From 13ffa2b5bc178f86e0bcec415465f469ee8951ee Mon Sep 17 00:00:00 2001
From: Nigusu Yenework <nyenework@microsoft.com>
Date: Fri, 10 Jul 2026 15:45:03 -0700
Subject: [PATCH] Add Benchmarking project

---
 NuGetMcpBenchmarks/.gitignore                 |  2 +
 .../UserDataServiceTests.cs                   | 44 +++++++++++++++++++
 .../VulnerableApp.Tests.csproj                | 17 +++++++
 .../VulnerableApp/UserDataService.cs          | 12 +++++
 .../VulnerableApp/VulnerableApp.csproj        | 10 +++++
 5 files changed, 85 insertions(+)
 create mode 100644 NuGetMcpBenchmarks/.gitignore
 create mode 100644 NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp.Tests/UserDataServiceTests.cs
 create mode 100644 NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp.Tests/VulnerableApp.Tests.csproj
 create mode 100644 NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp/UserDataService.cs
 create mode 100644 NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp/VulnerableApp.csproj

diff --git a/NuGetMcpBenchmarks/.gitignore b/NuGetMcpBenchmarks/.gitignore
new file mode 100644
index 0000000..cd42ee3
--- /dev/null
+++ b/NuGetMcpBenchmarks/.gitignore
@@ -0,0 +1,2 @@
+bin/
+obj/
diff --git a/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp.Tests/UserDataServiceTests.cs b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp.Tests/UserDataServiceTests.cs
new file mode 100644
index 0000000..fb7e06a
--- /dev/null
+++ b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp.Tests/UserDataServiceTests.cs
@@ -0,0 +1,44 @@
+using Xunit;
+using VulnerableApp;
+
+namespace VulnerableApp.Tests;
+
+public class UserDataServiceTests
+{
+    [Fact]
+    public void SerializeUser_ProducesValidJson()
+    {
+        var service = new UserDataService();
+        var user = new User("Alice", "alice@example.com", 30);
+
+        var json = service.SerializeUser(user);
+
+        Assert.NotNull(json);
+        Assert.Contains("Alice", json);
+        Assert.Contains("alice@example.com", json);
+    }
+
+    [Fact]
+    public void DeserializeUser_RoundTrips()
+    {
+        var service = new UserDataService();
+        var user = new User("Alice", "alice@example.com", 30);
+
+        var result = service.DeserializeUser(service.SerializeUser(user));
+
+        Assert.NotNull(result);
+        Assert.Equal(user.Name, result.Name);
+        Assert.Equal(user.Email, result.Email);
+        Assert.Equal(user.Age, result.Age);
+    }
+
+    [Fact]
+    public void DeserializeUser_ReturnsNull_ForNullJson()
+    {
+        var service = new UserDataService();
+
+        var result = service.DeserializeUser("null");
+
+        Assert.Null(result);
+    }
+}
diff --git a/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp.Tests/VulnerableApp.Tests.csproj b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp.Tests/VulnerableApp.Tests.csproj
new file mode 100644
index 0000000..6d824ae
--- /dev/null
+++ b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp.Tests/VulnerableApp.Tests.csproj
@@ -0,0 +1,17 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
+    <PackageReference Include="xunit" Version="2.6.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.5.4">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+    <ProjectReference Include="../VulnerableApp/VulnerableApp.csproj" />
+  </ItemGroup>
+</Project>
diff --git a/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp/UserDataService.cs b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp/UserDataService.cs
new file mode 100644
index 0000000..92f00ec
--- /dev/null
+++ b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp/UserDataService.cs
@@ -0,0 +1,12 @@
+using Newtonsoft.Json;
+
+namespace VulnerableApp;
+
+public class UserDataService
+{
+    public string SerializeUser(User user) => JsonConvert.SerializeObject(user);
+
+    public User? DeserializeUser(string json) => JsonConvert.DeserializeObject<User>(json);
+}
+
+public record User(string Name, string Email, int Age);
diff --git a/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp/VulnerableApp.csproj b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp/VulnerableApp.csproj
new file mode 100644
index 0000000..5fcef26
--- /dev/null
+++ b/NuGetMcpBenchmarks/VulnerableUpgrade/VulnerableApp/VulnerableApp.csproj
@@ -0,0 +1,10 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Newtonsoft.Json" Version="12.0.1" />
+  </ItemGroup>
+</Project>