Security vulnerability created by ASP.NET MVC ModelBinder -

as ask in detail @ can spot security implications/vulnerability of small change asp.net mvc 3.0+ model binder? 1 of versions of cartmodelbinder class (shown below) allows exploitation via mvc modelbinding vulnerability (also called overposting)

can spot one?

ideally should provide answer/results/proof using unittests :)

version 1: using defaultmodelbinder , createmodel

public class cartmodelbinder : defaultmodelbinder {     private const string sessionkey = "cart";      protected override object createmodel(controllercontext controllercontext, modelbindingcontext bindingcontext, type modeltype)     {         // cart session         cart cart = (cart)controllercontext.httpcontext.session[sessionkey];         // create cart if there wasn't 1 in session data         if (cart == null)         {             cart = new cart();             controllercontext.httpcontext.session[sessionkey] = cart;         }         // return cart         return cart;     } } 

version 2: using imodelbinder , bindmodel

public class cartmodelbinder : imodelbinder {     private const string sessionkey = "cart";      public object bindmodel(controllercontext controllercontext,modelbindingcontext bindingcontext)     {          // cart session         cart cart = (cart)controllercontext.httpcontext.session[sessionkey];         // create cart if there wasn't 1 in session data         if (cart == null)         {             cart = new cart();             controllercontext.httpcontext.session[sessionkey] = cart;         }         // return cart         return cart;     } } 

controller example:

public redirecttorouteresult addtocart(cart cart, int productid, string returnurl) {     product product = repository.products         .firstordefault(p => p.productid == productid);      if (product != null)     {         cart.additem(product, 1);     }     return redirecttoaction("index", new { returnurl }); } 

your current design can misused suggested. better solution cart , use instance.

  public class cartcontroller : controller   {         private iproductrepository repository;         private iorderprocessor orderprocessor;         private cart;         public cartcontroller(iproductrepository repo, iorderprocessor proc)         {             repository = repo;             orderprocessor = proc;             cart = session["cart"]; // or cart.current         }          public redirecttorouteresult addtocart(int productid, string returnurl)         {             product product = repository.products                 .firstordefault(p => p.productid == productid);              if (product != null)             {                 cart.additem(product, 1);             }             return redirecttoaction("index", new { returnurl });         }    }