So far, in my research I have seen that it is unwise to set AllowUnsafeUpdates on GET request operation. But, if this is required, what is the proper way to handle the situation to mitigate any exposure?
//Best Practice?
// NOTE: should the base OnLoad be called before or after this?
protected override void OnLoad(System.EventArgs e)
{
if(Request.HttpMethod == "POST")
{
SPUtility.ValidateFormDigest(); //will automatically set AllowSafeUpdates to true
}
// If not a POST then AllowUnsafeUpdates should be used only at the point of update and reset immediately after finished
//NOTE: Is this true? How is cross-site scripting used on GET and what mitigates the vulnerability?
}
//point of item update
SPSecurity.RunWithElevatedPrivledges(delegate()
{
using(SPSite site = new SPSite(SPContext.Current.Site.Url))
{
using (SPWeb web = site.RootWeb)
{
bool allowUpdates = web.AllowUnsafeUpdates;
web.AllowUnsafeUpdates = true;
... Do something and call Update() ...
web.AllowUnsafeUpdates = allowUpdates;
}
}
});
Feedback on the best pattern is appreciated.