Same-Origin Policy یک سازوکار امنیتی در مرورگرها هستش که ارتباط مستندات (Documents) و Scriptها رو از یک Origin با یک Origin دیگه، محدود میکنه و برای اون‌ها قانون وضع میکنه. این سازوکار کمک میکنه که مستندات آلوده ایزوله باشن و از حملات احتمالی جلوگیری بشه. به این صورت که مرورگر اجازه نمیده که یک Origin محتوایی از Origin دیگه‌ای بخونه و یا به اون دسترسی داشته باشه.
public T GetFromQueryString<T>(RequestType type=RequestType.GET) where T : new()
{
var obj = new T();
var properties = typeof(T).GetProperties();
var queries =new NameValueCollection();
if(type==RequestType.GET)
queries= HttpContext.Current.Request.QueryString;
else
{
queries = HttpContext.Current.Request.Form;
}
foreach (var property in properties)
{
foreach (Attribute attribute in property.GetCustomAttributes(true))
{
var requestBodyField = attribute as RequestBodyField;
if (requestBodyField == null) continue;
//get value of query string
var valueAsString = queries[requestBodyField.Field];
if (valueAsString == null)
{
var keys = from key in queries.AllKeys where key.StartsWith(requestBodyField.Field) select key;
if(!keys.Any())
continue;
var collection = new NameValueCollection();
foreach (var key in keys)
{
var openBraketIndex = key.IndexOf("[", StringComparison.Ordinal);
var closeBraketIndex = key.IndexOf("]", StringComparison.Ordinal);
if (openBraketIndex < 0 || closeBraketIndex < 0)
throw new Exception("query string is crupted.");
openBraketIndex++;
//get key in [...]
var fieldName = key.Substring(openBraketIndex, closeBraketIndex - openBraketIndex);
collection.Add(fieldName, queries[key]);
}
property.SetValue(obj, collection, null);
continue;
}
var converter = TypeDescriptor.GetConverter(property.PropertyType);
var value = converter.ConvertFrom(valueAsString);
if (value == null)
continue;
property.SetValue(obj, value, null);
}
}
return obj;
} using System; using System.Collections.Specialized; using System.Reflection; using System.Text.RegularExpressions; using System.Web; using Microsoft.Security.Application;
namespace AntiXssMdl { public class AntiXssModule : IHttpModule { private static readonly Regex _cleanAllTags = new Regex("<[^>]+>", RegexOptions.Compiled); public void Init(HttpApplication context) { context.BeginRequest += CleanUpInput; }
public void Dispose() { }
private static void CleanUpInput(object sender, EventArgs e) { HttpRequest request = ((HttpApplication)sender).Request; if (request.QueryString.Count > 0) { //تمیزکاری مقادیر کلیه کوئری استرینگ‌ها پیش از استفاده در برنامه CleanUpAndEncode(request.QueryString, allowHtmltags: false); }
if (request.HttpMethod == "POST") { //تمیزکاری کلیه مقادیر ارسالی به سرور if (request.Form.Count > 0) { CleanUpAndEncode(request.Form, allowHtmltags: true); } } }
private static void CleanUpAndEncode(NameValueCollection collection, bool allowHtmltags) { //اندکی دستکاری در سیستم داخلی دات نت PropertyInfo readonlyProperty = collection .GetType() .GetProperty("IsReadOnly", BindingFlags.Instance | BindingFlags.NonPublic); readonlyProperty.SetValue(collection, false, null);//IsReadOnly=false
for (int i = 0; i < collection.Count; i++) { if (string.IsNullOrWhiteSpace(collection[i])) continue;
if (!allowHtmltags) { //در حالت کوئری استرینگ دلیلی برای ارسال هیچ نوع تگی وجود ندارد collection[collection.Keys[i]] = AntiXss.HtmlEncode(_cleanAllTags.Replace(collection[i], string.Empty)); } else { //قصد تمیز سازی ویوو استیت را نداریم چون در این حالت وب فرم‌ها از کار می‌افتند if (collection.Keys[i].StartsWith("__VIEWSTATE")) continue; //در سایر موارد کاربران مجازند فقط تگ‌های سالم را ارسال کنند و مابقی حذف می‌شود collection[collection.Keys[i]] = Sanitizer.GetSafeHtml(collection[i]); } }
readonlyProperty.SetValue(collection, true, null);//IsReadOnly=true } } }
<?xml version="1.0"?>
<configuration>
<system.web>
