议题作者：灰色轨迹
信息来源：邪恶八进制信息安全团队（
www.eviloctal.com）
下面是一个.net文件的源码
_______________________________________________________________
----------------------------------------------------------------------
<%@ Page language="c#" Codebehind="list.aspx.cs" AutoEventWireup="false" Inherits="hosp.list" %>
<%@ Register TagPrefix="Acme" TagName="top" Src="top.ascx" %>
<%@ Register TagPrefix="Acme" TagName="menu" Src="menu.ascx" %>
<HTML>
<HEAD>
<title>某某网站的一个页面，名为list.aspx,接收的参数为xt=12345678901234我想请问如何对XT这个参数进行过滤</title>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<meta http-equiv="Content-Language" content="zh-cn">
<meta content="Microsoft Visual Studio .NET 7.1" name="GENERATOR">
<meta content="C#" name="CODE_LANGUAGE">
<meta content="java-script" name="vs_defaultClientScript">
<meta content="
http://schemas.microsoft.com/intellisense/ie5" name="vs_targetSchema">
<link href="/wadmin/Images/style.css" type="text/css" rel="stylesheet">
<link href="/wadmin/Images/bg.css" type="text/css" rel="stylesheet">
</HEAD>
<body bgColor="#00ccff" leftMargin="0" topMargin="0">
<form id="form1" runat="server">
<div align="center"><ACME:TOP id="Top" runat="server"></ACME:TOP>
<table id="table2" cellSpacing="0" cellPadding="0" width="780" border="0">
<tr>
<td width="503"><IMG height="111" src="Images/c1.gif" width="503" border="0"></td>
<td vAlign="top" width="276" bgColor="#F5F5F5" rowSpan="2"><MARQUEE direction="up" height="140" id="cool" onmouseout="cool.start()" onmouseover="cool.stop()" scrollAmount="2"
scrollDelay="98"><asp:datagrid id="mgrid" runat="server" Width="100%" ShowHeader="False" AllowPaging="True" AutoGenerateColumns="False"
CellPadding="2" BorderWidth="0px" CellSpacing="2" PageSize="5">
<Columns>
<asp:TemplateColumn>
<ItemTemplate>
<table cellpadding="0" cellspacing="0" width="100%">
<tr>
<td width="20"><img src="Images/copy.gif" height="20"></td>
<td>
<asp:HyperLink ID="lk1" Runat="server" NavigateUrl='<%# "show.aspx?id=" + DataBinder.Eval(Container.DataItem,"ID").ToString() + "&xt=" + DataBinder.Eval(Container.DataItem,"XT").ToString()%>'>
<%#DataBinder.Eval(Container.DataItem,"TITLE").ToString()%>
</asp:HyperLink></td>
</tr>
<tr>
<td colspan="2" height="1" background="Images/xudian.gif"><img src="" height="1"></td>
</tr>
</table>
</ItemTemplate>
</asp:TemplateColumn>
</Columns>
<PagerStyle Visible="False"></PagerStyle>
</asp:datagrid></marquee></td>
<td width="3" background="Images/line6.gif" rowSpan="2"><img src="" width="3"></td>
</tr>
<tr>
<td background="Images/bg1.gif"><iframe src="frmmail.aspx" width="90%" scrolling="no" height="30" frameborder="0" hspace="0"></iframe>
</td>
</tr>
</table>
<table id="table4" cellSpacing="0" cellPadding="0" width="780" border="0">
<tr>
<td><IMG height="9" src="Images/line.gif" width="780" border="0"></td>
</tr>
</table>
<table id="table5" cellSpacing="0" cellPadding="0" width="780" border="0">
<tr>
<td width="4" background="Images/line3.gif"><img src="" width="4"></td>
<td vAlign="top" width="164" bgColor="#ffffff"><ACME:MENU id="Menu_Info" runat="server"></ACME:MENU></td>
<td vAlign="top" width="610" background="Images/line8.gif" bgColor="#ffffff" colSpan="2">
