blocks|key|361914|text|你的担心是对的。这称为批量分配。您可以通过使用BindAttribute标记类并设置Exclude+/+Include属性来保护您的代码。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|361915|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/system.web.mvc.bindattribute.aspx|1|http://msdn.microsoft.com/en-us/library/system.web.mvc.bindattribute.exclude.aspx|2|http://msdn.microsoft.com/en-us/library/system.web.mvc.bindattribute.include.aspx^0|N|D|0|16|7|1|1G|7|2|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@$A|Q|B|R|1|S]|$A|T|B|U|1|V]|$A|W|B|X|1|Y]]|C|$]]|$1|D|3|-4|5|6|7|Z|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]|L|$5|G|H|I|C|$J|M]]|N|$5|G|H|I|C|$J|O]]]]

Your fears are right. This is called mass assignment. You can protect your code by marking your class with <a href="http://msdn.microsoft.com/en-us/library/system.web.mvc.bindattribute.aspx" rel="noreferrer">BindAttribute</a> and setting <a href="http://msdn.microsoft.com/en-us/library/system.web.mvc.bindattribute.exclude.aspx" rel="noreferrer">Exclude</a> / <a href="http://msdn.microsoft.com/en-us/library/system.web.mvc.bindattribute.include.aspx" rel="noreferrer">Include</a> properties.

blocks|key|1663382|text|有一些UpdateModel重载需要更新命名属性的字符串数组。这些重载将仅更新命名属性。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1663383|可能还有其他更简单/更具声明性的方法来实现这一点，我不是MVC数据绑定方面的专家。|1663384|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/dd505127.aspx^0|3|B|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

There are overloads of <a href="http://msdn.microsoft.com/en-us/library/dd505127.aspx" rel="nofollow noreferrer">UpdateModel</a> that take an array of strings naming properties to update. These overloads will only update the named properties.

There may be other easier / more declarative ways to accomplish this, I'm not an expert on MVC data binding.

blocks|key|191799|text|您可以使用其他UpdateModel重载之一，在模型上标记应该通过更新或传递包含/排除字段列表而忽略的字段。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|191800|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/dd470185.aspx^0|7|B|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

You can mark fields on your model that should be ignored by update or pass a list of included/excluded fields using one of the other <a href="http://msdn.microsoft.com/en-us/library/dd470185.aspx" rel="nofollow noreferrer">UpdateModel</a> overloads.

blocks|key|1597974|text|你错过了“模型绑定安全性”这一节。您应该始终包含可由任何用户输入方法更新的属性的白名单。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1597975|例如，从NerdDinner：|1597976|[AcceptVerbs(HttpVerbs.Post)]
public+ActionResult+Create(+[Bind(Include="Title,+Address")]+Dinner+dinner)
{

}|code-block|syntax|javascript|1597977|或者，如果您正在调用UpdateModel，您可以创建一个允许属性的字符串数组，然后执行|1597978|UpdateModel(myObject,+allowedProperties);|1597979|您可以锁定类本身，以便只有某些属性也是可更新的。|1597980|[Bind(Include="MyProp1,MyProp2,MyProp3")]
public+partial+class+MyEntity+{+}|1597981|entityMap^0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|T|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|V|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|W|8|@]|9|@]|A|$G|H]]|$1|M|3|N|5|6|7|X|8|@]|9|@]|A|$]]|$1|O|3|P|5|F|7|Y|8|@]|9|@]|A|$G|H]]|$1|Q|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|R|$]]

You're missing the section on "Model Binding Security". You should always include a whitelist of properties that can be updated by any of your user input methods.

For example, from NerdDinner:

<pre><code>[AcceptVerbs(HttpVerbs.Post)]
public ActionResult Create( [Bind(Include="Title, Address")] Dinner dinner)
{

}
</code></pre>

or if you're calling UpdateModel, you can create a string array of allowed properties, and do

<pre><code>UpdateModel(myObject, allowedProperties);
</code></pre>

You can lock down the classes themselves so that only certain properties are updateable as well.