<pages validateRequest="false" enableEventValidation="false" />
<httpRuntime requestValidationMode="2.0" />
<compilation debug="true" targetFramework="4.0" />
<httpModules>
<add name="AntiXssModule" type="AntiXssMdl.AntiXssModule"/>
</httpModules>
</system.web>
<system.webServer>
<validation validateIntegratedModeConfiguration="false"/>
<modules>
<add name="AntiXssModule" type="AntiXssMdl.AntiXssModule"/>
</modules>
</system.webServer>
</configuration>
<?xml version="1.0" encoding="utf-8"?>
<packages>
<package id="EntityFramework" version="4.3.1" />
</packages>
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<configSections>
<!-- For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 -->
<section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=4.3.1.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
</configSections>
<entityFramework>
<defaultConnectionFactory type="System.Data.Entity.Infrastructure.SqlConnectionFactory, EntityFramework">
<parameters>
<parameter value="Data Source=(localdb)\v11.0; Integrated Security=True; MultipleActiveResultSets=True" />
</parameters>
</defaultConnectionFactory>
</entityFramework>
</configuration>
namespace EF_Sample01.Models
{
public class Post
{
public int Id { set; get; }
public string Title { set; get; }
public string Content { set; get; }
public virtual Blog Blog { set; get; }
}
}
using System.Collections.Generic;
namespace EF_Sample01.Models
{
public class Blog
{
public int Id { set; get; }
public string Title { set; get; }
public string AuthorName { set; get; }
public IList<Post> Posts { set; get; }
}
}
using System.Data.Entity;
using EF_Sample01.Models;
namespace EF_Sample01
{
public class Context : DbContext
{
public DbSet<Blog> Blogs { set; get; }
public DbSet<Post> Posts { set; get; }
}
}
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<configSections>
...
</configSections>
<connectionStrings>
<clear/>
<add name="Context"
connectionString="Data Source=(local);Initial Catalog=testdb2012;Integrated Security = true"
providerName="System.Data.SqlClient"
/>
</connectionStrings>
...
</configuration>
<connectionStrings>
<add name="MyContextName"
connectionString="Data Source=|DataDirectory|\Store.sdf"
providerName="System.Data.SqlServerCe.4.0" />
</connectionStrings>
public class Context : DbContext
{
public Context()
: base("ConnectionStringName")
{
}
using EF_Sample01.Models;
namespace EF_Sample01
{
class Program
{
static void Main(string[] args)
{
using (var db = new Context())
{
db.Blogs.Add(new Blog { AuthorName = "Vahid", Title = ".NET Tips" });
db.SaveChanges();
}
}
}
}
using EF_Sample01.Models;
namespace EF_Sample01
{
class Program
{
static void Main(string[] args)
{
//addBlog();
addPost();
}
private static void addPost()
{
using (var db = new Context())
{
var blog = db.Blogs.Find(1);
db.Posts.Add(new Post
{
Blog = blog,
Content = "data",
Title = "EF"
});
db.SaveChanges();
}
}
private static void addBlog()
{
using (var db = new Context())
{
db.Blogs.Add(new Blog { AuthorName = "Vahid", Title = ".NET Tips" });
db.SaveChanges();
}
}
}
}
exec sp_executesql N'insert [dbo].[Posts]([Title], [Content], [Blog_Id])
values (@0, @1, @2)
select [Id]
from [dbo].[Posts]
where @@ROWCOUNT > 0 and [Id] = scope_identity()',
N'@0 nvarchar(max) ,@1 nvarchar(max) ,@2 int',
@0=N'EF',
@1=N'data',
@2=1
namespace TestKeys
{
class Program
{
public class Bill
{
[DatabaseGenerated(DatabaseGeneratedOption.None)]
public string Id { get; set; }
public decimal Amount { set; get; }
[ForeignKey("AccountId")]
public virtual Account Account { get; set; }
public string AccountId { set; get; }
}
public class Account
{
[DatabaseGenerated(DatabaseGeneratedOption.None)]
public string Id { get; set; }
public string Name { get; set; }
}
public class MyContext : DbContext
{
public DbSet<Bill> Bills { get; set; }
