Warning: file_get_contents(/data/phpspider/zhask/data//catemap/2/csharp/321.json): failed to open stream: No such file or directory in /data/phpspider/zhask/libs/function.php on line 167

Warning: Invalid argument supplied for foreach() in /data/phpspider/zhask/libs/tag.function.php on line 1116

Notice: Undefined index: in /data/phpspider/zhask/libs/function.php on line 180

Warning: array_chunk() expects parameter 1 to be array, null given in /data/phpspider/zhask/libs/function.php on line 181

Warning: file_get_contents(/data/phpspider/zhask/data//catemap/1/asp.net/30.json): failed to open stream: No such file or directory in /data/phpspider/zhask/libs/function.php on line 167

Warning: Invalid argument supplied for foreach() in /data/phpspider/zhask/libs/tag.function.php on line 1116

Notice: Undefined index: in /data/phpspider/zhask/libs/function.php on line 180

Warning: array_chunk() expects parameter 1 to be array, null given in /data/phpspider/zhask/libs/function.php on line 181
C# 有没有办法通过编程更改webmethod参数?_C#_Asp.net_Sql Injection_Sqlparameter - Fatal编程技术网

C# 有没有办法通过编程更改webmethod参数?

C# 有没有办法通过编程更改webmethod参数?,c#,asp.net,sql-injection,sqlparameter,C#,Asp.net,Sql Injection,Sqlparameter,需要在执行asp.net web服务web方法输入之前对其进行操作 例如: 我有一个名为web1(stringinp1)的web方法。现在,我正在调用这个web方法,输入的inp1值为“Jagan drop table”,但我需要将inp1值更改为“Jagan”,然后将其传递给相应的web方法 我不想在每个web方法中都替换它,而是在公共位置(如公共函数或类)。您想处理吗?在构建查询时只需使用sql参数即可避免这种情况 我不认为这是在没有通知的情况下从传入参数中删除某些内容的好方法。最好检查sq

需要在执行asp.net web服务web方法输入之前对其进行操作

例如:

我有一个名为
web1(stringinp1)
的web方法。现在,我正在调用这个web方法,输入的
inp1
值为“Jagan drop table”,但我需要将
inp1
值更改为“Jagan”,然后将其传递给相应的web方法

我不想在每个web方法中都替换它,而是在公共位置(如公共函数或类)。

您想处理吗?在构建查询时只需使用sql参数即可避免这种情况

我不认为这是在没有通知的情况下从传入参数中删除某些内容的好方法。最好检查sql注入并在发现错误时引发错误

如果您正在寻找检查所有传入参数的方法,则可以使用ASP.NET中间件。 像

您可以使用Microsoft.AspNetCore.Builder.UseMidlewareExtensions对控制器中的每个方法执行这个
SampleMiddleware.InvokeAsync

public class Startup
{
public void Configure(IApplicationBuilder app)
{
app.UseMiddleware<SampleMiddleware>();
}
}
公共类启动
{
公共void配置(IApplicationBuilder应用程序)
{
app.UseMiddleware();
}
}

实现需求的一种方法是使用Soap扩展-

我采取了以下网站的代码,并试图解释同样的相应-

  • 创建Soap扩展类
  • 整个处理过程发生在processmessage调用中。如果您看到在序列化之前调用的“updateMessage”方法,该方法将使用输入节点“inp1”解析和提取XML,并根据您的要求使用拆分运算符替换该值。如果需要,您可以进一步更改
  • ParameterValueChangedSoapExtensionAttribute”类,该类将帮助指定Soap扩展类
  • 所有其他方法都是帮助器类来实现需求
  • 有关SOAP扩展的更多信息,请浏览以下链接-


    @SushantYelpale OP在问号中提到了
    asmx
    。我删除了web api标签,我建议您在这种情况下使用参数,坦率地说,编写一个用于数据处理的通用类是必须的-您应该已经知道如何做到这一点。记住,
    async
    将取决于所使用的.NET Framework版本和编程方法(经典的ASP.NET、MVC、Razor页面)。我不会做太花哨的东西,在这里,只要坚持基本的东西。此外,跨多个函数的使用不依赖于异步执行;仅仅拥有一个可访问的类就足够了。在某些情况下,甚至可以使用静态类函数。不过,请继续使用SQL参数。
    public class Startup
    {
    public void Configure(IApplicationBuilder app)
    {
    app.UseMiddleware<SampleMiddleware>();
    }
    }
    
    public class ParameterValueChangedSoapExtension : SoapExtension
    {
        private Stream streamChainedAfterUs = null;
        private Stream streamChainedBeforeUs = null;
    
        private const int STREAMBUFFERSIZE = 65535;
    
        private ParameterValueChangedSoapExtensionAttribute ParameterValueChangedSoapExtensionAttribute = null;
    
        public override Stream ChainStream(Stream stream)
        {
            if (stream == null)
            {
                throw new ArgumentNullException("stream");
            }
            Stream ret = null;
            this.streamChainedBeforeUs = stream;
            this.streamChainedAfterUs = new MemoryStream();
            ret = this.streamChainedAfterUs;
            return ret;
        }
    
