mercredi 30 mars 2016

MVC Expose class and assembly name in View, what are the risks?

I have view model class: DummyClass.cs in project: ViewDataModels. Running MVC Razor app is named MyWebApp. In this web app I have View /Home/Index.cshtml and form with hidden field where is line of code that exposes DummyClass AssemblyQulifiedName

'@typeof(DummyClass).AssemblyQualifiedName'

results in

ViewDataModels.DummyClass, ViewDataModels, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null

so in post I can through reflexion get class type that represens model. What are the risks here? Are there any work arounds? For ex.: two way hash of the string?





Aucun commentaire:

Enregistrer un commentaire