asp.net-mvc - 如何在模型绑定(bind)期间检测 ASP.MVC 中的过度发布攻击？

Question

我想确定用户是否正在尝试 overposting attack在 Asp.NET MVC 中。

如何确定是否有人正在向我的 Controller 发送特殊值(例如通过 Fiddler)？

注意下面的“绑定(bind)”属性

[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult Create([Bind(Include = "LastName, FirstMidName, EnrollmentDate")]Student student)
{
    try
    {
        if (ModelState.IsValid)
        {
            db.Students.Add(student);
            db.SaveChanges();
            return RedirectToAction("Index");
        }
    }
    catch (DataException /* dex */)
    {
        //Log the error (uncomment dex variable name and add a line here to write a log.
        ModelState.AddModelError("", "Unable to save changes. Try again, and if the problem persists see your system administrator.");
    }
    return View(student);
}

The Bind attribute is one way to protect against over-posting in create scenarios. For example, suppose the Student entity includes a Secret property that you don't want this web page to set.

   public class Student
   {
      public int ID { get; set; }
      public string LastName { get; set; }
      public string FirstMidName { get; set; }
      public DateTime EnrollmentDate { get; set; }
      public string Secret { get; set; }

      public virtual ICollection<Enrollment> Enrollments { get; set; }
   }

Even if you don't have a Secret field on the web page, a hacker could use a tool such as fiddler, or write some JavaScript, to post a Secret form value. Without the Bind attribute limiting the fields that the model binder uses when it creates a Student instance, the model binder would pick up that Secret form value and use it to create the Student entity instance. Then whatever value the hacker specified for the Secret form field would be updated in your database. The following image shows the fiddler tool adding the Secret field (with the value "OverPost") to the posted form values.

Answer 1

如果您使用 View 模型，那么过度发布对您来说不是任何问题，也不是您应该担心的事情。这样做的原因是您将只包含应该来自 View 模型中的用户输入的属性。然后，您将从数据库中获取实际实体并合并两者。这样，实体的所有 sensible 属性都将保持不变。所以作为一个经验法则:始终在 ASP.NET MVC 应用程序中使用 View 模型 - 所有应该修改服务器上某些状态的 POST Controller 操作都应该采用 View 模型，而不是实体模型。

因此，与其试图确定是否有人试图过度发布一些他不应该修改的值，您可以简单地通过允许他只修改他应该修改的值来禁止这种情况 - 通过在 View 中公开它们型号。