如何调试恶意表单上传，错误500？(How can I debug malicious form upload which gives error 500?)

我目前有一个上传表格，看起来像

<form action="/Upload/Registration?measurementId=139" enctype="multipart/form-data" method="post"> <fieldset> <legend>Registrationfiles</legend> <input type="hidden" name="MeasurementId" value="139"/> <div class="editor-field"> <input id="RadioSelection" name="RadioSelection" type="radio" value="0" /> <label>or</label> <input type="hidden" name="RecordId[0]" value="375" /> <input type="file" name="RegistrationFile[0]" /> </div> <p class="submit"> <input type="submit" value="Save" /> </p> </fieldset> </form>

我在UploadController有两个方法：

[Authorize] public ActionResult Registration(int measurementId) { [...] return View(registrationViewModel); }

和

[HttpPost] [Authorize] public ActionResult Registration(RegistrationViewModel data, ICollection<int> RecordId, ICollection<HttpPostedFileBase> RegistrationFile) { [...] }

当我访问http://mySite.com/Upload/Registration?measurementId=139时，我得到表单（正如预期的那样），但是当我提交表单时，我收到Error 500 - (Internal Server Error) 。

这个错误的原因是什么？

我有很多断点，但没有一个被击中。 它只声明“错误500”。

这是响应头：

HTTP/1.1 500 Internal Server Error Cache-Control: private, s-maxage=0 Server: Microsoft-IIS/7.5 X-AspNetMvc-Version: 3.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Sun, 17 Feb 2013 18:50:13 GMT Content-Length: 0

编辑：当我删除第二种方法时，我没有收到错误500.我从来没有得到过YSOD 。

I currently have an upload form which looks like

<form action="/Upload/Registration?measurementId=139" enctype="multipart/form-data" method="post"> <fieldset> <legend>Registrationfiles</legend> <input type="hidden" name="MeasurementId" value="139"/> <div class="editor-field"> <input id="RadioSelection" name="RadioSelection" type="radio" value="0" /> <label>or</label> <input type="hidden" name="RecordId[0]" value="375" /> <input type="file" name="RegistrationFile[0]" /> </div> <p class="submit"> <input type="submit" value="Save" /> </p> </fieldset> </form>

And I have two methods in UploadController:

[Authorize] public ActionResult Registration(int measurementId) { [...] return View(registrationViewModel); }

and

[HttpPost] [Authorize] public ActionResult Registration(RegistrationViewModel data, ICollection<int> RecordId, ICollection<HttpPostedFileBase> RegistrationFile) { [...] }

When I access http://mySite.com/Upload/Registration?measurementId=139 I get the form (as expected), but when I submit it I get Error 500 - (Internal Server Error).

What is the reason for this bug?

I've many breakpoints, but none gets hit. It only states "Error 500".

This is the response header:

HTTP/1.1 500 Internal Server Error Cache-Control: private, s-maxage=0 Server: Microsoft-IIS/7.5 X-AspNetMvc-Version: 3.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Sun, 17 Feb 2013 18:50:13 GMT Content-Length: 0

edit: When I remove the second method, I don't get an error 500. And I never get a YSOD.

最满意答案

在您的web.config中将customErrors设置为“On”并重定向到Error.cshmtl。 您应该只修复500错误，然后将其恢复为“关闭”。

有关详细说明，请参阅无法使defaultRedirect正常工作或https://stackoverflow.com/a/6211961/1176596 。

一个可能的问题可能是您在View中使用的某个模型缺少默认构造函数。 如果是这样，您将在错误视图中看到MissingMethodException。

In your web.config set customErrors to "On" and redirect to Error.cshmtl. You should do this only for fixing the 500 error and put it back to "Off" afterwards.

For further instructions see Can't get defaultRedirect to work or https://stackoverflow.com/a/6211961/1176596 .

One possible problem might be that one of your used Models in a View lacks a default constructor. If so, you will get a MissingMethodException in your Error view.

