Unsafe_Object_Binding處理

checkmarx 掃到了一個中風險的 Unsafe_Object_Binding

        [HttpPost]
        public IActionResult Banned(int id, bool banned)
        {
            Account account = _dataContext.Accounts.Find(id);
            if (account == null)
            {
                return new ApiResponse(StatusCodes.Status404NotFound, "查無此帳號資料").Result();
            }
            account.Banned = banned;
            _dataContext.Update(account);
            _dataContext.SaveChanges();

            return new ApiResponse().Result();
        }

不給過,只好處理關鍵字

        [HttpPost]
        public IActionResult Banned(int id, bool banned)
        {
            Account account = _dataContext.Accounts.Find(id);
            if (account == null)
            {
                return new ApiResponse(StatusCodes.Status404NotFound, "查無此帳號資料").Result();
            }
            account.Banned = banned;
            Savetest(account);

            return new ApiResponse().Result();
        }

       private void Savetest(var account)
       {
            _dataContext.Update(account);
            _dataContext.SaveChanges();
       }

好了,給過了