Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
YouTube Security VideosGoogle Cloud Tech: Gemini is coming to your city(24.09.2026 um 15:00 Uhr)
AI & KI NachrichtenGoogle’s latest moonshot to put machine learning in space(24.09.2026 um 15:12 Uhr)
Windows Tipps & SecurityPoll: What's your favorite Surface of 2026?(24.09.2026 um 14:58 Uhr)
Sichere ProgrammierungStreaming Materialized Views for Live Read Models (2026)(24.09.2026 um 15:02 Uhr)
Sichere ProgrammierungA Day Is Not 86400 Seconds: The DST Bug in Your Date Math(24.09.2026 um 15:02 Uhr)
Sichere ProgrammierungSetting up Traefik: reverse proxy with automatic HTTPS(24.09.2026 um 15:02 Uhr)
Sichere ProgrammierungA 200 OK response does not prove a secret leak(24.09.2026 um 15:02 Uhr)
Sichere ProgrammierungHow hot do you like it?(24.09.2026 um 15:05 Uhr)
YouTube Security VideosGoogle Cloud Tech: Gemini is coming to your city(24.09.2026 um 15:00 Uhr)
AI & KI NachrichtenGoogle’s latest moonshot to put machine learning in space(24.09.2026 um 15:12 Uhr)
Windows Tipps & SecurityPoll: What's your favorite Surface of 2026?(24.09.2026 um 14:58 Uhr)
Sichere ProgrammierungStreaming Materialized Views for Live Read Models (2026)(24.09.2026 um 15:02 Uhr)
Sichere ProgrammierungA Day Is Not 86400 Seconds: The DST Bug in Your Date Math(24.09.2026 um 15:02 Uhr)
Sichere ProgrammierungSetting up Traefik: reverse proxy with automatic HTTPS(24.09.2026 um 15:02 Uhr)
Sichere ProgrammierungA 200 OK response does not prove a secret leak(24.09.2026 um 15:02 Uhr)
Sichere ProgrammierungHow hot do you like it?(24.09.2026 um 15:05 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

Don't mutate CommandText in an EF Core interceptor (a mistake I shipped)

For about a year, my debugging tool crashed the instant anyone pointed it at SQLite. I had no idea, because I only ever ran it against SQL Server. Nobody opened an issue either, which tells you roughly how many people were using it. Here's…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

For about a year, my debugging tool crashed the instant anyone pointed it at SQLite. I had no idea, because I only ever ran it against SQL Server. Nobody opened an issue either, which tells you roughly how many people were using it. Here's the bug, because it's an easy one to ship and I doubt I'm alone.



The tool records the SQL that EF Core runs (among other things) and shows it in a dashboard. To do that it uses a DbCommandInterceptor, and I wanted each query's execution time. The way I got it was bad enough that I'll just show you:




public override InterceptionResult<DbDataReader> ReaderExecuting(
DbCommand command, CommandEventData eventData, InterceptionResult<DbDataReader> result)
{
var id = Guid.NewGuid();
command.CommandText += $" /* {id}:{DateTime.UtcNow.Ticks} */";
return result;
}






On the way in, glue a comment with an id and a timestamp onto the SQL. On the way out, in ReaderExecuted, parse that comment back off the command text and subtract to get the elapsed time. A little correlation system, smuggled through the query string.



Yeah.



The first problem is that this changes the SQL you send to the database. Every query left with a /* ... */ tail on it. SQL Server shrugs and runs it, which is the whole reason I never noticed, but now the database's own query logging is full of my garbage and I'm writing to something that isn't mine to write to.



The second problem is the one that actually broke. Rewriting CommandText after the command has run, while its reader is still open, throws on SQLite:




System.InvalidOperationException: An open reader is associated with this
command. Close it before changing the CommandText property.






SQLite in local dev is completely normal. So instead of a dashboard, those people got an exception thrown from inside the tool that was supposed to be helping them debug. Great look.



Now the part that stings. I built that whole id-in-a-comment contraption to carry one number from ReaderExecuting to ReaderExecuted. I never needed to. ReaderExecuted already hands you the duration, and the command, and everything else:




public override DbDataReader ReaderExecuted(
DbCommand command, CommandExecutedEventData eventData, DbDataReader result)
{
Record(command.CommandText, eventData.Duration);
return result;
}






CommandExecutedEventData.Duration is a TimeSpan that EF measured for me. The command is right there too. There was nothing to correlate, because both halves of what I wanted live in the same callback. I'd written a solution to a problem the API had already solved, and that solution happened to corrupt SQL and crash SQLite on its way past.



If you genuinely do need to carry state from executing to executed (something that's only available before the command runs, say), there's a stable handle for that too. eventData.CommandId is the same Guid across both calls. Key your own dictionary off it and leave the SQL alone:




private readonly ConcurrentDictionary<Guid, MyState> _inflight = new();

public override InterceptionResult<DbDataReader> ReaderExecuting(
DbCommand command, CommandEventData eventData, InterceptionResult<DbDataReader> result)
{
_inflight[eventData.CommandId] = CaptureWhateverYouNeed();
return result;
}

public override DbDataReader ReaderExecuted(
DbCommand command, CommandExecutedEventData eventData, DbDataReader result)
{
_inflight.TryRemove(eventData.CommandId, out var state);
// use state + eventData.Duration here
return result;
}






The command object is for reading. Whatever you want to stash, stash it on your side.



I rebuilt the tool around the boring one-liner and shipped 2.0. MIT, .NET 8/9/10, two lines to wire up, then you open /_debug and get your requests, the SQL with real parameter values, logs, exceptions, and an N+1 nag when one request fires the same query over and over. Demo gif and setup in the readme: https://github.com/eladser/AspNetDebugDashboard



If you write interceptors, go look at yours and make sure they're not doing something clever to the command text. Mine looked fine for a year.

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Remote Code Execution (RCE) Defense
title: Detect Exploitation - Don't mutate CommandText in an EF Core interceptor (a mistake I shipped)
id: 03cb3b22-f065-4772-8496-991505983bd3
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Don\'t mutate CommandText in an" ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Don&#039;t mutate CommandText in an EF Core i.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Don't mutate CommandText in an EF Core interceptor (a mistake I shipped)

Thematisch verwandte Begriffe: Dont, mutate, CommandText, Core · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-97179 | A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. T…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick