ASP.NET MVC Preview 2 Changes to Prevent JSON Hijacking
Phil Haack recently blogged about a very subtle JSON vulnerability and a related JSON Hijacking problem that can hijack sensitive data returned by a JSON GET. He outlines the problem very well and in concrete detail - and even supplies a sample project you can use to see the vulnerabilities in action yourself. So I won’t detail the issue here, other than to say that he raises a very serious specter, which is that GETs for JSON data can be prone to a very subtle, yet vicious, security vulnerability.

Given Phil’s role in defining the direction of ASP.NET MVC, it’s therefore not surprising to see that Preview2 of ASP.NET MVC 2 (up on codeplex.com) introduces a breaking change to address this. Specifically, as the release notes outline, an ASP.NET MVC JsonResult will now only respond to HttpPost requests.

http://www.devproconnections.com/tabId/180/itemId/4587/Security-Changes-in-ASPNET-MVC-V2-Good-News-for.aspx

http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx

Now I just have to figure out how to get all these GET examples converted to working POST examples.

I have a question about a problem I am having with a simple Entity Framework implementation I am doing with MVC 2.0 P2. I think/hope this is something simple, and I don’t think (though I could be wrong) that this is related to the issues you describe above.

I have a simple controller action that does the following:

public ActionResult GridDemoData(int page, int rows, string search, string sidx, string sord)
{/*
var repository = new Repository();
var model = from entity in repository.SelectAll().OrderBy(sidx + " " + sord)
select new
{
IntProperty = entity.IntProperty,
StringProperty = entity.StringProperty,
DateProperty = entity.DateProperty.ToString(System.Globalization.CultureInfo.CurrentUICulture)
};
*/
var dc = new InvestorEntities();
var model = dc.Investor
//.Include("Organization")
//.Include("LastModifiedUser")
.Where(i => !i.IsDeleted);

JsonResult r = Json(model.ToJqGridData(page, rows, sidx + " " + sord, search,
new[] { "InvestorID", "IsDeleted" }));

return r;
}

And here is my complete jqGrid definition:

$(function() {
$(’#investorGrid’).jqGrid({
url: ”,
imgpath: ”,
datatype: ‘json’,
height: ‘auto’,
jsonReader: {
root: ‘Rows’,
page: ‘Page’,
total: ‘Total’,
records: ‘Records’,
repeatitems: false,
userdata: ‘UserData’,
id: ‘InvestorID’
},
loadui: ‘block’,
mtype: ‘GET’,
multiboxonly: true,
rowNum: 5,
rowList: [5, 10, 15, 20],
viewrecords: true,
multiselect: false,
caption: ‘Investors’,
colNames: ['Investor ID', 'Is Deleted'],
colModel: [
{ name: 'InvestorID', index: 'InvestorID' },
{ name: 'IsDeleted', index: 'IsDeleted' }
],
pager: $(’#investorPager’),
sortname: ‘InvestorID’,
sortorder: ‘asc’
}).navGrid(’#investorPager’, { edit: false, add: false, del: false, search: false });
$(’#investorSearch’).filterGrid(’#’ + grid.attr(’InvestorID’), {
gridModel: false,
filterModel: [{
label: 'Search',
name: 'search',
stype: 'text'
}]
});
});

The problem I run into here is that my data gets blocked/lost somewhere between "return r" - at which point I have a filled object hierarchy - and showing up on the screen. I don’t get any error - I just get no rows.

For a while, I thought that perhaps the default JsonRequest.JsonRequestBehavior of "DenyGet" was getting me, but explicitly setting this to "AllowGet" right before "return r" in my action doesn’t change anything.

I tried swapping out my datatype of json for local and using a javascript array and it worked fine, so I think my jqGrid definition is good. I am just at my wit’s end here and I am hoping you have seen this before.

Thanks in advance for your time and once again - great articles!

Tony