<pre><code>[Bind(Include="MyProp1,MyProp2,MyProp3")]
public partial class MyEntity { }
</code></pre>

blocks|key|191944|text|有进取心/怀有恶意的人完全有可能将这些字段映射到您的模型上的任何属性。有几种方法可以解决这个问题|type|unstyled|depth|inlineStyleRanges|entityRanges|data|191945|最简单的方法是使用前面提到的UpdateModel的排除/包含属性重载。这样做的缺点是该方法只接受字符串数组，这有时意味着如果您进行任何重命名，您的代码可能会失去同步。|191946|另一种方法是使用包含绑定字段的简单DTO，然后您可以使用DTO并对事件对象执行您想要的操作，这显然添加了另一个类，并且更加手动，但给您提供了更多的控制|191947|public+ActionResult(int+id,+EditForm+form)+{
++++MyEvent+event+=+_eventRepository.GetMyEvent(id);
++++event.Name+=+form.Name;+//etc;
++++if+(User.IsInRole("Organiser"))+{
++++++++event.Date+=+form.Date;
++++}
++++return+...
}|code-block|syntax|javascript|191948|另一种方法是通过MyEvent类的客户模型绑定器，它只绑定您想要的字段，但可能会过度杀伤力。|191949|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|Q|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|R|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|S|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

It's perfectly possible for someone enterprising / malicious to map the fields to any of the properties on your model. There are a few ways around this

The most simple is to use the exclude / include properties overloads of UpdateModel as has been mentioned before. The downside of this is that the method only accepts a string array which can sometimes mean your code gets out of sync if you do any renaming.

Another way is to use a simple DTO which holds the bound fields, you can then take the DTO and do what you want with your event object, this obviously adds another class and is much more manual but gives you a lot more control

<pre><code>public ActionResult(int id, EditForm form) {
 MyEvent event = _eventRepository.GetMyEvent(id);
 event.Name = form.Name; //etc;
 if (User.IsInRole("Organiser")) {
 event.Date = form.Date;
 }
 return ...
}
</code></pre>

Another way could be via a customer model binder for your MyEvent class which only binds your desired field, probably overkill though.

I have an ASP.NET MVC application that is calendar-like. As per the NerdDinner example, I'm updating the results of my edit page using UpdateMethod()

In my app, certain events are fully customizable and certain ones are only partially customizable. Even though the edit form for editing the partially customizable events only have those fields available, obviously someone could create their own form with the missing data and post to my site. If they do so, what's to keep someone from changing any/all fields? Worse, what if they tried to change the id (primary key)?

It feels like UpdateModel() is vulnerable to very basic hacking. Are my fears legitimate or is there something I'm missing?

<pre><code>// POST: /MyEvents/Edit/2
[AcceptVerbs(HttpVerbs.Post), Authorize]
public ActionResult Edit(int id, FormCollection formValues)
{
 MyEvent myevent = eventRepository.GetMyEvent(id);

 try
 {
 UpdateModel(myevent);
 eventRepository.Save();
 return RedirectToAction("Details", new { id = myevent.MyEventId });
 }
 catch
 {
 ModelState.AddRuleViolations(myevent.GetRuleViolations());
 return View(new MyEventFormViewModel(myevent));
 }
}
</code></pre>

ASP.NET MVC UpdateModel vulnerable to hacking?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我有一个类似日历的ASP.NET MVC应用程序。根据NerdDinner示例，我使用UpdateMethod()更新编辑页面的结果。在我的应用程序中，某些事件是完全可定制的，而某些事件只能部分定制。尽管用于编辑部分可定制事件的编辑表单只有这些字段可用，但显然有人可以使用缺失的数据创建自己的表单并发布到我的网站。如果他...

问ASP.NET MVC UpdateModel易受黑客攻击？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问ASP.NET MVC UpdateModel易受黑客攻击？EN