微信公众号搜"智元新知"关注
微信扫一扫可直接关注哦!

asp.net – 绕过路径遍历过滤器

在我的Web应用程序中,我删除这些字符:

( <,>,:,”,/,\,|,?,* )

从我的文件下载网址,以防止路径遍历.

有没有办法绕过这个?

它安全吗?

解决方法

请查看以下指南: http://msdn.microsoft.com/en-us/library/ff647397.aspx,但问题的相关部分将在下面突出显示.

If you must accept file names as input,use the full name of the file by using System.IO.Path.GetFileName.

如果您想进一步保护您的网站:

Using Code Access Security to Restrict File I/O
An administrator can restrict an application’s file I/O to its own virtual directory hierarchy by configuring the application to run with Medium trust. In this event,.NET code access security ensures that no file access is permitted outside of the application’s virtual directory hierarchy.

You configure an application to run with Medium trust by setting the element in Web.config or Machine.config.
<trust level="Medium" />

版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。

相关推荐