asp.net - 我的事件日志充满了 ViewState 无效和未处理的异常

Question

我的网站上有 HealthMonitoring。我 90% 的页面都是以

格式访问的

http://www.itsmywebsite.com/showproduct.aspx?id=somenumber

我正在检查 WebEvents_events 表，发现我的表主要有两个错误

错误 1

0002609ad8vdf45f8daffc7de8716e32    2013-11-25 17:01:18.153 2013-11-25 11:01:18.153 System.Web.Management.WebViewStateFailureAuditEvent 9877    1455    4009    50204   Viewstate verification failed. Reason: Viewstate was invalid.   C:\HostingSpaces\parthak\itsmywebsite.com\wwwroot\  /   C15472-132183   http://www.itsmywebsite.com/showproduct.aspx    NULL    Event code: 4009
    Event message: Viewstate verification failed. Reason: Viewstate was invalid.
    Event time: 11/25/2013 11:01:18 AM
    Event time (UTC): 11/25/2013 5:01:18 PM
    Event ID: 0002609ad8vdf45f8daffc7de8716e32
    Event sequence: 9877
    Event occurrence: 1455
    Event detail code: 50204

    Application information:
        Application domain: /LM/W3SVC/94/ROOT-1-1302342423433586
        Trust level: Full
        Application Virtual Path: /
        Application Path: C:\HostingSpaces\parthak\itsmywebsite.com\wwwroot\
        Machine name: C15472-132183

    Process information:
        Process ID: 28796
        Process name: w3wp.exe
        Account name: C15472-132183\itsmywebsitecom_web

    Request information:
        Request URL: http://www.itsmywebsite.com/showproduct.aspx
        Request path: /showproduct.aspx
        User host address: 186.xx.xxx.xx
        User: 
        Is authenticated: False
        Authentication Type: 
        Thread account name: C15472-132183\itsmywebsitecom_web

    ViewStateException information:
        Exception message: Invalid viewstate. 
        Client IP: 186.xx.xxx.xx
        Port: 29991
        Referer: 
        Path: /showproduct.aspx
        User-Agent: Mozilla/4.0 (compatible; Synapse)

错误 2

0034c75464ecdd32dee41996bfe 2013-11-24 13:19:52.360 2013-11-24 07:19:52.360 System.Web.Management.WebRequestErrorEvent  8727    1313    3005    0   An unhandled exception has occurred.    C:\HostingSpaces\parthak\itsmywebsite.com\wwwroot\  /   C15472-132183   http://www.itsmywebsite.com/showproduct.aspx?id=-1%27   System.FormatException  Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 11/24/2013 7:19:52 AM
Event time (UTC): 11/24/2013 1:19:52 PM
Event ID: 0034c75464ecdd32dee41996bfe
Event sequence: 8727
Event occurrence: 1313
Event detail code: 0

Application information:
    Application domain: /LM/W3SVC/94/ROOT-1-1302342423433586
    Trust level: Full
    Application Virtual Path: /
    Application Path: C:\HostingSpaces\parthak\itsmywebsite.com\wwwroot\
    Machine name: C15472-132183

Process information:
    Process ID: 14932
    Process name: w3wp.exe
    Account name: C15472-132183\itsmywebsitecom_web

Exception information:
    Exception type: System.FormatException
    Exception message: Input string was not in a correct format.

