Question

例如，如果您有CSP之类的话 default-src 'self'; report-uri /CspViolationReport 如果ASP.Net处理/CspViolationReport，您如何访问已发布的CSP违规报告？

我们希望找到一些JSON，例如http://www.w3.org/TR/CSP11/#example-violation-report

当您检查Request.Form时，没有密钥，Request.ServerVariables["ALL_RAW"]中没有任何证据，但Request.ServerVariables["HTTP_METHOD"]是“POST”。

用Fiddler拦截POST，你可以看到JSON肯定是被发布的，但是.Net似乎没有让你看到它。

Answer 1

这是一种灵感来自http://muaz-khan.blogspot.co.nz/2012/06/exploring-csp-content-security-policy.html的方式，谢谢！

void ProcessCspValidationReport() {
    Request.InputStream.Position = 0;
    using (StreamReader inputStream = new StreamReader(Request.InputStream))
    {
        string s = inputStream.ReadToEnd();
        if (!string.IsNullOrWhiteSpace(s))
        {
            CspPost cspPost = JsonConvert.DeserializeObject<CspPost>(s);
            //now you can access properties of cspPost.CspReport
        }
    }
}

class CspPost
{
    [JsonProperty("csp-report")]
    public CspReport CspReport { get; set; }
}

class CspReport
{
    [JsonProperty("document-uri")]
    public string DocumentUri { get; set; }

    [JsonProperty("referrer")]
    public string Referrer { get; set; }

    [JsonProperty("effective-directive")]
    public string EffectiveDirective { get; set; }

    [JsonProperty("violated-directive")]
    public string ViolatedDirective { get; set; }

    [JsonProperty("original-policy")]
    public string OriginalPolicy { get; set; }

    [JsonProperty("blocked-uri")]
    public string BlockedUri { get; set; }

    [JsonProperty("source-file")]
    public string SourceFile { get; set; }

    [JsonProperty("line-number")]
    public int LineNumber { get; set; }

    [JsonProperty("column-number")]
    public int ColumnNumber { get; set; }

    [JsonProperty("status-code")]
    public string StatusCode { get; set; }
}

Answer 2

问题可能出在请求的内容类型上：application / csp-report。我刚刚添加到WebApiConfig：

config.Formatters.JsonFormatter.SupportedMediaTypes.Add(
new System.Net.Http.Headers.MediaTypeHeaderValue("application/csp-report"));

当然，您还需要其他答案形式的句号：CspReportContainer，CspReport

Answer 3

使用DataContractJsonSerializer的{{1}}位于名称空间System.Runtime.Serialization和System.Runtime.Serialization.Json之内，其他库不需要，它们都在.NET Framework中。

控制器：

public class ReportingController : Controller
{

    [HttpPost]
    public void CspReport()
    {
        var context = System.Web.HttpContext.Current;

        context.Response.ContentType = "application/json";
        context.Response.ContentEncoding = Encoding.UTF8;

        using (IO.Stream body = context.Request.InputStream) {
            var ser = new DataContractJsonSerializer(typeof(CspReportContainer));
            var report = (CspReportContainer)ser.ReadObject(body);
            ReportingControllerHelper.LogCspReport(report.Report);
        }
    }
}

型号：

[DataContract()]
public class CspReportContainer
{
    [DataMember(Name = "csp-report")]
    public CspReport Report { get; set; }
}
[DataContract()]
public class CspReport
{
    [DataMember(Name = "blocked-uri")]
    public string BlockedUri { get; set; }
    [DataMember(Name = "column-number")]
    public int? ColumnNumber { get; set; }
    [DataMember(Name = "document-uri")]
    public string DocumentUri { get; set; }
    [DataMember(Name = "effective-directive")]
    public string EffectiveDirective { get; set; }
    [DataMember(Name = "line-number")]
    public int? LineNumber { get; set; }
    [DataMember(Name = "original-policy")]
    public string OriginalPolicy { get; set; }
    [DataMember(Name = "referrer")]
    public string Referrer { get; set; }
    [DataMember(Name = "source-file")]
    public string SourceFile { get; set; }
    [DataMember(Name = "status-code")]
    public int? StatusCode { get; set; }
    [DataMember(Name = "violated-directive")]
    public string ViolatedDirective { get; set; }
}

访问发布到ASP.Net的内容安全策略违规报告

3 个答案: