关于Web安全的那些事（XSS攻击）

 public class FormValidationException : Exception { public FormValidationException(PropertyInfo field) : this(field, null) { } public FormValidationException(PropertyInfo field, string message) : base(message) { Property = field; Field = field.Name; } public string Field { get; private set; } public PropertyInfo Property { get; private set; } public override string Message { get { string msg = base.Message; if (!string.IsNullOrWhiteSpace(Field)) { if (string.IsNullOrWhiteSpace(msg)) { msg = Field; } else { msg = string.Format("{0}({1})", msg, Field); } } return msg; } } } /// <summary> /// 不是必需的 /// </summary> public class NotRequiredException : FormValidationException { public NotRequiredException(PropertyInfo field) : base(field) {} public NotRequiredException(PropertyInfo field, string message) : base(field, message) {} } /// <summary> /// 无效的电子邮件格式 /// </summary> public class InvalidEmailFormatException : FormValidationException { public InvalidEmailFormatException(PropertyInfo field) : base(field) {} public InvalidEmailFormatException(PropertyInfo field, string message) : base(field, message) {} } /// <summary> /// 无效的电话号码 /// </summary> public class InvalidTelephoneNumberFormatException : FormValidationException { public InvalidTelephoneNumberFormatException(PropertyInfo field) : base(field) {} public InvalidTelephoneNumberFormatException(PropertyInfo field, string message) : base(field, message) {} } /// <summary> /// 不是中文名或者英文名 /// </summary> public class NotChineseNameOrEnglishNameException : FormValidationException { public NotChineseNameOrEnglishNameException(PropertyInfo field) : base(field) {} public NotChineseNameOrEnglishNameException(PropertyInfo field, string message) : base(field, message) {} } /// <summary> /// 不符合正则表达式 /// </summary> public class InconformityRegularExpressionException : FormValidationException { public InconformityRegularExpressionException(PropertyInfo field) : base(field) {} public InconformityRegularExpressionException(PropertyInfo field, string message) : base(field, message) {} } public class ValueLengthIsLengthyException : FormValidationException { public ValueLengthIsLengthyException(PropertyInfo field) : base(field) { } public ValueLengthIsLengthyException(PropertyInfo field, string message) : base(field, message) { } } public static class FormValidationExtendMethods { static void Validation(PropertyInfo p, string value) { var fv = p.GetAttribute<FormValidationAttribute>(); #region 验证 if (fv != null) { if (fv.Required && string.IsNullOrWhiteSpace(value)) { throw new NotRequiredException(p); } if (!string.IsNullOrWhiteSpace(value)) { if (!string.IsNullOrWhiteSpace(fv.RegularExpression) && !Regex.IsMatch(value, fv.RegularExpression, fv.RegexOptions)) { throw new InconformityRegularExpressionException(p); } if (fv.IsEmailFormat && !value.IsValidEmail()) { throw new InvalidEmailFormatException(p); } if (fv.IsTelephoneNumber && !value.IsTelephoneNumber()) { throw new InvalidTelephoneNumberFormatException(p); } if (fv.IsChineseNameOrEnglishName && !value.IsChineseNameOrEnglishName()) { throw new NotChineseNameOrEnglishNameException(p); } if (fv.MaxLength > 0 && value.Length > fv.MaxLength) { throw new ValueLengthIsLengthyException(p); } } } #endregion } public static bool Validation(this object o,bool isThrow=true) { bool err=false; Type t = o.GetType(); var ps = t.GetProperties(); try { foreach (var p in ps) { object v = null; try { v = p.GetValue(o, null); } catch { } Validation(p, v != null ? v.ToString() : string.Empty); } } catch { if (isThrow) throw; err = true; } return !err; } public static T GetInstance<T>(this NameValueCollection collection, bool verify = true) where T : class,new() { return collection.GetInstance<T>(new T(), verify); } public static T GetInstance<T>(this NameValueCollection collection, T instance, bool verify=true) where T : class { var ps = instance.GetType().GetProperties(); var keys = collection.AllKeys; foreach (var p in ps) { bool has = false; string k = p.Name; foreach (var o in keys) { if (string.Equals(o, k, StringComparison.InvariantCultureIgnoreCase)) { k = o; has = true; break; } } var value = has ? (collection[k] ?? "").Trim() : string.Empty; if (verify) { Validation(p, value); } ///如果没有指定值，就保持默认值。 if (!has) continue; #region 赋值 try { if (p.PropertyType.IsEnum) { p.SetValue(instance, Enum.Parse(p.PropertyType, value), null); } else { p.SetValue(instance, p.PropertyType.Equals(typeof(string)) ? value : Convert.ChangeType(value, p.PropertyType), null); } } catch { } #endregion } return instance; } public static T GetInstance<T>(this HttpRequest request, bool verify = true) where T : class,new() { return request.GetInstance<T>(new T(), verify); } public static T GetInstance<T>(this HttpRequest request, T instance, bool verify = true) where T : class { return request.Form.GetInstance<T>(instance,verify); } }