Only Bind certain properties of the navigation properties inside my action method - asp.net-mvc

Question

I have the following 2 model classes:-
public Submission()
{
SubmissionQuestionSubmission = new HashSet<SubmissionQuestionSubmission>();
}
public int Id { get; set; }
public string FirstName { get; set; }
public string LastName { get; set; }
public string Npi { get; set; }
public bool Independent { get; set; }
public string Comment { get; set; }
public virtual ICollection<SubmissionQuestionSubmission> SubmissionQuestionSubmission { get; set; }
}
public partial class SubmissionQuestionSubmission
{
public int SubmissionQuestionId { get; set; }
public int SubmissionId { get; set; }
public string Answer { get; set; }
public virtual Submission Submission { get; set; }
}
and i created the following view model:-
public class SubmissionCreate
{
public Submission Submission {set; get;}
public IList<SubmissionQuestion> SubmissionQuestion { set; get; }
public IList<SubmissionQuestionSubmission> SubmissionQuestionSubmission { set; get; }
}
then inside my view i only need to submit back the following fields:-
#model LandingPageFinal3.ViewModels.SubmissionCreate
<form asp-action="Create">
<div asp-validation-summary="ModelOnly" class="text-danger"></div>
<div class="form-group">
<label asp-for="Submission.FirstName" class="control-label"></label>
<input asp-for="Submission.FirstName" class="form-control" />
<span asp-validation-for="Submission.FirstName" class="text-danger"></span>
</div>
<div class="form-group">
<label asp-for="Submission.LastName" class="control-label"></label>
<input asp-for="Submission.LastName" class="form-control" />
<span asp-validation-for="Submission.LastName" class="text-danger"></span>
</div>
<div class="form-group">
<label asp-for="Submission.Npi" class="control-label"></label>
<input asp-for="Submission.Npi" class="form-control" />
<span asp-validation-for="Submission.Npi" class="text-danger"></span>
</div>
<div class="form-group form-check">
<label class="form-check-label">
<input class="form-check-input" asp-for="Submission.Independent" /> #Html.DisplayNameFor(model => model.Submission.Independent)
</label>
</div>
<div class="form-group">
<label asp-for="Submission.Comment" class="control-label"></label>
<textarea asp-for="Submission.Comment" class="form-control"></textarea>
<span asp-validation-for="Submission.Comment" class="text-danger"></span>
</div>
<div id="additionalInfo">
#for (var i = 0; i < Model.SubmissionQuestion.Count(); i++)
{
<label>#Model.SubmissionQuestion[i].Question</label><br />
<input asp-for="#Model.SubmissionQuestion[i].Question" hidden />
<textarea asp-for="#Model.SubmissionQuestionSubmission[i].Answer" class="form-control"></textarea>
<input asp-for="#Model.SubmissionQuestionSubmission[i].SubmissionQuestionId" hidden />
<br />
}
</div>
so i define the following binding inside my post action method, to only bind the fields inside my view, as follow:-
public async Task<IActionResult> Create([Bind(Submission.FirstName,Submission.LastName,Submission.Npi,Submission.Independent" +
"Submission.Comment,SubmissionQuestionSubmission.Answer,SubmissionQuestionSubmission.SubmissionQuestionId")] SubmissionCreate sc )
{
but the sc.Submission and the sc.SubmissionQuestionSubmission will be null inside my action method... so not sure what is the minimum binding i should define, to prevent hacking our application by posting back extra info and navigation properties other than the ones defined in my view?

Answer 1

You don't need to use bind to bind only the fields that appear in your view.
In fact, your view has set the name attribute for the fields you need to display, so
SubmissionCreate sc will only bind the corresponding fields in the view when accepting.
Just use this code to receive:
public async Task<IActionResult> Create(SubmissionCreate sc)
{
return View();
}
Update
Since you only bound some fields in the view, you only need to exclude the SubmissionQuestion field value：
public async Task<IActionResult> Create([Bind("Submission", "SubmissionQuestionSubmission")]SubmissionCreate sc)
{
return View();
}
If you want to be more precise, you can bind the fields you need to the Submission and SubmissionQuestionSubmission classes separately, as follows:
[Bind("FirstName,LastName,Npi,Independent,Comment")]
public class Submission
{
public Submission()
{
SubmissionQuestionSubmission = new HashSet<SubmissionQuestionSubmission>();
}
public int Id { get; set; }
public string FirstName { get; set; }
public string LastName { get; set; }
public string Npi { get; set; }
public bool Independent { get; set; }
public string Comment { get; set; }
public virtual ICollection<SubmissionQuestionSubmission> SubmissionQuestionSubmission { get; set; }
}
[Bind("Answer,SubmissionQuestionId")]
public partial class SubmissionQuestionSubmission
{
[Key]
public int SubmissionQuestionId { get; set; }
public int SubmissionId { get; set; }
public string Answer { get; set; }
public virtual Submission Submission { get; set; }
}