如何检查自定义属性

Question

我正在使用中间件使用 HtmlSanitizer 清理 asp.net 端点，如此处所述。 但它不适用于文件上传。 因此，我正在尝试使用一个名为XssSanitizeIgnore的自定义属性，如讨论部分所述。

我在My controller中创建XssSanitizeIgnore属性，如下所示，

namespace CarPortal.ReportingServiceApi.Controllers.APIControllers
{
    [Route("api/[controller]")]
    [ApiController]
    public class AutoReportController : BaseController
    {
        private readonly IAutoReportService _autoReportService;
        public AutoReportController(IAutoReportService autoReportService) : base()
        {
            _autoReportService = autoReportService;
        }

        [HttpPost]
        [XssSanitizeIgnore]
        [Route("ProcessUploadedFile")]
        public async Task<string> ProcessUploadedFile([FromForm] object formData)
        {

            return await _autoReportService.ProcessUploadedFile((IFormFile)formData);
        }

    }
}

[System.AttributeUsage(System.AttributeTargets.All)]
public class XssSanitizeIgnore: Attribute
{
}

但我不确定如何在middleware中使用它

// enable buffering so that the request can be read by the model binders next
            httpContext.Request.EnableBuffering();

            // leaveOpen: true to leave the stream open after disposing, so it can be read by the model binders
            using (var streamReader = new StreamReader(httpContext.Request.Body, Encoding.UTF8, leaveOpen: true))
            {
                var raw = await streamReader.ReadToEndAsync();
                var sanitiser = new HtmlSanitizer();
                var sanitised = sanitiser.Sanitize(raw);

                System.Attribute[] attrs = System.Attribute.GetCustomAttributes(typeof(AutoReportController));
//ignore if XssSanitizeIgnore 
                if (raw != sanitised)
                {
                    throw new BadRequestException("XSS injection detected from middleware.");
                }
            }

            // rewind the stream for the next middleware
            httpContext.Request.Body.Seek(0, SeekOrigin.Begin);
            await _next.Invoke(httpContext);

Answer 1

您可以使用此代码片段来检查此端点是否具有属性。

var endpoint = httpContext.GetEndpoint();
var myCustomAttribute = endpoint?.Metadata?.GetMetadata<MyCustomAttribute>();
if (myCustomAttribute is not null)
{
    // ToDo: do someting
}

如果可能，请多次使用此属性，以便您可以改用它。

var endpoint = httpContext.GetEndpoint();
var myCustomAttributes = endpoint?.Metadata?.GetOrderedMetadata<MyCustomAttribute>();
if (myCustomAttributes != null && myCustomAttributes.Any())
{
    // ToDo: do someting
}