<P><asp:label id="navi" runat="server"></asp:label></P>
<P style="FONT-SIZE: 16px" align="center"><b><asp:label id="txt_title" runat="server"></asp:label></b>
<div align="right"><asp:label id="info" Runat="server"></asp:label></div>
<asp:panel id="line" Runat="server" Visible="False">
<HR width="98%" SIZE="1">
</asp:panel>
<table cellSpacing="0" cellPadding="0" width="96%" align="center">
<tr>
<td vAlign="top" height="300"><span id="cnt" style="LINE-HEIGHT: 160%" runat="server"></span><asp:datagrid id="mgrid_list" runat="server" Width="100%" ShowHeader="False" AllowPaging="True"
AutoGenerateColumns="False" CellPadding="2" BorderWidth="0px" CellSpacing="2" PageSize="18" OnPageIndexChanged="mgrid_page">
<Columns>
<asp:TemplateColumn>
<ItemTemplate>
<table cellpadding="0" cellspacing="0" width="100%">
<tr>
<td width="20"><img src="Images/copy.gif" height="20"></td>
<td>
<asp:HyperLink ID="Hyperlink1" Runat="server" NavigateUrl='<%# "show.aspx?id=" + DataBinder.Eval(Container.DataItem,"ID").ToString() + "&xt=" + DataBinder.Eval(Container.DataItem,"XT").ToString()%>'>
<%#DataBinder.Eval(Container.DataItem,"TITLE").ToString()%>
</asp:HyperLink> [<%#DataBinder.Eval(Container.DataItem,"DTM","{0:d}")%>]</td>
</tr>
<tr>
<td colspan="2" height="1" background="Images/line7.gif"><img src="" height="1"></td>
</tr>
</table>
</ItemTemplate>
</asp:TemplateColumn>
</Columns>
<PagerStyle NextPageText="上一页" PrevPageText="下一页"></PagerStyle>
</asp:datagrid><br>
<br>
</td>
</tr>
</table>
</td>
<td background="Images/line6.gif" height="1"><img height="2" src="" width="2"></td>
</tr>
</table>
<table id="table6" cellSpacing="0" cellPadding="0" width="780" border="0">
<tr>
<td colSpan="3"><IMG height="22" src="Images/line4.gif" width="780" border="0"></td>
</tr>
<tr>
<td width="4" background="Images/line3.gif"><img src="" width="4"></td>
<td align="center" width="773" bgColor="#ffffff" height="46">2005 某网站
地址：某网站 <br>
设计制作：某网站 </td>
<td width="3" background="Images/line6.gif"><img src="" width="3"></td>
</tr>
</table>
</div>
</form>
</body>
</HTML>
_______________________________________________________________
-----------------------------------------------------------------------
这个文件在web下以
http://www.xxx.com/list.aspx?xt=12345678901234的形式访问的，但是由于没有对参数xt进行过滤，便产生的注入漏洞，我想修补一下，曾经试过下面几种方法：
(1)我自认为是图中的代码中的红色部分没有对参数据进行过滤，于是在后面加上toString().Replace('\'', '')等相关的限制语名，结果都页面出现了错误
(2)接着用第二种方法,在前面加上如下代码:
<script runat="server">
void Page_Load(object sender, EventArgs e)
{
if(Request.RequestType == "POST")
{
string tocheck=Request.QueryString["xt"];
if(tocheck.Lengt>14)
{
Response.Write("error");
}
}
}
</script>
结果页面访问正常，但是不能防止注入
也试过如下代码：
<script runat="server">
void Page_Load(object sender, EventArgs e)
{
if (Request.RequestType == "POST")
{
int i;
if (Int64.TryParse(Request.Form["xt"], out i) == true)
{
}
else
Response.Write("Input data is not an integer");
}
}
</script>
返回错误
(3)我用类似VB脚本写进如下代码(注意：Page language="c#" 因此VB脚本用不了)
<script runat="server">
String Inject(String str)
{
string tocheck="";
tocheck=str;
string [] a =tocheck.Split('\'');
string checkover= a[0];
return(checkover);
}
</script>
然后在所有的"xt"参数都改为Inject("xt")，结果返回正常，但不能防注
实在没辙，请大伙帮忙，感谢！
