Silverlight中获取文件时间的危险在哪里？
在上传文件之前，我需要在名称中加入一些附加信息，以增加文件名唯一（无状态）的机会。调用 FileInfo.LastWriteTime-get 会抛出 SecurityException ，表示该进程需要提升权限。
我可以在某种程度上看到这些数据中存在有关用户的某些历史信息，但也考虑到无论如何操纵它是多么容易，但为什么呢？是否有其他方法可以获取类似信息而不需要管理员托管的 OOB？
Before uploading a file I need to salt the name with some additional information to increase the chance of the filename being unique (stateless-ly). Invoking FileInfo.LastWriteTime-get throws a SecurityException saying the process needs elevated priviledges.
I can see to some extent that there exists certain historical information about the user in such data, but also considering how easy it is to manipulate anyway, but why? Is there some other way to obtain similar information withouth requiring admin-hosted OOBs?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果有一种方法可以在不提升权限的情况下获取此信息，那么这将是 Silverlight 中的一个漏洞。这些 RIA 平台限制此活动的情况很常见，Flex 也有类似的限制。
如果您只需要一个唯一的文件名，那么您可以使用时间戳+文件名。或
md5(时间戳+随机值)+文件名。If there where a way to obtain this information without elevated privileges then it would be a vulnerability in Silverlight. It is common to see these RIA platforms to restrict this activity, Flex has similar restrictions.
If you just need a unique file name then you can use a timestamp+filename. or
md5(timestamp+random_value)+filename.不，为什么？因为 Silverlight 中的安全方法是使攻击面尽可能小。通过获取
FileInfo真正获得的只是文件内容。为什么应用程序甚至应该了解用户文件系统中内容的名称，这一点可能存在争议。如果您只需要使名称唯一，只需使用 Guid：-
No. Why? Because the approach to security in Silverlight is to keep the attack surface as small as possible. All that is really being granted by gaining a
FileInfois the file content. Why an application should even be privy to the name that content had when in the user's file system could be debated.If you just need to make the name unique just use a Guid:-