HP Fortify - Mass assignment

问题:

HP fortify scan gives me a message as Mass Assignment: Insecure Binder Configuration ( API Abuse, Structural ) for most of the Action Methods in my controller. Below is the example of the action method.

<HttpPost>
Function Edit(model as GridViewModel)
Dim manager as new Managers
manager.Edit(model.id, model.name, model.desc,model.class)
Return Nothing
End Function

When I tried following method the error was gone.

<HttpPost>
Function Edit(id as integer?,name as string, desc as string, class as string)
Dim manager as new Managers
manager.Edit(id, name, desc,class)
Return Nothing
End Function

But above code seems to be MVC bad practices. Please do suggest a method to overcome this issue.

回答1:

In C#, you can specify which items in the model will be allowed in. For example, your routine would look like this in c#:

[HttpPost]
public ActionResult Edit([Bind(Include = "id,name,desc,class")] GridviewModel model)
{
	Managers manager = new Managers();
	manager.Edit(model.id, model.name, model.desc, model.class);

	return RedirectToAction("Edit", "[Controller]");
}

This should at least give you a jumping point to research the language you are writing in to see if they allow the same action.

In addition to being able to include specific parameters (whitelisting) you can also exclude parameters simply by using [Bind(Exclude = "")]