restrict ibnder to query, form and route

Models/Api/ModelBinder.cs

@@ -76,6 +76,23 @@ namespace NejCommon.Models
             _routeValues = routeValues;
         }
 
+        private static string? GetValue(ModelBindingContext context, string name)
+        {
+            // Route first
+            if (context.ActionContext.RouteData.Values.TryGetValue(name, out var routeValue))
+                return routeValue?.ToString();
+
+            // Then query string
+            if (context.HttpContext.Request.Query.TryGetValue(name, out var queryValue))
+                return queryValue.FirstOrDefault();
+
+            // Then form
+            if (context.HttpContext.Request.HasFormContentType  && context.HttpContext.Request.Form.TryGetValue(name, out var formValue))
+                return formValue.FirstOrDefault();
+
+            return null;
+        }
+
         public async Task BindModelAsync(ModelBindingContext bindingContext)
         {
             if (bindingContext == null)
@@ -100,17 +117,17 @@ namespace NejCommon.Models
                         ? bindingContext.ModelName
                         : routeValue.Name;
 
-                var result = bindingContext.ValueProvider.GetValue(name);
+                var result = GetValue(bindingContext, name);
                 // If these really are route values, don't go through the entire
                 // MVC ValueProvider infrastructure.
-                if (result == ValueProviderResult.None)
+                if (result == null)
                 {
                     bindingContext.ModelState.AddModelError(name, "Route value not found");
                     bindingContext.Result = ModelBindingResult.Failed();
                     return;
                 }
 
-                values[i] = result.FirstValue!;
+                values[i] = result;
             }
 
             // Check if all the required route values are present