Merge pull request #24175 from brunolins16/brunolins16/collections-binding-index-alert

Collections model binding "index" parameter warning
pull/24206/head
Bruno Oliveira 2021-12-06 11:06:05 -08:00 committed by GitHub
commit ea7b247ecf
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 1 deletions

View File

@ -342,7 +342,15 @@ For targets that are collections of simple types, model binding looks for matche
[a]=1050&[b]=2000&index=a&index=b
```
* The following format is supported only in form data:
Avoid binding a parameter or a property named `index` or `Index` if it is adjacent to a collection value. Model binding attempts to use `index` as the index for the collection which might result in incorrect binding. For example, consider the following action:
```csharp
public IActionResult Post(string index, List<Product> products)
```
In the preceding code, the `index` query string parameter binds to the `index` method parameter and also is used to bind the product collection. Renaming the `index` parameter or using a model binding attribute to configure binding avoids this issue:
```csharp
public IActionResult Post(string productIndex, List<Product> products)
```
```
selectedCourses[]=1050&selectedCourses[]=2000
@ -967,6 +975,18 @@ For targets that are collections of simple types, model binding looks for matche
[a]=1050&[b]=2000&index=a&index=b
```
Avoid binding a parameter or a property named `index` or `Index` if it is adjacent to a collection value. Model binding attempts to use `index` as the index for the collection which might result in incorrect binding. For example, consider the following action:
```csharp
public IActionResult Post(string index, List<Product> products)
```
In the preceding code, the `index` query string parameter binds to the `index` method parameter and also is used to bind the product collection. Renaming the `index` parameter or using a model binding attribute to configure binding avoids this issue:
```csharp
public IActionResult Post(string productIndex, List<Product> products)
```
* The following format is supported only in form data:
```