我有以下代码并抛出XML注入(请参阅突出显示的文本)。可以让我知道如何删除
private string GetRecordSet(OleDbDataReader oDR)
{
XmlTextWriter xTWriter = null;
StringWriter oSWriter = null;
int iRecCnt=0;
string sName = String.Empty;
string sValue = String.Empty;
try
{
//Create Out XML
oSWriter = new StringWriter();
xTWriter = new XmlTextWriter(oSWriter);
xTWriter.Formatting = Formatting.Indented;
xTWriter.WriteStartElement("SESSION");
while(oDR.Read())
{
iRecCnt++;
sName = oDR.GetValue(0).ToString();
sValue = oDR.GetValue(1).ToString();
**xTWriter.WriteElementString(sName, sValue);**
}
xTWriter.WriteElementString("TotalRecords", iRecCnt.ToString());
xTWriter.WriteEndElement(); //ROWSET END
//Return XML string. If no records found then return empty string
string sRtrn = oSWriter.ToString();
if (iRecCnt == 0) sRtrn = string.Empty;
return sRtrn;
}
答案 0 :(得分:1)
你没有以任何方式消毒输入。它的XML可注入性是因为XML元字符可用于将代码更改为无意的行为。元字符的示例:单引号,双引号,<,> - 任何通过代码的事实上都会导致代码写出无意的xml元素或属性。