Implement SafeVault security framework with input sanitization, BCrypt authentication, and RBAC

[Copilot]

SafeVault demonstrates defense-in-depth security practices: input sanitization (XSS/SQLi), parameterized queries, BCrypt password hashing, and role-based authorization.

Security Components

InputSanitizer - XSS prevention via HTML entity encoding, SQL injection pattern detection via regex, email/username validation

InputSanitizer.SanitizeForXss("<script>alert('XSS')</script>");
// → "&lt;script&gt;alert(&#x27;XSS&#x27;)&lt;&#x2F;script&gt;"

InputSanitizer.ContainsSqlInjectionPattern("admin' OR '1'='1"); // → true

AuthService - BCrypt password hashing with automatic salting, strength validation (8+ chars, mixed case, digit, special char)

string hash = AuthService.HashPassword("SecurePass123!");
AuthService.VerifyPassword("SecurePass123!", hash); // → true
AuthService.IsStrongPassword("weak"); // → false

RoleAuthorization - Role-based access control, admin privilege checks, resource ownership validation

RoleAuthorization.RequireAdmin(user); // throws UnauthorizedAccessException if not admin
RoleAuthorization.CanAccessResource(user, resourceId); // admins access all, users only own

UserRepository - Parameterized SQL queries via DbCommand.Parameters preventing injection

cmd.Parameters.AddWithValue("@Username", username);
cmd.Parameters.AddWithValue("@Email", email);

Data Model

User entity with Id, Username, Email, PasswordHash (BCrypt only), Role (admin/user)

Deliverables

• webform.html - Client-side validation demo
• database.sql - SQLite schema with sample BCrypt hashes
• SECURITY_SUMMARY.md - Documents 6 vulnerability classes addressed: XSS, SQLi, weak input validation, plaintext passwords, missing authorization, weak password requirements
• Test suite - 58 NUnit tests covering input validation, authentication, authorization, and security regression

Original prompt

Create a C# project named SafeVault with secure input sanitization, parameterized SQL queries, authentication with hashed passwords, and role-based authorization. Include a User model, AuthService, RoleAuthorization, InputSanitizer, UserRepository, and a Tests folder with NUnit tests for validation, auth, roles, and security regression.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.