alexei.dolgolyov
0683e348ba
Two defense-in-depth findings from the I-series security review (both safe today, neither currently exploitable): - AddBetForm.Notes was unbounded free-text into SQLite; add a 2000-char sanity cap in IsValid (covers both the add and edit paths), alongside the existing stake/rate caps. - EventId only rejected empty/whitespace; now also reject path separators, '..' traversal, control/newline chars and over-length input so no current-or-future consumer that builds a path/filename/log line from an id can be tricked. The charset stays open for forward-compat with non-numeric bookmaker ids.
maraphon-app
Sports betting odds analyzer for marathonbet.by.
Scrapes pre-match (/su) and live (/su/live) sports events, tracks coefficient changes
over time, and detects anomalies — in particular the "odds-flip" pattern where the
bookmaker freezes betting and then inverts underdog/favorite odds.
Tech stack
- .NET 8 + C# 12
- Blazor Hybrid — WPF shell hosting
BlazorWebView(designed to migrate to ASP.NET Core Blazor Server with no UI rewrite) - EF Core + SQLite (WAL mode) for local storage
- ClosedXML for Excel export
- AngleSharp for HTML scraping (with Playwright fallback for JS-rendered pages)
- Polly v8 for retry / circuit breaker / rate limiting
- MudBlazor UI components, Plotly.Blazor for charts
- Serilog structured logging
- xUnit / FluentAssertions / NSubstitute for tests
Project layout
src/
Marathon.Domain/ entities, value objects, no dependencies
Marathon.Application/ use cases, abstractions (IOddsScraper, IRepository, ...)
Marathon.Infrastructure/ EF Core, scraping, Polly, Excel, Playwright
Marathon.UI/ Razor Class Library — all Blazor components live here
Marathon.Hosts.WpfBlazor/ WPF + BlazorWebView host (replaceable for web)
tests/
Marathon.*.Tests/ unit + integration tests per layer
Build & run
dotnet build Marathon.sln
dotnet test Marathon.sln
dotnet run --project src/Marathon.Hosts.WpfBlazor
Configuration
All variable parameters (polling intervals, concurrency, user-agents, retry policy,
snapshot retention, locale) are exposed via appsettings.json and live-editable via
the in-app Settings page.
Status
🟡 In active development. See plans/initial-implementation/PLAN.md
for the current phase plan and progress.
License
Private — customer project.