【发布时间】：2020-05-18 16:12:46
【问题描述】：
我正在努力解决一些应用程序漏洞。我有一个带有 url http://localhost:12997/Manning_HQ/Edit/1274 的编辑页面，问题是用户能够更改 id 并能够访问不应该访问的其他请求。
我搜索了URLEncoding，但发现它只能确保所有浏览器都能正确传输 URL 字符串中的文本。我的问题是有办法防止这种情况发生吗？
我的编辑功能：
// GET: Manning_HQ/Edit/5
[CustomAuthorize(Roles = AccessRoleHelper.Add_Manning_Plan_HQ)]
public ActionResult Edit(int? id)
{
if (id == null)
{
return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
}
var test1 = (from c in db.TBL_Manning_HQ
join e in db.TBL_User_Dep_Access
on c.Inserted_By equals e.UserID
join t in db.TBL_Department
on c.Department_ID equals t.Department_ID
join p in db.TBL_Location
on c.Location_ID equals p.Location_ID
join n in db.TBL_Titles_HQ
on c.TitleHQ_ID equals n.TitleHQ_ID
where (e.Dep_ID == c.Department_ID)
where c.Manning_HQ_ID == id
select new Manning_HQ_VM
{
Manning_HQ_ID = c.Manning_HQ_ID,
}).ToList();
TBL_Manning_HQ tBL_Manning_HQ = db.TBL_Manning_HQ.Find(id);
int userid = Convert.ToInt32(Request.ServerVariables["LOGON_USER"].ToString().Split('\\')[1].ToString().Remove(0, 2));
if (tBL_Manning_HQ == null)
{
return HttpNotFound();
}
var departments = (from d in db.TBL_Department
join ud in db.TBL_User_Dep_Access
on d.Department_ID equals ud.Dep_ID
join m in db.TBL_Manning_HQ
on d.Department_ID equals m.Department_ID
where ud.UserID == userid && ud.IsActive == true
where m.Manning_HQ_ID == id
select new KeyValuePairsViewModel
{
Id = d.Department_ID,
Value = d.Department_Name
}).ToList();
ViewBag.Department_ID = new SelectList(departments, "Id", "Value");
ViewBag.Location_ID = new SelectList(db.TBL_Location, "Location_ID", "Location_Name", tBL_Manning_HQ.Location_ID);
ViewBag.TitleHQ_ID = new SelectList(db.TBL_Titles_HQ, "TitleHQ_ID", "Title_Name", tBL_Manning_HQ.TitleHQ_ID);
if (test1.Count != 0)
{
return View(tBL_Manning_HQ);
}
else
{
return View();
}
}
[HttpPost]
[CustomAuthorize(Roles = AccessRoleHelper.Add_Manning_Plan_HQ)]
[ValidateAntiForgeryToken]
public ActionResult Edit(TBL_Manning_HQ _HQ)
{
var chk_ID = db.TBL_Manning_HQ.Any(x => x.Manning_HQ_ID == _HQ.Manning_HQ_ID);
var Chk_Dep = db.TBL_Manning_HQ.Where(x=>x.Manning_HQ_ID == _HQ.Manning_HQ_ID).Any(x => x.Department_ID == _HQ.Department_ID);
if (chk_ID && Chk_Dep)
{
_HQ.Update_By = Convert.ToInt32(Request.ServerVariables["LOGON_USER"].ToString().Split('\\')[1].ToString().Remove(0, 2));
_HQ.Update_In = DateTime.Now;
db.SaveChanges();
TempData["success"] = "Data updated successfully !";
}
return RedirectToAction("Index");
}
自定义授权：
public class CustomAuthorize : AuthorizeAttribute
{
Staff_RequisitionEntities_1 db = new Staff_RequisitionEntities_1();
public override void OnAuthorization(AuthorizationContext filterContext)
{
if (filterContext == null)
{
throw new ArgumentNullException("filterContext");
}
if (filterContext.HttpContext.User == null)
{
throw new ArgumentNullException("filterContext.HttpContext.User");
}
string username = filterContext.HttpContext.User.Identity.Name.ClientName();
int xceedId = Convert.ToInt32(username.Substring(2));
var user = db.TBL_UserPermissions.FirstOrDefault(us => us.UserID== xceedId && us.IsActive == true);
{
filterContext.HttpContext.User = new CustomPrincipal((WindowsIdentity)filterContext.HttpContext.User.Identity,user, true , Convert.ToString(xceedId));
base.OnAuthorization(filterContext);
}
}
}
访问角色助手：
public class AccessRoleHelper
{
public const string Manning_Plan = "Add Manning Plan";
public const string View_Manning_Plan = "View Manning Plan";
public const string Add_New_Request = "Add New Request";
public const string View_Requestes = "View Requestes";
public const string Add_Fulfillment_Rate = "Add Fulfillment Rate";
public const string View_Fulfillment_Rate = "View Fulfillment Rate";
public const string Add_Manning_Plan_HQ = "Add Manning Plan HQ";
public const string View_Manning_Plan_HQ = "View Manning Plan HQ";
public const string View_Manning_Plan_HQ_CombCEO = "View Manning Plan HQ Manager";
public const string View_Manning_Plan_CEO = "View Manning Plan CEO";
public const string Add_Issue_staff_requisition = "Add Issue staff requisition";
public const string Training_Action = "Training Action";
public const string Admin = "Admin";
public const string Rec_Action = "Recruitment Actions";
}
自定义主体：
public CustomPrincipal(WindowsIdentity source, TBL_UserPermissions baseUser ,bool inDb, string ID) :
base(source)
{
UserPermission = baseUser;
HttpContext.Current.Session["USERID"] = ID;
}
public override bool IsInRole(string role)
{
bool hasPermission = false;
if (UserPermission != null && (UserPermission.UserID != null))
{
hasPermission = db.TBL_UserPermissions.Any(up => up.TBL_Permissions.PermissionName == role && up.IsActive == true && up.UserID == UserPermission.UserID);
}
return (base.IsInRole(role) || (hasPermission));
}
public TBL_UserPermissions UserPermission { get; protected set; }
【问题讨论】：
-
永远不要相信用户输入，句号！您需要在您的 HttpPost 方法中验证他们是否可以访问服务器端的页面。如果他们无权访问，请将他们重定向到其他页面。
-
你已经有一个动作过滤器；
[CustomAuthorize(Roles = AccessRoleHelper.Add_Manning_Plan_HQ)]。 Mannig_HQ 是属于单个用户还是属于该操作过滤器未处理的单个实体？ -
嗨@JerdineSabio，我猜是个人用户。我将编辑帖子以分享它的代码。
标签： c# entity-framework asp.net-authorization penetration-testing web-application-security