        public override object GetInitializer(Type serviceType)
        {
            throw new NotSupportedException();
        }
    
        public override object GetInitializer(LogicalMethodInfo methodInfo, SoapExtensionAttribute attribute)
        {
            if (attribute == null)
            {
                throw new ArgumentNullException("attribute");
            }
            object ret = attribute;
            return ret;
        }
    
        public override void Initialize(object initializer)
        {
            if (initializer == null)
            {
                throw new ArgumentNullException("initializer");
            }
            ParameterValueChangedSoapExtensionAttribute = initializer as ParameterValueChangedSoapExtensionAttribute;
            if (ParameterValueChangedSoapExtensionAttribute == null)
            {
                throw new InvalidOperationException(String.Format("initializer must be of type {0}, but its a {1}!", typeof(ParameterValueChangedSoapExtensionAttribute), initializer.GetType()));
            }
        }
    
        public override void ProcessMessage(SoapMessage message)
        {
            if (message == null)
            {
                throw new ArgumentNullException("message");
            }
            switch(message.Stage)
            {
                case SoapMessageStage.BeforeSerialize:
                    break;
                case SoapMessageStage.AfterSerialize:
                    streamChainedAfterUs.Position = 0;
                    Copy(streamChainedAfterUs, streamChainedBeforeUs);
                    break;
                case SoapMessageStage.BeforeDeserialize:
                    UpdateMessage(message);
                    streamChainedAfterUs.Position = 0;
                    break;
                case SoapMessageStage.AfterDeserialize:
                    break;
                default:
                    throw new NotImplementedException(message.Stage.ToString());
            }
        }
    
        private void UpdateMessage(SoapMessage message)
        {
            var soapMsgAsString = ReadOriginalSoapMessage();
            var soapMsgRootNode = XElement.Parse(soapMsgAsString);
            var callDescriptorNode = FindCallDescriptorNode(soapMsgRootNode, message.MethodInfo.Name);
            var ns = callDescriptorNode.Name.Namespace;
            var originalNameWeLookFor = ns + ParameterValueChangedSoapExtensionAttribute.OriginalParameterName;
            var nodeWithOriginalName = callDescriptorNode.Elements().FirstOrDefault(i => i.Name == originalNameWeLookFor);
            if (nodeWithOriginalName != null)
            {
                //Here implement according to your need!
                nodeWithOriginalName.Value = nodeWithOriginalName.split(' ')[0];
                var nodeWithCurrentName = new XElement(ns + ParameterValueChangedSoapExtensionAttribute.CurrentParameterName, nodeWithOriginalName.Value);
                nodeWithOriginalName.AddAfterSelf(nodeWithCurrentName);
                nodeWithOriginalName.Remove();
            }
            WriteResultSoapMessage(soapMsgRootNode.ToString());
        }
    
        private XElement FindCallDescriptorNode(XElement soapMsgRootNode, string methodName)
        {
            XElement ret = null;
            var soapBodyName = soapMsgRootNode.Name.Namespace + "Body";
            var soapBodyNode = soapMsgRootNode.Elements().First(i => i.Name == soapBodyName);
            ret = soapBodyNode.Elements().First(i => i.Name.LocalName == methodName);
            return ret;
        }
    
        private void WriteResultSoapMessage(string msg)
        {
            streamChainedAfterUs.Position = 0;
            using (var sw = new StreamWriter(streamChainedAfterUs, Encoding.UTF8, STREAMBUFFERSIZE, true))
            {
                sw.Write(msg);
            }
        }
    
        private string ReadOriginalSoapMessage()
        {
            string ret = null;
            using (var sr = new StreamReader(streamChainedBeforeUs, Encoding.UTF8, false, STREAMBUFFERSIZE, true))
            {
                ret = sr.ReadToEnd();
            }
            return ret;
        }
    
        private void Copy(Stream from, Stream to)
        {
            using (var sr = new StreamReader(from, Encoding.UTF8, false, STREAMBUFFERSIZE, true))
            {
                using (var sw = new StreamWriter(to, Encoding.UTF8, STREAMBUFFERSIZE, true))
                {
                    var content = sr.ReadToEnd();
                    sw.Write(content);
                }
            }
        }
    }
    
    
    [AttributeUsage(AttributeTargets.Method, AllowMultiple=true)]
    public class ParameterValueChangedSoapExtensionAttribute : SoapExtensionAttribute
    {
        public override Type ExtensionType
        {
            get { return typeof(ParameterNameChangedSoapExtension); }
        }
    
        public override int Priority { get; set; }
        public string CurrentParameterName { get; private set; }
        public string OriginalParameterName { get; private set; }
    
        public ParameterValueChangedSoapExtensionAttribute()
        {
            this.CurrentParameterName = "inp1";
            this.OriginalParameterName = "inp1";
        }
    }