MS Chart ChartImageHandler 存储选项
我读过一些关于 ChartImageHandler storage 选项的文章，它似乎有 3 个选项，我对此有疑问；
如果我们选择
文件选项，那么由ms图表创建的图像首先存储在我们指定的位置。我想知道如果我们在C:\TempImageFiles地址中指定了默认位置，是否有安全考虑？我的意思是 MS Chart 在哪个windows 用户下访问此文件夹并在其上写入图像？这有黑客风险吗？如果我们选择
内存图像存储在主内存中，然后如果我们在下载到客户端后指定选项deleteAfterServicing=true则将其删除。我想知道如果我们为图表选择ImageStorageMode="UseHttpHandler"选项，黑客是否可以使用Chart.axd并多次调用它并导致内存溢出？ MS Chart 如何防止这种情况发生？如果我们选择
session将图像存储在会话中，我想知道任何黑客都可以使用Chart.axd，多次调用它导致内存溢出？如果创建镜像过程中出现异常，是否会删除会话？下载到客户端后，是否也会删除会话？
I've read some articles about ChartImageHandler storage options, and it seems to have 3 options which I have questions about;
If we choose
fileoptions then image created by ms chart first stores in location we specified. I want to know if we specified the default location inC:\TempImageFilesaddress, does it have security considerations? I mean MS Chart under whichwindows useraccess this folder and write image on it? Has this a hack risk?If we choose
memoryImage stored in main memory, and then if we specify the optiondeleteAfterServicing=trueafter downloading to client it deleted. I want to know if we chooseImageStorageMode="UseHttpHandler"option for chart, can any hacker useChart.axdand call it multiple times and cause memory overflow? What does MS Chart do to prevent this?If we choose
sessionImage stored in a session, and again I want to know any hacker can useChart.axd, calling it multiple times to cause a memory overflow? If any exception during creating image, does it delete the session? After downloading to client, does it also delete the session?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
有权访问该计算机的其他 Windows 用户将可以在文件系统上创建文件。这些文件将由 ASP 用户创建，因此您可以将文件夹访问权限限制为仅该用户，从而阻止其他普通级别用户的可见性 - 尽管系统管理员很可能拥有完全访问权限。
在 Web 服务器的内存中创建图像会触发内存溢出，从而使服务器容易受到攻击，这并不比 IIS 的任何其他内存消耗部分更不安全。例如，如果恶意用户在您的网络服务器上创建了许多匿名会话，他们可能会触发相同的内存状态。因此我想说，使用方法 2 和 3 的安全风险非常低。
Creating files on the file system will be available to other windows users with access to the machine. The files will be created by the ASP user, and as such you could restrict the folder access to just this user therefore preventing visibility to other normal level users - though system administrators will most likely have full access.
Creating the images in memory of the webserver triggering a memory overflow and therefore leaving your server vulnerable is no more insecure than any other memory consuming part of IIS. For example, if a malicious user created many many anonymous sessions on your webserver they could trigger the same memory state. Therefore I'd state that you are at very low security risk using methods 2 and 3.