Comments for Josh Bush http://freshbrewedcode.com/joshbush I write code that does stuff. Mon, 23 Apr 2012 16:26:00 +0000 hourly 1 http://wordpress.org/?v=3.2.1 Comment on Mass Assignment Vulnerability in ASP.NET MVC by Ron Krauter http://freshbrewedcode.com/joshbush/2012/03/05/mass-assignment-aspnet-mvc/#comment-61 Ron Krauter Mon, 23 Apr 2012 16:26:00 +0000 http://freshbrewedcode.com/joshbush/?p=187#comment-61 Brad Wilson has mentioned this in a post from two years.  http://bradwilson.typepad.com/blog/2010/01/input-validation-vs-model-validation-in-aspnet-mvc.html  Brad Wilson has mentioned this in a post from two years. 
http://bradwilson.typepad.com/blog/2010/01/input-validation-vs-model-validation-in-aspnet-mvc.html 

]]> Comment on Mass Assignment Vulnerability in ASP.NET MVC by Ron Krauter http://freshbrewedcode.com/joshbush/2012/03/05/mass-assignment-aspnet-mvc/#comment-60 Ron Krauter Mon, 23 Apr 2012 16:26:00 +0000 http://freshbrewedcode.com/joshbush/?p=187#comment-60 http://bradwilson.typepad.com/blog/2010/01/input-validation-vs-model-validation-in-aspnet-mvc.html http://bradwilson.typepad.com/blog/2010/01/input-validation-vs-model-validation-in-aspnet-mvc.html

]]> Comment on Mass Assignment Vulnerability in ASP.NET MVC by The Pull Request » The Pull Request Episode 3 http://freshbrewedcode.com/joshbush/2012/03/05/mass-assignment-aspnet-mvc/#comment-58 The Pull Request » The Pull Request Episode 3 Tue, 13 Mar 2012 01:57:52 +0000 http://freshbrewedcode.com/joshbush/?p=187#comment-58 [...] The group discusses the Mass Assignment Vulnerability and Josh Bush’s blog post [...] [...] The group discusses the Mass Assignment Vulnerability and Josh Bush’s blog post [...]

]]> Comment on Mass Assignment Vulnerability in ASP.NET MVC by Rocky LIU http://freshbrewedcode.com/joshbush/2012/03/05/mass-assignment-aspnet-mvc/#comment-57 Rocky LIU Fri, 09 Mar 2012 05:57:00 +0000 http://freshbrewedcode.com/joshbush/?p=187#comment-57 we should operate view model and data model .but take us lots of work for this convert. we should operate view model and data model .but take us lots of work for this convert.

]]> Comment on Mass Assignment Vulnerability in ASP.NET MVC by About the mass assignment vulnerability in Asp.Net MVC framework « thewayofcode http://freshbrewedcode.com/joshbush/2012/03/05/mass-assignment-aspnet-mvc/#comment-56 About the mass assignment vulnerability in Asp.Net MVC framework « thewayofcode Thu, 08 Mar 2012 10:51:11 +0000 http://freshbrewedcode.com/joshbush/?p=187#comment-56 [...] could actually happen using Asp.Net MVC model binding feature is explained very well in this blog article by Josh Bush, so I won’t repeat [...] [...] could actually happen using Asp.Net MVC model binding feature is explained very well in this blog article by Josh Bush, so I won’t repeat [...]

]]> Comment on Mass Assignment Vulnerability in ASP.NET MVC by Yarx http://freshbrewedcode.com/joshbush/2012/03/05/mass-assignment-aspnet-mvc/#comment-54 Yarx Tue, 06 Mar 2012 16:42:00 +0000 http://freshbrewedcode.com/joshbush/?p=187#comment-54 How do you handle the many mappings you'll need to have in an app that uses Automapper, especially if they are being mapped to complex objects? Do you just define them as you need them or do you have them all defined in a central location How do you handle the many mappings you’ll need to have in an app that uses Automapper, especially if they are being mapped to complex objects? Do you just define them as you need them or do you have them all defined in a central location

]]> Comment on Mass Assignment Vulnerability in ASP.NET MVC by Josh Bush http://freshbrewedcode.com/joshbush/2012/03/05/mass-assignment-aspnet-mvc/#comment-53 Josh Bush Tue, 06 Mar 2012 13:16:00 +0000 http://freshbrewedcode.com/joshbush/?p=187#comment-53 If you are using view specific models, you likely won't need the Bind attribute. By binding only a subset, there should be no issue of overposting. If you are using view specific models, you likely won’t need the Bind attribute. By binding only a subset, there should be no issue of overposting.

]]> Comment on Mass Assignment Vulnerability in ASP.NET MVC by Josh Bush http://freshbrewedcode.com/joshbush/2012/03/05/mass-assignment-aspnet-mvc/#comment-52 Josh Bush Tue, 06 Mar 2012 13:13:00 +0000 http://freshbrewedcode.com/joshbush/?p=187#comment-52 Yep, that's exactly what I'm doing too. I mentioned it towards the end of the article: "The approach I typically take is to model bind to an object with only the properties I’m willing to accept." The point of this article was to just point out the parallels between Rails and ASP.NET MVC with this particular issue. I figure if it can affect a site like github, then it's worth talking about. Yep, that’s exactly what I’m doing too. I mentioned it towards the end of the article: “The approach I typically take is to model bind to an object with only the properties I’m willing to accept.”

The point of this article was to just point out the parallels between Rails and ASP.NET MVC with this particular issue. I figure if it can affect a site like github, then it’s worth talking about.

]]> Comment on Mass Assignment Vulnerability in ASP.NET MVC by Josh Bush http://freshbrewedcode.com/joshbush/2012/03/05/mass-assignment-aspnet-mvc/#comment-51 Josh Bush Tue, 06 Mar 2012 13:10:00 +0000 http://freshbrewedcode.com/joshbush/?p=187#comment-51 Yep, it all boils down to just understanding the data. No framework can do that for us. Yep, it all boils down to just understanding the data. No framework can do that for us.

]]> Comment on Mass Assignment Vulnerability in ASP.NET MVC by Steve Fenton http://freshbrewedcode.com/joshbush/2012/03/05/mass-assignment-aspnet-mvc/#comment-50 Steve Fenton Tue, 06 Mar 2012 12:27:00 +0000 http://freshbrewedcode.com/joshbush/?p=187#comment-50  I agree - with the caveat / reminder that you only put stuff on the ViewModel that you actually need and you also need to think about what happens if you have "Id" on there - what if I change the Id to someone else's Id etc.  I agree – with the caveat / reminder that you only put stuff on the ViewModel that you actually need and you also need to think about what happens if you have “Id” on there – what if I change the Id to someone else’s Id etc.

]]>