界: Time and State

分布式计算是关于时间和状态的。也就是说,为了让多个组件相互通信,必须共享状态,所有这些都需要时间。

大多数程序员都会将其工作拟人化。他们会让一个控制线程以同样的方式(他们必须自己完成工作时采取的方式)执行整个程序。然而,现代计算机不同任务之间切换得非常快,在多核、多 CPU 或分布式系统中,两个事件可能完全同时发生。程序员预期的程序执行过程与实际情况之间存在差距,即存在缺陷。这些缺陷与线程、流程、时间和信息之间的意外交互有关。这些交互是通过共享状态发生的:信号量、变量、文件系统,以及总而言之,可以存储信息的任何内容。

ASP.NET Bad Practices: Non-Serializable Object Stored in Session

Abstract
把一个不可序列化的对象作为 HttpSessionState 属性来储存会破坏应用程序的可靠性。
Explanation
默认情况下,ASP.NET 服务器会存储 HttpSessionState 对象、其属性及其在内存中引用的任何对象。该模型将活动会话状态限制为只利用一台计算机的系统内存所能提供的资源。为了超越这些限制来扩展容量,要频繁地为服务器配置持久会话状态信息,这样不但可以扩展容量,还允许在多台机器上来回复制以提高整体性能。为了能够维持其会话状态,服务器必须对 HttpSessionState 对象进行序列化,这就要求存储在服务器中的所有对象都是可序列化的。

为了让会话能够正确地进行序列化,应用程序以会话属性形式存储的所有对象都必须声明 [Serializable] 属性。另外,如果对象需要用自定义的序列化方法,它还必须实施一个 ISerializable 接口。

例 1:下面这个类会把自己添加到会话中,但因为它是不可序列化的,因此会话也就不能正确序列化。


public class DataGlob {
String GlobName;
String GlobValue;

public void AddToSession(HttpSessionState session) {
session["glob"] = this;
}
}
References
[1] Session State Providers Microsoft Corporation
[2] Underpinnings of the Session State Implementation in ASP.NET Microsoft Corporation
[3] Standards Mapping - Common Weakness Enumeration CWE ID 579
[4] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls
[5] Standards Mapping - OWASP Top 10 2004 A3 Broken Authentication and Session Management
[6] Standards Mapping - OWASP Top 10 2007 A7 Broken Authentication and Session Management
[7] Standards Mapping - OWASP Top 10 2010 A3 Broken Authentication and Session Management
[8] Standards Mapping - OWASP Top 10 2013 A2 Broken Authentication and Session Management
[9] Standards Mapping - OWASP Top 10 2017 A2 Broken Authentication
[10] Standards Mapping - OWASP Top 10 2021 A04 Insecure Design
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.3
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.7
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.8
[14] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.10
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.10
[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.10
[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.10
[18] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[19] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection
[20] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection
[21] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection
desc.structural.dotnet.asp_dotnet_bad_practices_non_serializable_object_stored_in_session