SafeCriteriaValidator class
namespace: Serenity.Data assembly: Serenity.Net.Services
Validates a criteria for allowed field names, operators and SQL injection safety
public class SafeCriteriaValidator : BaseCriteriaVisitor
Public Members
| name | description |
|---|---|
| SafeCriteriaValidator() | The default constructor. |
| Validate(…) | Validates the specified criteria. |
Protected Members
| name | description |
|---|---|
| override VisitCriteria(…) | Visits the criteria, returning a potentially reworked version. |
| override VisitFunctionCall(…) | Visits an allowed function call criteria. |
| override VisitParam(…) | Visits the parameter criteria. A parameter criteria is just a parameter name. |
| override VisitValue(…) | Visits the value criteria. |
Remarks
This validator is intended for criteria supplied by clients, such as criteria deserialized from a ListRequest. A criteria instance does not indicate whether it came from JSON or was constructed by application code, so the same restrictions apply in either case. This is not a validator for every criteria expression the framework can generate: aliases (e.g. T0.Name), quoted identifiers, and free-form expressions such as 1=1 are intentionally rejected, even when they are otherwise valid framework criteria.
See Also
- class BaseCriteriaVisitor
- Source: SafeCriteriaValidator.cs