C#-防止MDX注入攻击
作者：互联网
用C#防御MDX注入攻击的好方法是什么？我目前正在使用ADOMDClient,我应该使用其他客户端吗？
解决方法:
我们可以通过将用户指定的字符串传递到MDX StrToSet,StrToTuple,StrToMember和StrToValue函数中来创建参数化的MDX查询,以防止MDX注入攻击.
这是从this MSDN page开始的MDX StrToSet函数的一些示例.
The following example returns the set of members of the State-Province attribute hierarchy using the StrToSet function. The set specification provides a valid MDX set expression.
SELECT StrToSet ('[Geography].[State-Province].Members')
ON 0
FROM [Adventure Works]
The following example returns an error due to the CONSTRAINED flag. While the set specification provides a valid MDX set expression, the CONSTRAINED flag requires qualified or unqualified member names in the set specification.
SELECT StrToSet ('[Geography].[State-Province].Members', CONSTRAINED)
ON 0
FROM [Adventure Works]
下面的代码示例演示如何创建参数化查询以及如何使用AdomdConnection对象执行该查询.
假设我们具有以下通用C#方法,该方法执行参数化的MDX查询并返回CellSet.
public CellSet GetCellSet(string connectionString, string query, IDictionary<string, object> parms)
{
using (var conn = new AdomdConnection(connectionString))
{
// Open the connection.
conn.Open();
// Create the command.
using (var cmd = conn.CreateCommand())
{
// Set the command query.
cmd.CommandText = query;
// Add any query parameters.
if (parms != null)
{
foreach (var kv in parms)
{
var parameter = cmd.CreateParameter();
parameter.ParameterName = kv.Key;
parameter.Value = kv.Value;
cmd.Parameters.Add(parameter);
}
}
// Execute the query and return the CellSet.
return cmd.ExecuteCellSet();
}
}
}
假设我们有另一种方法,该方法允许客户端传递MDX集表达式的字符串表示形式.该方法将从多维数据集中选择集合,并返回结果的CellSet.
public CellSet GetMdxSetOnColumns(string setExpression)
{
var connectionString = "replace with your connection string";
// The query parameter @TheSet will be replaced with setExpression.
var query = "SELECT StrToSet(@TheSet) ON 0 FROM [Adventure Works]";
// Add the passed in string as a query parameter.
var parms = new Dictionary<string, object>();
// You can omit the "@" in front of the parameter name here.
parms.Add("TheSet", setExpression);
return GetCellSet(connectionString, query, parms);
}
客户端代码可以像这样调用此方法.
var cellSet = GetMdxSetOnColumns("[Geography].[State-Province].Members");