Request information:
    Request URL: http://www.itsmywebsite.com/showproduct.aspx?id=-1%27
    Request path: /showproduct.aspx
    User host address: 178.xxx.xxx.xxx
    User: 
    Is authenticated: False
    Authentication Type: 
    Thread account name: C15472-132183\itsmywebsitecom_web

Thread information:
    Thread ID: 31
    Thread account name: C15472-132183\itsmywebsitecom_web
    Is impersonating: False
    Stack trace:    at System.Number.StringToNumber(String str, NumberStyles options, NumberBuffer& number, NumberFormatInfo info, Boolean parseDecimal)
   at System.Number.ParseInt32(String s, NumberStyles style, NumberFormatInfo info)
   at System.String.System.IConvertible.ToInt32(IFormatProvider provider)
   at System.Convert.ChangeType(Object value, TypeCode typeCode, IFormatProvider provider)
   at System.Web.UI.WebControls.Parameter.GetValue(Object value, String defaultValue, TypeCode type, Boolean convertEmptyStringToNull, Boolean ignoreNullableTypeChanges)
   at System.Web.UI.WebControls.Parameter.GetValue(Object value, Boolean ignoreNullableTypeChanges)
   at System.Web.UI.WebControls.Parameter.get_ParameterValue()
   at System.Web.UI.WebControls.ParameterCollection.GetValues(HttpContext context, Control control)
   at System.Web.UI.WebControls.ObjectDataSourceView.ExecuteSelect(DataSourceSelectArguments arguments)
   at System.Web.UI.WebControls.BaseDataList.GetData()
   at System.Web.UI.WebControls.DataList.CreateControlHierarchy(Boolean useDataSource)
   at System.Web.UI.WebControls.BaseDataList.OnDataBinding(EventArgs e)
   at System.Web.UI.WebControls.BaseDataList.DataBind()
   at System.Web.UI.WebControls.BaseDataList.EnsureDataBound()
   at System.Web.UI.WebControls.BaseDataList.CreateChildControls()
   at System.Web.UI.Control.EnsureChildControls()
   at System.Web.UI.WebControls.BaseDataList.get_Controls()
   at MB.TheBeerHouse.Helpers.SetInputControlsHighlight(Control container, String className, Boolean onlyTextBoxes)
   at MB.TheBeerHouse.Helpers.SetInputControlsHighlight(Control container, String className, Boolean onlyTextBoxes)
   at MB.TheBeerHouse.Helpers.SetInputControlsHighlight(Control container, String className, Boolean onlyTextBoxes)
   at MB.TheBeerHouse.Helpers.SetInputControlsHighlight(Control container, String className, Boolean onlyTextBoxes)
   at MB.TheBeerHouse.Helpers.SetInputControlsHighlight(Control container, String className, Boolean onlyTextBoxes)
   at MB.TheBeerHouse.UI.BasePage.OnLoad(EventArgs e)
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

请指导我如何防止这些错误的发生。

更新:

最糟糕的部分是附加到 url 的 -1%27。现在我再次检查，它在以下 url 中使用

http://www.itsmywebsite.com/showproduct.aspx?id=-1%27 [invalid]
http://www.itsmywebsite.com/browseproduct.aspx?id=-1%27 [invalid]

等等。这些 url 都不存在，我的健康监控正在记录所有这些错误。我的 table 上现在有大约 10 万个。

有效的 url 是 http://www.itsmywebsite.com/showproduct.aspx?id=127

如果没有办法阻止它们，我可以通过重定向或任何其他最佳实践在我的代码中处理它们，这样它就不会产生错误并填满我的表

Answer 1

您已成为 SQL 注入(inject)攻击的目标，可能是机器人或一些在商店中寻找信用卡的随机黑客。在线商店不断受到攻击，您将遭受您无法想象的更多攻击。

为了防止此类攻击，您可以安装 Web 应用程序防火墙，例如 mod_security(适用于 IIS 和 Apache)。该插件将检查提供的请求，对其进行分析并在将其传递给您的应用程序之前阻止每个攻击意图。

Web 应用程序防火墙只是另一种缓解措施，真正的解决方案是拥有安全代码。在这种特殊情况下，您可以实现堆叠查询、限制权限、验证输入(在这种情况下，您的应用程序应该首先捕获错误并在未接收到整数参数时正确处理它)并正确处理错误(例如显示自定义页面和不是可能暴露内部信息的默认错误)。仅举几例。

如果您需要了解任何特殊信息，请告诉我。