自定义 MVC controller 动作属性来检查和操作动作输入

Question

Good evening

I am trying to refine our controllers validation; some of my fellow developers were forced to use [ValidateInput(false)] on some controllers, but now we need a finer check on the parameters they accept.

What I am trying to achieve is writing a custom validation attribute to use instead of [ValidateInput(false)] to check data in input, and if possible alter it. So a controller like:

[HttpPost]
[ValidateInput(false)]
public JsonResult SetData(long id, string text1, string text2)

should be treated this way

[HttpPost]
[MyCustomAttribute]
public JsonResult SetData(long id, string text1, string text2)

and I need in my attribute code to check all incoming parameters one by one and perform specific checks and possibly transformations based on their type:

MyCustomAttribute(context) {

   //Extract somehow a list of parameters pars from the context

   for (var i in pars) {
      if (pars[i] is string) {
         //Alter strings
         ((string)pars[i]).Replace("a", "x"); //Just an example
      }
      if (pars[i] is long) {
         //Alter numbers
         if ((long)pars[i] < 0) pars[i] = 0; //Just an example
      }
   }
}

The alterations inside the attribute logic needs to be permanent so that controller's logic does not need to care about parameters outside the domain of allowed values. Is this possible? I am sorry for my poor skills in attributes, and if my question should result trivial or absurd.

Answer 1

I managed to solve this problem. It can be created an ActionFilterAttribute where inside the overridden function OnActionExecuting it can be analyzed and altered the member ActionParameters of the ActionExecutingContext passed to the function, as follows:

public class MyAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        //Logic here
        var myField = filterContext.ActionParameters["myField"];
    }
}

ActionExecutingContext.ActionParameters can be cycled to perform type-based check/manupulation in all its members, or punctually in one of them if its name is known.

Thanks for your attention.