MCTS 70-515 培训套件,视图状态错误?

发布于 2024-12-07 16:14:24 字数 398 浏览 1 评论 0原文

本书第 123 页 - 第 3 章第 2 课中写道: ” Page.ViewState 属性提供了一个字典对象,用于保留之间的值 对同一页面的多个请求。该对象的类型为 StateBag。当 ASP.NET 处理页面时,页面及其控件的当前状态被散列成字符串,并且 作为名为 __ViewState 的 HTML 隐藏字段保存在页面中。如果数据对于a来说太长 单个字段(在 Page.MaxPageStateFieldLength 属性中指定),ASP.NET 执行 视图状态分块以将其拆分为多个隐藏字段。”

我对 __ViewState 隐藏字段的理解是,它存储与设计时相比发生变化的控件值。更不用说如果 __ViewState 是任意数量的哈希值由于哈希值的大小是固定的,数据永远不会变得太大。

这本书是错误的还是我在这里遗漏了一些东西......

On page 123 of the book - chapter 3, lesson 2. it says:
"
The Page.ViewState property provides a dictionary object for retaining values between
multiple requests for the same page. This object is of the type StateBag. When an ASP.NET
page is processed, the current state of the page and its controls is hashed into a string and
saved in the page as an HTML hidden field called __ViewState. If the data is too long for a
single field (as specified in the Page.MaxPageStateFieldLength property), ASP.NET performs
view state chunking to split it across multiple hidden fields."

my understanding of the __ViewState hidden field is that it stores the values of controls changed when compared to what they were at design time. Not to mention that if __ViewState was a hash of any amount of data it would never get too large since hashes are fixed in size.

Is the book wrong? or am i missing something here...

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(2

妞丶爷亲个 2024-12-14 16:14:24

Viewstate 采用 base-64 编码。

这本书具有误导性,因为散列是单向操作,并且稍后在服务器端对其进行解码几乎是不可能的。

您的理解也是错误的,视图状态不存储与设计时值不同的值。基本上,它是在回发之间持久保存表单数据。请参阅 msdn (http://msdn.microsoft.com/en-us/library/bb386448.aspx) 了解详细信息。

Viewstate is encoded with base-64.

Book is misleading because hashing is one-way operation and it would make pretty impossible to decode it later on the server side.

Your understanding is also wrong, viewstate is not storing values different from design-time values. Basically, it is persisting form data between postbacks. Please refer to msdn (http://msdn.microsoft.com/en-us/library/bb386448.aspx) for detailed info.

感性不性感 2024-12-14 16:14:24

我也在使用同一本书准备这次考试。该特定行似乎与下一篇文章中的信息相似

http://msdn.microsoft.com/en-us/库/ie/75x4ha6s.aspx

处理页面时,页面和控件的当前状态
被散列成字符串并作为隐藏字段保存在页面中,或者
如果 ViewState 中存储的数据量较多,则有多个隐藏字段
属性超出 MaxPageStateFieldLength 中的指定值
财产。当页面回发到服务器时,页面会被解析
页面初始化时的视图状态字符串并恢复属性
页面中的信息。

然而,如果您在 MSDN 的其他地方进行挖掘,就会得到以下准确的解释。

http://msdn.microsoft.com/en-us/库/ie/bb386448.aspx

默认情况下,视图状态数据存储在页面的隐藏字段中
并使用base64编码进行编码。此外,视图的哈希值
状态数据是通过使用机器身份验证从数据创建的
代码 (MAC) 密钥。哈希值被添加到编码的视图状态数据中
结果字符串存储在页面中。当页面为
发回服务器后,ASP.NET 页面框架重新计算
哈希值并将其与视图状态中存储的值进行比较。如果
哈希值不匹配,会引发异常,表明
查看状态数据可能无效。

通过创建哈希值,ASP.NET页面框架可以测试是否
视图状态数据已损坏或被篡改。然而,即使
如果不被篡改,视图状态数据仍然可以被拦截
并被恶意用户读取。

那么,来回答你的问题。

  • 已完成哈希处理,但仅用于有效性目的。该段落肯定具有误导性。
  • 关于__ViewState,Dooh已经提供了上面的链接

I am also studying for this exam using the same book. That particular line seems similar to the information in the following article

http://msdn.microsoft.com/en-us/library/ie/75x4ha6s.aspx

When the page is processed, the current state of the page and controls
is hashed into a string and saved in the page as a hidden field, or
multiple hidden fields if the amount of data stored in the ViewState
property exceeds the specified value in the MaxPageStateFieldLength
property. When the page is posted back to the server, the page parses
the view-state string at page initialization and restores property
information in the page.

However, if you dig elsewhere on MSDN, one gets following explanation which is accurate.

http://msdn.microsoft.com/en-us/library/ie/bb386448.aspx

By default, view state data is stored in the page in a hidden field
and is encoded using base64 encoding. In addition, a hash of the view
state data is created from the data by using a machine authentication
code (MAC) key. The hash value is added to the encoded view state data
and the resulting string is stored in the page. When the page is
posted back to the server, the ASP.NET page framework re-computes the
hash value and compares it with the value stored in view state. If the
hash values do not match, an exception is raised that indicates that
view state data might be invalid.

By creating a hash value, the ASP.NET page framework can test whether
the view state data has been corrupted or tampered with. However, even
if it is not tampered with, view state data can still be intercepted
and read by malicious users.

So, to answer your questions.

  • Hashing is done but for validity purposes only. That paragraph is certainly misleading.
  • Regarding __ViewState, Dooh has provided the link above
~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文