SQL injection exception when creating dynamic data store

Kenia Gonzalez

Vote:

Hello!

I'm trying to create a Dynamic Data Store in Episerver CMS6 to store number of visits to certain pages, but I'm getting the following exception:

Exception Details: System.ArgumentException: Contains potentially dangerous (SQL Injection) characters
Parameter name: storeName

My code looks like this:

protected List<ProjectVisits> GetProjectsVisitsInfo()
        {
            var store = DynamicDataStoreFactory.Instance.GetStore(typeof(ProjectVisits));

            if (store == null)
            {
                DynamicDataStoreFactory.Instance.CreateStore(typeof(ProjectVisits));
                return new List<ProjectVisits>();
            }

            return store.LoadAll<ProjectVisits>().ToList();

        }

public class ProjectVisits:IDynamicData
    {
        public string LinkURL { get; set; }
        public int NumberOfVisits { get; set; }
        public int PageID { get; set; }

        public EPiServer.Data.Identity Id
        {
            get;
            set;
        }
    }

The exception occurs specifically when I try to create the store. Any ideas?
Thanks!

/Kenia

#54549

Oct 20, 2011 11:40

Mark Everard

Vote:

The storeName will use the full namespace of your ProjectVisits class. Does this contain any special characters? I think that only characters a-z, 0-9, '.', and '_' are allowed for security reasons

#54551

Oct 20, 2011 13:10

Anders Hattestad

Vote:

Guess ProjectVisits is a class defined inside another class. That will mess up the namespace with _

just move the class outside and dont have any spesial characters in the namespace

#54556

Oct 20, 2011 14:04

Kenia Gonzalez

Vote:

Hello and thanks for your reply! I had invalid characters in the namespace, so I provided a name for the store and the problem was solved.

#54561

Oct 20, 2011 15:04