Azure Search中防范筛选器类SQL注入漏洞的技术咨询

Great question—this is a super common pitfall when building filters manually, but Azure Search has dedicated features to avoid exactly this kind of injection risk, just like parameterized queries in SQL. Here are the two most reliable approaches to fix your code:

1. Use Parameterized Filters #

Instead of concatenating user input directly into your filter string, use parameterized placeholders and let Azure Search handle value substitution safely. This ensures malicious input is treated as a literal string, not part of the OData filter expression.

Modified Code Example #

public SearchParameters CreateWithFilter(string fieldName, string op, string value)
{
    // Use a placeholder (@value) instead of embedding raw user input
    var filterString = $"{fieldName} {op} @value";
    
    return new SearchParameters
    {
        Filter = filterString,
        // Map the placeholder to the actual value—Azure Search auto-handles escaping
        FilterParameters = new Dictionary<string, object>
        {
            { "@value", value }
        }
    };
}

Even if someone passes a malicious value like volvo' or someField eq 1 or manufacturer eq 'volvo, Azure Search will treat it as a single literal string for the filter, not execute the injected OData logic.

2. Use Strongly-Typed Filter Constructors (Recommended) #

For maximum safety and readability, use Azure Search SDK's built-in Filter class static methods to build filters programmatically. This completely eliminates manual string concatenation, so injection risks can't happen at all.

Code Example #

public SearchParameters CreateWithFilter(string fieldName, string op, string value)
{
    Filter filter;
    switch(op.ToLowerInvariant())
    {
        case "eq":
            filter = Filter.Equal(fieldName, value);
            break;
        case "ne":
            filter = Filter.NotEqual(fieldName, value);
            break;
        case "gt":
            filter = Filter.GreaterThan(fieldName, value);
            break;
        case "lt":
            filter = Filter.LessThan(fieldName, value);
            break;
        // Add more cases for operators you need to support
        default:
            throw new ArgumentOutOfRangeException(nameof(op), "Unsupported filter operator");
    }
    
    return new SearchParameters { Filter = filter.ToString() };
}

The SDK handles all escaping and formatting behind the scenes, so you don't have to worry about edge cases or malicious input. This is the most robust approach recommended by Azure.

Key Takeaway #

Avoid manual filter string concatenation entirely. Both parameterized filters and strongly-typed constructors are purpose-built to prevent injection attacks in Azure Search, just like parameterized queries protect against SQL injection.

内容的提问来源于stack exchange，提问作者Tomasz Madeyski