是什么阻止用户向 ASP.NET 页面客户端添加控件？
这又回到了我的另一个问题，我认为这个问题已经得到了充分的回答，但经过反思，我不确定是否是这样（抱歉）。
背景资料：
我正在动态生成一个表单。我正在从数据库中提取控件。
我必须将每个控件与一个数据库 ID 相关联，该数据库 ID 不是用户的会话 ID。目前，我通过将我的 ID 与其他一些内容存储在 Web 控件的 ID 中来做到这一点，以使其唯一/清楚我在做什么。
在回发时，我遍历网页上的所有控件，检查我的特殊标识符，即 MyGeneeratedTextBox_ID_Unique。此过程需要执行 2 个重要步骤，即识别该控件是我生成的，并获取此输入字段的 ID。
而且，所有这些都有效，但我仍然担心它的安全性。在这种情况下，我没有看到显示实际数据库 ID 的安全问题，尽管我同意这并不可取。但是，我担心以下可能性：
如果用户可以向我的集合添加恶意控件并将其用于 SQL 注入攻击。
更学术，但如果用户可以通过更改 id 以某种方式存储他们无权访问的字段的数据。
更学术，但如果用户可以以某种
我同意这是一种“黑客”方法。但我的问题是，这是否存在安全风险，是否有一种“简单”的方法以更少的黑客方式做到这一点？
我假设只有在页面上创建/实例化的控件才会添加到控件列表中。因此，所有控件都必须在服务器端创建，因此安全问题已得到解决，但只是想验证。再次感谢。
附： 我可以看到为每个控件添加一个属性并加密视图状态会更安全一些。
This goes back to my other question which I thought was sufficiently answers but upon reflect am not sure that it was (sorry).
Backgrounder:
I am generating a form dynamically. I am pulling from the database the controls.
I must associate each control with a database ID which is not the user's session id. I do this currently by storing my ID in the ID for the web control with some other stuff to make it unique/clear what I am doing.
On the post back, I iterate through all the controls on my web page checking for my special identifier, ie, MyGeneratedTextBox_ID_Unique. This process enables for 2 important steps, identifying the control was one I generated and also getting the ID for this input field.
And, all of this works but I'm still concerned about the security of it. I do not see a security issue with showing the actual database ID's in this case, although agree it is not desirable. However, I am concerned of the following possibilities:
If a user could add a nefarious control to my collection and use that for a SQL injection attack.
More academic, but if a user could somehow store data for fields they do not have access too by changing the id's.
I agree this is a "hack" of a way to do it. But my question is, is it a security risk and is there an 'easy' way to do it in a less hack way?
I assume that only the controls that are created/instantiated on the page are added to the controls list.. thus all controls must be created server side and thus the security issue is address but just wanted to validate. Thanks again.
PS:
I could see adding a property for each control and encrypting the viewstate would be a little more secure.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
在 ASP.NET 2.0 安全性的原始指南中，他们特别指出您应该对从浏览器发回的每个输入执行输入验证。实际上没有什么可以阻止某人将不同的数据发回您的服务器端代码。 ASP.NET 中内置了一些最小的请求验证，但他们特别声明不要依赖于此。
您应该始终验证从控件发回的每个单独输入，以确保数据完整性。应通过删除可能指示攻击向量的不必要的特殊字符和模式来清理所有输入，以防止 SQL 注入攻击。如果您所依赖的只是来自控件的标识符来表明数据良好，那么您的验证逻辑中就有一个巨大的漏洞。
您应该对每个输入执行服务器端验证，以验证输入的格式是否良好以及其中不包含有问题的数据。
http://msdn.microsoft.com/en-us/library/ms998258。 ASPX
In the original guidelines for ASP.NET 2.0 security they specifically state that you should perform input validation on every input being posted back from the browser. There is really nothing that prevents someone from posting back different data to your server side code. There is some minimal request validation built into ASP.NET, but they specifically state not to rely on that.
You should always validate each individual input that is being posted back from your controls for data integrity. All inputs should be sanitized for SQL injection attacks by removing unnecessary special characters and patterns that might indicate an attack vector. If all you are relying on is an identifier from the control to say that the data is good then you have a huge hole in your validation logic.
You should perform server side validation on each input that validates the format of the input is good as well as that it has no problematic data contained in it.
http://msdn.microsoft.com/en-us/library/ms998258.aspx
您使用
runat="server"在服务器上“实时”创建的控件。您不需要在控件集合中检查您的特殊 ID。正如 Harv 所说，您确实需要验证控件的所有输入。没有人可以将服务器控件添加到您的页面，除非您的 Web 服务器受到威胁。
The controls you create "live" on the server with
runat="server". You don't need to check for your special ID in the controls collection. As Harv said, you do need to validate all of the input from your controls.No one can add server controls to your pages unless perhaps your web server was compromised.
我觉得你自己的回答并没有错。但我觉得你仍然把事情搞混了（控件的创建/实例化/定义与恢复 ViewState/状态管理）。
也许以下两条信息有助于澄清一些问题：
我非常热烈向所有使用 ASP.NET（以及 ViewState）的人推荐第二篇文章。
I think what you answered yourself is not wrong. But I feel like you are still mixing things up a bit (creation/instantiation/definition of controls vs. restoring ViewState/state management).
Maybe the following two pieces of information help clear things up a bit:
I very warmly recommend the second article to anyone using ASP.NET (and thus ViewState).
我将尝试回答我的问题，因为我认为这是唯一的方法：
创建服务器端控件的唯一方法是在服务器上，因此您可以相信它们也将具有您设置的 id。这是必须在每个页面实例化上创建控件的原因之一。您可能不信任任何表单提交的数据，但控件和 ID 是在服务器端生成的，因此是安全的。同样，不可能编辑 HTML 来生成服务器端控件。
因此我的方法虽然不优雅，但还是相对安全的。唯一的安全缺陷是身份泄露。
I am going to try to answer my question because I think this is the only way it could be:
The only way server side controls get created is on the server thus you can trust that they will have the id that you set them too. This is one reason the controls must be created on every page instantiation. You may not trust any form submitted data but controls and there IDs are generate server side and thus safe. Likewise, it is not possible to edit the HTML to ever generate a server side control.
Thus my method is relatively secure even if it is not elegant. The only security flaw is the id revealed.