: The library assumes callers pass .NET string objects
    within valid memory; however, the string content itself is treated as
    completely untrusted.
-   **Boundary crossings**: External user/client request → AppSheet HTTP edge /
    API handler → `NetFrameworkUri.EscapeDataString` → Signature validator /
    image storage fetcher.

## Sensitive Data Paths

| Data Type  | Source   | Destination                        | Protection           |
| ---------- | -------- | ---------------------------------- | -------------------- |
| Customer   | External | `NetFrameworkUri.EscapeDataString` | In-memory            |
: image URLs : client   : -> Signature verification hash /   : processing; input    :
: & query    : requests : HMAC engine                        : size limited by      :
: parameters :          :                                    : `c_MaxUriBufferSize` :
| Image URL  | External | Signature verification comparison  | Processed in string  |
: signatures : client   : logic                              : / character buffers  :
: & HMAC     : requests :                                    :                      :
: tokens     :          :                                    :                      :

## Privileged Actions

| Action               | Location                                | Guard                           |
| -------------------- | --------------------------------------- | ------------------------------- |
| Unsafe stack         | `NetFrameworkUri.EscapeString`          | Fixed allocation size           |
: allocation           :                                         : (`c_MaxUnicodeCharsReallocate * :
: (`stackalloc`)       :                                         : c_MaxUTF_8BytesPerUnicodeChar`  :
:                      :                                         : = 160 bytes); bounded by        :
:                      :                                         : `maxSize` calculation           :
| Direct pointer       | `NetFrameworkUri.EscapeString`,         | Fixed pointer pins (`fixed      |
: dereferencing &      : `NetFrameworkUri.EnsureDestinationSize` : (char* pStr = input)`); bounded :
: traversal (`char*`,  :                                         : loop index and `prevInputPos`   :
: `byte*`)             :                                         : tracking                        :
| Raw buffer copy      | `NetFrameworkUri.EnsureDestinationSize` | Reallocation logic with         |
: (`Buffer.BlockCopy`) :                                         : `destPos << 1` byte count       :

## Priority Review Areas

1.  **Unsafe Pointer Manipulation and Buffer Resizing:** Verify bounds checks in
    `NetFrameworkUri.EscapeString` and `NetFrameworkUri.EnsureDestinationSize`
    under edge cases (e.g. repeated resizing, maximum buffer size, mixed ASCII
    and non-ASCII sequences).
2.  **Malformed Unicode & Surrogate Pair Handling:** Review behavior when
    processing lone high surrogates, lone low surrogates, or invalid UTF-8 byte
    sequences at string boundaries (`count == 1 || count == end - i`).
3.  **V2 Quirks Differential & RFC 2396 Compliance:** Review the character sets
    in `RFC2396UnreservedMarks` (`-_.~*'()!`) vs `RFC3986UnreservedMarks`
    (`-_.~`) and ensure signature calculations in AppSheet cannot be
    desynchronized between .NET Framework and .NET Core.
4.  **Denial of Service (DoS) via Exception Flooding or Buffer Limits:** Check
    if large or invalid URI payloads (approaching `c_MaxUriBufferSize = 0xFFF0`)
    can cause high CPU usage or excessive garbage collection.