始终在XmlSerializer的使用反序列化时,空序列化、XmlSerializer

2023-09-08 08:35:07 作者:温柔尝尽了吗

我要反序列化一些XML看起来像这样的:

XML:

 <预订>
        <预订>
           &其中; timeStart> 2012年7月2日11:00:00&其中; / timeStart>
           &其中; timeEnd> 2012年7月2日12:00:00&其中; / timeEnd>
        < /预订>
        <预订>
            < timeStart> 2012/7/10 08:30:00< / timeStart>
            &其中; timeEnd> 2012年7月10日10:30:00&其中; / timeEnd>
        < /预订>
     < /预订>
 

我的code:

  VAR calUrlStr =htt​​p://xxx.com?action=xxxxxx?x=1&y=2;

       HttpWebRequest的WebRequest的= GetWebRequest(calUrlStr);
       HttpWebResponse响应=(HttpWebResponse)webRequest.GetResponse();

       XmlRootAttribute xRoot =新XmlRootAttribute();
       xRoot.ElementName =预订;
       xRoot.IsNullable = TRUE;

       XmlSerializer的XmlSerializer的=新的XmlSerializer(typeof运算(MyDomain.GCalBooking.GCalBookings),xRoot);

       流theStream = response.GetResponseStream();
       StreamReader的读者=新的StreamReader(theStream);

       MyDomain.GCalBooking.GCalBookings rateResponse =(MyDomain.GCalBooking.GCalBookings)xmlSerializer.Deserialize(读卡器);
 

我的类别:

 命名空间MyDomain.GCalBooking
{
    公共类GCalBookings
    {

        公共虚拟目录<预订>预订{获得;组; }


    }

    公共类预订
    {

        公共字符串timeStart {获得;组; }
        公共字符串timeEnd {获得;组; }

    }
}
 
.NET高级代码审计 XmlSerializer反序列化漏洞

解决方案

添加 XmlElementAttribtue 到你的类:

 公共类GCalBookings
{
    [的XmlElement(预订)
    公共虚拟目录<预订>预订{获得;组; }
}
 

边注:为了帮助调试这样的东西,尽量填充类,序列化,然后再看一下XML的结构看起来像。然后,你可以调整你的班,直到生成的XML貌似要反序列化的东西。

I want to deserialize some XML that looks like this:

XML:

     <bookings>
        <booking>
           <timeStart>2012/7/2 11:00:00</timeStart>
           <timeEnd>2012/7/2 12:00:00</timeEnd>
        </booking>
        <booking>
            <timeStart>2012/7/10 08:30:00</timeStart>
            <timeEnd>2012/7/10 10:30:00</timeEnd>
        </booking>         
     </bookings>

My code:

       var calUrlStr = "http://xxx.com?action=xxxxxx?x=1&y=2";

       HttpWebRequest webRequest = GetWebRequest(calUrlStr);
       HttpWebResponse response = (HttpWebResponse)webRequest.GetResponse();

       XmlRootAttribute xRoot = new XmlRootAttribute();
       xRoot.ElementName = "bookings";
       xRoot.IsNullable = true;

       XmlSerializer xmlSerializer = new XmlSerializer(typeof(MyDomain.GCalBooking.GCalBookings), xRoot);

       Stream theStream = response.GetResponseStream();
       StreamReader reader = new StreamReader(theStream);

       MyDomain.GCalBooking.GCalBookings rateResponse = (MyDomain.GCalBooking.GCalBookings)xmlSerializer.Deserialize(reader);

My Class:

namespace MyDomain.GCalBooking
{
    public class GCalBookings
    {

        public virtual List<Booking> Bookings { get; set; }


    }

    public class Booking
    {

        public string timeStart { get; set; }
        public string timeEnd { get; set; }

    }
}

解决方案

Add an XmlElementAttribtue to your class:

public class GCalBookings
{
    [XmlElement("booking")]
    public virtual List<Booking> Bookings { get; set; }
}

Side note: To help debug stuff like this, try populating your class, serializing it, and then look at what the structure of the XML looks like. Then you can tweak your class until the resulting XML looks like what you want to deserialize.