仅在我的操作方法中绑定导航属性的某些属性

Question

我有以下 2 个模型类：-

 public Submission()
        {
            SubmissionQuestionSubmission = new HashSet<SubmissionQuestionSubmission>();
        }

        public int Id { get; set; }
        public string FirstName { get; set; }
        public string LastName { get; set; }
        public string Npi { get; set; }
        public bool Independent { get; set; }
        public string Comment { get; set; }

        public virtual ICollection<SubmissionQuestionSubmission> SubmissionQuestionSubmission { get; set; }
    }


public partial class SubmissionQuestionSubmission
    {
        public int SubmissionQuestionId { get; set; }
        public int SubmissionId { get; set; }
        public string Answer { get; set; }

        public virtual Submission Submission { get; set; }
    }

我创建了以下视图模型：-

 public class SubmissionCreate
    {
        public Submission Submission {set; get;}
        public IList<SubmissionQuestion> SubmissionQuestion { set; get; }

        public IList<SubmissionQuestionSubmission> SubmissionQuestionSubmission { set; get; }

    }

然后在我看来，我只需要提交以下字段：-

@model LandingPageFinal3.ViewModels.SubmissionCreate
<form asp-action="Create">
                <div asp-validation-summary="ModelOnly" class="text-danger"></div>
                <div class="form-group">
                    <label asp-for="Submission.FirstName" class="control-label"></label>
                    <input asp-for="Submission.FirstName" class="form-control" />
                    <span asp-validation-for="Submission.FirstName" class="text-danger"></span>
                </div>
                <div class="form-group">
                    <label asp-for="Submission.LastName" class="control-label"></label>
                    <input asp-for="Submission.LastName" class="form-control" />
                    <span asp-validation-for="Submission.LastName" class="text-danger"></span>
                </div>
                <div class="form-group">
                    <label asp-for="Submission.Npi" class="control-label"></label>
                    <input asp-for="Submission.Npi" class="form-control" />
                    <span asp-validation-for="Submission.Npi" class="text-danger"></span>
                </div>
                <div class="form-group form-check">
                    <label class="form-check-label">
                        <input class="form-check-input" asp-for="Submission.Independent" /> @Html.DisplayNameFor(model => model.Submission.Independent)
                    </label>
                </div>
                <div class="form-group">
                    <label asp-for="Submission.Comment" class="control-label"></label>
                    <textarea asp-for="Submission.Comment" class="form-control"></textarea>
                    <span asp-validation-for="Submission.Comment" class="text-danger"></span>
                </div>

                <div id="additionalInfo">
                    @for (var i = 0; i < Model.SubmissionQuestion.Count(); i++)
                    {
                        <label>@Model.SubmissionQuestion[i].Question</label><br />
                        <input asp-for="@Model.SubmissionQuestion[i].Question" hidden />
                        <textarea asp-for="@Model.SubmissionQuestionSubmission[i].Answer" class="form-control"></textarea>
                        <input asp-for="@Model.SubmissionQuestionSubmission[i].SubmissionQuestionId" hidden />
                        <br />
                    }
                </div>

所以我在我的 post 操作方法中定义了以下绑定，只绑定我的视图中的字段，如下所示：-

public async Task<IActionResult> Create([Bind(Submission.FirstName,Submission.LastName,Submission.Npi,Submission.Independent" +
            "Submission.Comment,SubmissionQuestionSubmission.Answer,SubmissionQuestionSubmission.SubmissionQuestionId")] SubmissionCreate sc )
        {

但sc.Submission 和sc.SubmissionQuestionSubmission 在我的操作方法中将为空...所以不确定我应该定义的最小绑定是什么，以防止通过回发额外信息和导航属性以外的其他信息和导航属性来攻击我们的应用程序我认为定义的那些？

Answer 1

您无需使用bind 来仅绑定出现在您的视图中的字段。

其实你的视图已经为你需要显示的字段设置了name属性，所以 SubmissionCreate sc 接受时只会绑定视图中对应的字段。

只需使用此代码接收：

 public async Task<IActionResult> Create(SubmissionCreate sc)
        {
            return View();
        }

---

更新

由于只绑定了视图中的部分字段，所以只需要排除SubmissionQuestion字段值：

public async Task<IActionResult> Create([Bind("Submission", "SubmissionQuestionSubmission")]SubmissionCreate sc)
    {
        return View();
    }

如果要更精确，可以将需要的字段分别绑定到Submission和SubmissionQuestionSubmission类，如下：

   [Bind("FirstName,LastName,Npi,Independent,Comment")]
    public class Submission
    {
        public Submission()
        {
            SubmissionQuestionSubmission = new HashSet<SubmissionQuestionSubmission>();
        }

        public int Id { get; set; }
        public string FirstName { get; set; }
        public string LastName { get; set; }
        public string Npi { get; set; }
        public bool Independent { get; set; }
        public string Comment { get; set; }
        public virtual ICollection<SubmissionQuestionSubmission> SubmissionQuestionSubmission { get; set; }
    }


   [Bind("Answer,SubmissionQuestionId")]
    public partial class SubmissionQuestionSubmission
    {
        [Key]
        public int SubmissionQuestionId { get; set; }

        public int SubmissionId { get; set; }
        public string Answer { get; set; }

        public virtual Submission Submission { get; set; }
    }