来自ASP.NET MVC站点的"无效的JSON原语:alihack"错误

Question

我们每天开始收到多个此类错误,出现在事件日志中:

无效的JSON原语:alihack.在System.Web.Script.Serialization.JavaScriptObjectDeserializer.DeserializePrimitiveObject()在System.Web.Script.Serialization.JavaScriptObjectDeserializer.DeserializeInternal(深度Int)在System.Web.Script.Serialization.JavaScriptObjectDeserializer.BasicDeserialize(字符串输入,的Int32 depthLimit,JavaScriptSerializer串行化器)在System.Web.Script.Serialization.JavaScriptSerializer.Deserialize(JavaScriptSerializer串行器,字符串输入,类型类型,的Int32 depthLimit)在System.Web.Mvc.JsonValueProviderFactory.GetDeserializedObject(controllerContext controllerContext)在System.Web.Mvc.JsonValueProviderFactory. System.Web.Mvc.ValueProviderFactoryCollection.GetValueProvider(ControllerContext controllerContext)中的System.Web.Mvc.ControllerBase.get_ValueProvider()处的System.Web.Mvc.ControllerActionInvoker.GetParameterValue(ControllerContext controllerContext,ParameterDescriptor parameterDescriptor)中的GetValueProvider(ControllerContext controllerContext) .Web.Mvc.Controlle System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncResult的System.Web.Mvc.Async.AsyncControllerActionInvoker.<> c__DisplayClass21.b__19(AsyncCallback asyncCallback,Object asyncState)中的rActionInvoker.GetParameterValues(ControllerContext controllerContext,ActionDescriptor actionDescriptor)1.CallBeginDelegate(AsyncCallback callback, Object callbackState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncResultBase1.Begin(AsyncCallback)回调,对象的状态,的Int32超时)在System.Web.Mvc.Async.AsyncControllerActionInvoker.BeginInvokeAction(ControllerContext controllerContext,字符串actionName,AsyncCallback的回调,对象状态)在System.Web.Mvc.Controller.b__1c(的AsyncCallback的AsyncCallback,对象asyncState, System.Web处的System.Web.Mvc.Controller.BeginExecuteCore 1.CallBeginDelegate(AsyncCallback callback, Object callbackState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncResultBase(AsyncCallback回调,对象状态)的System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid 1.Begin(AsyncCallback回调,对象状态,Int32超时)中的ExecuteCoreState innerState). System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsy上的Mvc.Controller.b__14(AsyncCallback asyncCallback,Object callbackState,Controller controller)1.CallBeginDelegate(AsyncCallback callback, Object callbackState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncResultBaseSystem.Web.Mvc.Controller.System.Web.Mvc.Async上的System.Web.Mvc.Controller.BeginExecute(RequestContext requestContext,AsyncCallback callback,Object state)中的ncVoid 1.Begin(AsyncCallback回调,对象状态,Int32超时) System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid上的System.Web.Mvc.MvcHandler.b__4(AsyncCallback asyncCallback,Object asyncState,ProcessRequestState innerState)中的1.CallBeginDelegate(AsyncCallback callback, Object callbackState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncResultBase.IAsyncController.BeginExecute(RequestContext requestContext,AsyncCallback callback,Object state)1.Begin(的AsyncCallback回调,对象的状态,的Int32超时)在System.Web.Mvc.MvcHandler.BeginProcessRequest(HttpContextBase HttpContext的,AsyncCallback的回调,对象状态)在System.Web.Mvc.MvcHandler.BeginProcessRequest(HttpContext的HttpContext的,AsyncCallback的回调,对象状态)在Orchard.Mvc.Routes.ShellRoute.HttpAsyncHandler.BeginProcessRequest(Http)中的System.Web.Mvc.MvcHandler.System.Web.IHttpAsyncHandler.BeginProcessRequest(HttpContext上下文,AsyncCallback cb,Object extraData)上下文语境,AsyncCallback的CB,而额外的对象)在System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()在System.Web.HttpApplication.ExecuteStep(IExecutionStep步骤,布尔逻辑completedSynchronously)

请求转到http://example.com/ali.txt.请求的有效负载中应该有其他内容,因为只需正确打开此URL就会生成404.

这有什么值得担心的吗？我可以,我应该防止这样的错误发生,而是返回一个错误的请求,例如？为什么这种反序列化首先发生？

Answer 1

此问题与(JSON::ParserError) "{N}: Unknown token at 'alihack<%eval request(\"alihack.com\")%> 重复，但针对不同的服务器 (IIS)。

如果您的站点不使用 PUT 请求，您可以使用 简单地拒绝所有这些请求<requestFiltering />。

<configuration>
   <system.webServer>
      <security>
        <requestFiltering>
          <verbs applyToWebDAV="false">
            <add verb="PUT" allowed="false" />
          </verbs>
        </requestFiltering>
      </security>
   </system.webServer>
</configuration>

否则，可以使用url 重写模块来实现更优雅的解决方案（可以使用Web Platform Installer进行安装）：

<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="Abort requests to ali.txt - alihack" patternSyntax="Wildcard" stopProcessing="true">
          <match url="ali.txt" />
          <conditions />
          <action type="AbortRequest" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>