Security Best Practices and Safe Extension Points

Overview

This document outlines the security hardening measures implemented in the FlowCore and provides guidance for safely extending the system with custom workflow blocks.

Security Features

Dynamic Assembly Loading Protection

The WorkflowBlockFactory now includes comprehensive security measures to prevent malicious assembly loading:

1. Assembly Loading Controls

Default Security Setting:

// Dynamic assembly loading is DISABLED by default for security
var factory = new WorkflowBlockFactory(serviceProvider); // Secure by default

Explicit Opt-in Required:

// Must explicitly enable dynamic assembly loading
var securityOptions = new WorkflowBlockFactorySecurityOptions
{
    AllowDynamicAssemblyLoading = true,
    AllowedAssemblyNames = new[] { "MyCompany.WorkflowBlocks", "TrustedBlocks" },
    ValidateStrongNameSignatures = true
};

var factory = new WorkflowBlockFactory(serviceProvider, securityOptions);

2. Assembly Whitelist Protection

Only assemblies explicitly listed in the whitelist can be loaded:

var securityOptions = new WorkflowBlockFactorySecurityOptions
{
    AllowDynamicAssemblyLoading = true,
    AllowedAssemblyNames = new[] {
        "MyCompany.WorkflowBlocks",
        "TrustedBlocks.Library",
        "ApprovedExtensions"
    }
};

3. Strong-Name Signature Validation

All dynamically loaded assemblies must have valid strong-name signatures:

var securityOptions = new WorkflowBlockFactorySecurityOptions
{
    AllowDynamicAssemblyLoading = true,
    ValidateStrongNameSignatures = true,
    AllowedPublicKeyTokens = new[] {
        new byte[] { 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC, 0xDE, 0xF0 }, // Your company's key
        new byte[] { 0xAB, 0xCD, 0xEF, 0x12, 0x34, 0x56, 0x78, 0x90 }  // Trusted partner's key
    }
};

Safe Extension Points

1. Creating Custom Workflow Blocks

Secure Implementation Pattern:

using FlowCore.Core.Interfaces;

public class MyCustomBlock : IWorkflowBlock
{
    private readonly ILogger<MyCustomBlock> _logger;

    public MyCustomBlock(ILogger<MyCustomBlock> logger)
    {
        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
    }

    public string NextBlockOnSuccess => "next_block_name";
    public string NextBlockOnFailure => "error_block_name";

    public async Task<ExecutionResult> ExecuteAsync(ExecutionContext context)
    {
        try
        {
            // Validate input security
            if (!IsInputSecure(context.Input))
            {
                return ExecutionResult.Failure("security_validation_failed");
            }

            // Perform business logic
            var result = await PerformSecureOperation(context);

            return ExecutionResult.Success(NextBlockOnSuccess);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error in MyCustomBlock");
            return ExecutionResult.Failure(NextBlockOnFailure);
        }
    }

    private bool IsInputSecure(object input)
    {
        // Implement security validation logic
        return input != null && IsValidInputType(input);
    }

    private async Task<object> PerformSecureOperation(ExecutionContext context)
    {
        // Implement your business logic with security considerations
        return await Task.FromResult(new { Processed = true });
    }
}

2. Dependency Injection Registration

Secure Service Registration:

public void ConfigureServices(IServiceCollection services)
{
    // Register your custom blocks for DI resolution
    services.AddTransient<MyCustomBlock>();
    services.AddTransient<IWorkflowBlock, MyCustomBlock>(sp =>
        sp.GetRequiredService<MyCustomBlock>());

    // Configure security options
    services.Configure<WorkflowBlockFactorySecurityOptions>(options =>
    {
        options.AllowDynamicAssemblyLoading = false; // Disable for maximum security
        options.ValidateStrongNameSignatures = true;
    });

    // Register factory with security options
    services.AddTransient<IWorkflowBlockFactory>(sp =>
    {
        var securityOptions = sp.GetRequiredService<IOptions<WorkflowBlockFactorySecurityOptions>>().Value;
        return new WorkflowBlockFactory(sp, securityOptions, sp.GetService<ILogger<WorkflowBlockFactory>>());
    });
}

3. JSON Workflow Definitions (Secure Approach)

Instead of dynamic assembly loading, use pre-registered types:

{
  "workflow": {
    "id": "secure_workflow",
    "nodes": {
      "custom_processing": {
        "type": "MyCompany.WorkflowBlocks.MyCustomBlock, MyCompany.WorkflowBlocks",
        "configuration": {
          "setting1": "value1",
          "setting2": "value2"
        },
        "transitions": {
          "success": "next_node",
          "failure": "error_handler"
        }
      }
    }
  }
}