Is Injection Possible through Dynamic LINQ?

前端 未结 2 1035
-上瘾入骨i
-上瘾入骨i 2020-12-01 06:16

Using the Dynamic LINQ library (link), is it vulnerable to injection? and (if so) how can this be protected against?

Some background from Security Considerations (En

2条回答
  •  南笙
    南笙 (楼主)
    2020-12-01 06:30

    From what I know from examining the System.Data.Linq namespace is that an SQL object tree is built from the LINQ query and as part of this process the SqlParameterizer class is called to replace all inline values with parameters. The values are then assigned to the parameters. So SQL injection attacks should not be possible.

提交回复
热议问题