Hacking DropDownList value

I've got a DropDownList and I'm trying to prevent it from being used as an attack vector. Can I assume that the user is unable to actually change the values of the DDL and postback to the server? At the moment, I get this ASP.NET error message thrown if I try and change the packet after submission:

For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them.

Am I right in thinking that this is due to the integrity being compromised in the viewstate hash? Can this be bypassed?

Thanks

Answers


Actually you should be able to assume that the dropdown list options have not been changed client side as long as the page has EnableEventValidation = true (which is default although you can disable it per page or in the web.config). If a new value is added to your dropdownlist client side, and a postback occurs an error will occur unless you register this new value for event validation (http://odetocode.com/blogs/scott/archive/2006/03/21/asp-net-event-validation-and-invalid-callback-or-postback-argument-again.aspx)


No, you can't assume that.

You should always consider that all input is untrusted, and treat it appropriately (make sure it is what it should be, and that it is of the right type, and that the current user (or whatever) has access to it, and so on).


Need Your Help

How do I attach a build log to an e-mail notification with the Jenkins plugin Email-ext?

plugins jenkins jenkins-plugins email-ext

Version 2.15 of Jenkins plug-in Email-ext added support for attaching files to build notification e-mails. I would like to have the build log attached to build notification e-mails, but I can't fig...

Auto fill in fields in WebView android

javascript android webview field

i want to fill in fields with this code but it gives me error

About UNIX Resources Network

Original, collect and organize Developers related documents, information and materials, contains jQuery, Html, CSS, MySQL, .NET, ASP.NET, SQL, objective-c, iPhone, Ruby on Rails, C, SQL Server, Ruby, Arrays, Regex, ASP.NET MVC, WPF, XML, Ajax, DataBase, and so on.