C# 代码审计 - 漏洞Sink点

// 模式1：直接拼接
string username = Request.QueryString["username"];
string sql = "SELECT * FROM Users WHERE Name = '" + username + "'";
var cmd = new SqlCommand(sql, connection);
var result = cmd.ExecuteReader();

// 模式2：EF Core FromSqlRaw使用字符串插值
string filter = Request.QueryString["filter"];
var users = context.Users
    .FromSqlRaw($"SELECT * FROM Users WHERE Name = {filter}")
    .ToList();

// 模式3：ORM框架拼接SQL
var users = db.Queryable<User>()
    .Select(x => SqlFunc.MappingColumn("SELECT * FROM Users WHERE Name = '" + userInput + "'"))
    .ToList();

// 方案1：参数化查询
string username = Request.QueryString["username"];
string sql = "SELECT * FROM Users WHERE Name = @username";
using (SqlCommand cmd = new SqlCommand(sql, connection))
{
    cmd.Parameters.AddWithValue("@username", username);
    var reader = cmd.ExecuteReader();
}

// 方案2：EF Core参数化
var username = Request.QueryString["username"];
var users = await context.Users
    .FromSql($"SELECT * FROM Users WHERE Name = {username}")
    .ToListAsync();

// 方案3：LINQ避免手写SQL
var username = Request.QueryString["username"];
var users = context.Users
    .Where(u => u.Name == username)
    .ToList();

// 方案4：ORDER BY白名单
string orderBy = Request.QueryString["orderBy"] ?? "id";
var allowedFields = new[] { "id", "name", "email", "createdAt" };
if (!allowedFields.Contains(orderBy))
    throw new ArgumentException("Invalid field");
var sql = "SELECT * FROM Users ORDER BY " + orderBy;

// 模式1：用户输入作为命令
string cmd = Request.QueryString["cmd"];
Process.Start(cmd);

// 模式2：通过shell执行
string hostname = Request.QueryString["hostname"];
Process.Start("cmd.exe", "/c ipconfig " + hostname);

// 模式3：ProcessStartInfo配置不当
var psi = new ProcessStartInfo
{
    FileName = "powershell.exe",
    Arguments = "-Command " + userCmd,
    UseShellExecute = true  // 通过shell执行，更危险
};
Process.Start(psi);

// 方案：命令白名单
var userCmd = Request.QueryString["cmd"];
var allowedCommands = new[] { "whoami", "date", "pwd" };

if (!allowedCommands.Contains(userCmd))
    throw new ArgumentException("Command not allowed");

Process.Start(userCmd);

// 模式1：直接使用上传文件名
if (Request.Files.Count > 0)
{
    var file = Request.Files[0];
    file.SaveAs(Path.Combine(Server.MapPath("~/uploads"), file.FileName));
}

// 模式2：仅检查扩展名
if (Path.GetExtension(file.FileName).ToLower() == ".jpg")
{
    file.SaveAs("uploads/" + file.FileName);
}

// 模式3：未验证保存路径
var uploadPath = "uploads/" + file.FileName;
file.SaveAs(uploadPath);

// 模式1：直接反序列化用户输入
byte[] data = Convert.FromBase64String(Request.QueryString["data"]);
var formatter = new BinaryFormatter();
object obj = formatter.Deserialize(new MemoryStream(data));

// 模式2：LosFormatter反序列化
string viewState = Request.Form["__VIEWSTATE"];
var formatter = new LosFormatter();
object obj = formatter.Deserialize(viewState);

// 模式3：JsonConvert不安全配置
var settings = new JsonSerializerSettings 
{
    TypeNameHandling = TypeNameHandling.All
};
var obj = JsonConvert.DeserializeObject(userInput, settings);

// 方案1：使用安全的JsonConvert配置
var settings = new JsonSerializerSettings 
{
    TypeNameHandling = TypeNameHandling.None
};
var user = JsonConvert.DeserializeObject<User>(userInput, settings);

// 方案2：使用System.Text.Json
var options = new JsonSerializerOptions 
{
    TypeInfoResolver = null
};
var user = JsonSerializer.Deserialize<User>(userInput, options);

// 方案3：ViewState安全配置
// web.config中：
// <pages enableViewStateMac="true" viewStateEncryptionMode="Always" />

public string ValidatePath(string userInput)
{
    string baseDir = Path.GetFullPath("data/");
    string fullPath = Path.Combine(baseDir, userInput);
    string canonicalPath = Path.GetFullPath(fullPath);
    
    if (!canonicalPath.StartsWith(baseDir))
        throw new ArgumentException("Path traversal detected");
    
    return canonicalPath;
}

var settings = new XmlReaderSettings
{
    DtdProcessing = DtdProcessing.Prohibit,
    XmlResolver = null
};
using (XmlReader reader = XmlReader.Create(xmlStream, settings))
{
    var doc = new XmlDocument();
    doc.Load(reader);
}