如何调试恶意表单上传，错误500？(How can I debug malicious form upload which gives error 500?)

我目前有一个上传表格，看起来像

<form action="/Upload/Registration?measurementId=139" enctype="multipart/form-data" method="post"> <fieldset> <legend>Registrationfiles</legend> <input type="hidden" name="MeasurementId" value="139"/> <div class="editor-field"> <input id="RadioSelection" name="RadioSelection" type="radio" value="0" /> <label>or</label> <input type="hidden" name="RecordId[0]" value="375" /> <input type="file" name="RegistrationFile[0]" /> </div> <p class="submit"> <input type="submit" value="Save" /> </p> </fieldset> </form>

我在UploadController有两个方法：

[Authorize] public ActionResult Registration(int measurementId) { [...] return View(registrationViewModel); }

和

[HttpPost] [Authorize] public ActionResult Registration(RegistrationViewModel data, ICollection<int> RecordId, ICollection<HttpPostedFileBase> RegistrationFile) { [...] }

当我访问http://mySite.com/Upload/Registration?measurementId=139时，我得到表单（正如预期的那样），但是当我提交表单时，我收到Error 500 - (Internal Server Error) 。

这个错误的原因是什么？

我有很多断点，但没有一个被击中。 它只声明“错误500”。

这是响应头：

HTTP/1.1 500 Internal Server Error Cache-Control: private, s-maxage=0 Server: Microsoft-IIS/7.5 X-AspNetMvc-Version: 3.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Sun, 17 Feb 2013 18:50:13 GMT Content-Length: 0

编辑：当我删除第二种方法时，我没有收到错误500.我从来没有得到过YSOD 。

I currently have an upload form which looks like

<form action="/Upload/Registration?measurementId=139" enctype="multipart/form-data" method="post"> <fieldset> <legend>Registrationfiles</legend> <input type="hidden" name="MeasurementId" value="139"/> <div class="editor-field"> <input id="RadioSelection" name="RadioSelection" type="radio" value="0" /> <label>or</label> <input type="hidden" name="RecordId[0]" value="375" /> <input type="file" name="RegistrationFile[0]" /> </div> <p class="submit"> <input type="submit" value="Save" /> </p> </fieldset> </form>

And I have two methods in UploadController:

[Authorize] public ActionResult Registration(int measurementId) { [...] return View(registrationViewModel); }

and

[HttpPost] [Authorize] public ActionResult Registration(RegistrationViewModel data, ICollection<int> RecordId, ICollection<HttpPostedFileBase> RegistrationFile) { [...] }

When I access http://mySite.com/Upload/Registration?measurementId=139 I get the form (as expected), but when I submit it I get Error 500 - (Internal Server Error).

What is the reason for this bug?

I've many breakpoints, but none gets hit. It only states "Error 500".

This is the response header:

HTTP/1.1 500 Internal Server Error Cache-Control: private, s-maxage=0 Server: Microsoft-IIS/7.5 X-AspNetMvc-Version: 3.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Sun, 17 Feb 2013 18:50:13 GMT Content-Length: 0

edit: When I remove the second method, I don't get an error 500. And I never get a YSOD.

最满意答案

在您的web.config中将customErrors设置为“On”并重定向到Error.cshmtl。 您应该只修复500错误，然后将其恢复为“关闭”。

有关详细说明，请参阅无法使defaultRedirect正常工作或https://stackoverflow.com/a/6211961/1176596 。

一个可能的问题可能是您在View中使用的某个模型缺少默认构造函数。 如果是这样，您将在错误视图中看到MissingMethodException。

In your web.config set customErrors to "On" and redirect to Error.cshmtl. You should do this only for fixing the 500 error and put it back to "Off" afterwards.

For further instructions see Can't get defaultRedirect to work or https://stackoverflow.com/a/6211961/1176596 .

One possible problem might be that one of your used Models in a View lacks a default constructor. If so, you will get a MissingMethodException in your Error view.