public DbSet<Account> Accounts { get; set; }
}
public class BillFromWebsrv
{
public string Id { get; set; }
public decimal Amount { set; get; }
public DateTime DateTime { get; set; }
public Account Account { get; set; }
}
static void Main(string[] args)
{
Database.SetInitializer(new DropCreateDatabaseIfModelChanges<MyContext>());
using (var ctx = new MyContext())
{
foreach (var dummyBill in DummyBills())
{
var bl = new Bill { Id = dummyBill.Id, Amount = dummyBill.Amount, Account = dummyBill.Account };
ctx.Bills.Add(bl);
}
ctx.SaveChanges();
}
}
public static List<BillFromWebsrv> DummyBills()
{
return new List<BillFromWebsrv>
{
new BillFromWebsrv
{
Id = "1",
Amount = 1231,
DateTime = DateTime.Now,
Account = new Account {Id = "1", Name = "ac1"}
},
new BillFromWebsrv
{
Id = "2",
Amount = 1232,
DateTime = DateTime.Now,
Account = new Account {Id = "2", Name = "ac2"}
},
new BillFromWebsrv
{
Id = "3",
Amount = 1233,
DateTime = DateTime.Now,
Account = new Account {Id = "2", Name = "ac2"}
},
new BillFromWebsrv
{
Id = "4",
Amount = 1134,
DateTime = DateTime.Now,
Account = new Account {Id = "3", Name = "ac3"}
}
};
}
}
} 
public class LockFilter : ActionFilterAttribute
{
static ConcurrentDictionary<StringBuilder, int> _properties;
static LockFilter()
{
_properties = new ConcurrentDictionary<StringBuilder, int>();
}
public int Duration { get; set; }
public string VaryByParam { get; set; }
public override async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
{
var actionArguments = context.ActionArguments.Values.Single();
var properties = VaryByParam.Split(",").ToList();
StringBuilder key = new StringBuilder();
foreach (var actionArgument in actionArguments.GetType().GetProperties())
{
if (!properties.Any(t => t.Trim().ToLower() == actionArgument.Name.ToLower()))
continue;
var value = actionArguments.GetType().GetProperty(actionArgument.Name).GetValue(actionArguments, null).ToString();
key.Append(value);
}
_properties.AddOrUpdate(key, 1, (x, y) => y + 1);
// rest of code
}
} 
public interface IUnitOfWork
{
IDbSet<TEntity> Set<TEntity>() where TEntity : class;
int SaveChanges();
void Update<TEntity>(TEntity entity) where TEntity : class;
}
public class MyContext : DbContext, IUnitOfWork
{
public void Update<TEntity>(TEntity entity) where TEntity : class
{
var fqen = GetEntityName<TEntity>();
object originalItem;
EntityKey key = (IObjectContextAdapter)this).ObjectContext.CreateEntityKey
(fqen, entity);
if (((IObjectContextAdapter)this).ObjectContext.TryGetObjectByKey(key, out
originalItem))
{
((IObjectContextAdapter)this).ObjectContext.ApplyCurrentValues
(key.EntitySetName, entity);
}
((IObjectContextAdapter)this).ObjectContext.ApplyCurrentValues
(key.EntitySetName, entity);
}
private string GetEntityName<TEntity>() where TEntity : class
{
return string.Format("{0}.{1}", ((IObjectContextAdapter)this).ObjectContext.
DefaultContainerName, _pluralizer.Pluralize(typeof(TEntity).Name));
}
#region IUnitOfWork Members
public new IDbSet<TEntity> Set<TEntity>() where TEntity : class
{
return base.Set<TEntity>();
}
#endregion
}public static bool IsUserAvailable(string username)
{'username':'value'}
public static string ToJson(this object data)
{
return new JavaScriptSerializer().Serialize(data);
}
public static string GetJsonTest0()
{
var data = "a1";
return data.ToJson();
}
public static string GetJsonTest1()
{
var data = new List<string> { "a1", "a2", "a3" };
return data.ToJson();
}
public static string GetJsonTest2()
{
var lst =
new List<KeyValuePair<string, object>>
{
new KeyValuePair<string, object>("Name", "علی"),
new KeyValuePair<string, object>("Number", 10),
new KeyValuePair<string, object>("Desc", "منابع مورد نیاز")
};
return lst.ToJson();
}
"a1"
["a1","a2","a3"]
[{"Key":"Name","Value":"علی"},{"Key":"Number","Value":10},{"Key":"Desc","Value":"منابع مورد نیاز"}]
