Ozzie.eu

The evolution of information systems places more and more applications on web-based architectures. The concern with security on this type of systems has to evolve also. Any programmer familiar with Web development is a potential script kiddie. The task of corrupting, destroying or getting illicit access to data cannot be facilitated.

There is a series of guides on Microsoft Developer's Network, on how to protect an ASP.NET application against injection attacks. The guides are pretty straightforward, giving a brief notion of the attacks and also the counter measures one can adopt to prevent them:

• How To: Protect From Injection Attacks in ASP.NET


• How To: Protect From SQL Injection in ASP.NET


• How To: Prevent Cross-Site Scripting in ASP.NET


• How To: Use Regular Expressions to Constrain Input in ASP.NET

Even if you have already deployed applications, it's very well worth it to spend some time analyzing them and integrating the security enhancements explained. Better safe than sorry.

Sometimes, to insure a service's quality stated on a Service Level Agreement, one has to do interventions on the systems at any given hour of the day. Even late at night, or on holidays.

Given the possibility of connecting to my Workplace´s network through VPN, I faced the challenge of configuring a VPN network client on Ubuntu Linux (9.10). Our communications staff had a ready to use setup for Windows, but that didn't help much. So I took the exported Cisco PCF file and got engaged on this task.

Overall, it wasn't as tricky as I would expect. I performed the following steps:

1. Open the Synaptic Package Manager


2. Selected the following packages: vpnc, network-manager-vpnc, KVpnc


3. Apply the changes

Having finished the installation:

1. Go to the Application menu, select Internet/KVpnc


2. Start the new connection wizard and import the pcf file


3. Save your new profile


4. Connect and ... that's it!

I tried to import the pcf file directly, without using the wizard and it didn't work. Anyway, when your VPN connection is active, open a terminal window and run the command "ifconfig". Your VPN tunnel should be listed on the active connections.

I had a most unusual problem after updating my laptop to Windows 7. The purpose of a laptop is really to move around so I usually take it from my workplace and use it at home, carrying it back on the next day.

I found out that, whenever I booted up the machine before plugging the network cable in, my network adapter vanished from the notification area as well as the Network and Sharing Center. A reboot, with the cable already plugged in, solved this little annoyance.

But, sometimes, the problem has it source between the computer and the chair. I was not aware of a nice feature on Power Management that allows the computer to turn off a device to save power.



So I just had to take the check off the turning off option and the situation ceased to occur. Maybe someday I'll put it back on ;)

Having to work with servers, which connect to external systems via private networks, one must face the difficulty of having to test Web services without having direct access to the endpoint of them. Given that, and adding the Linux operating system, one could find himself in a jam.

There is a command I use often to perform simple connectivity tests, like getting the WSDL. It's called "wget". You just type "wget http://someurl/endpoint" and an HTTP request to that URL is sent and the response is captured ans saved to file.

Nevertheless, one might be able to connect to the remote server, but what id you want to check if the service is really working? Otherwise you'll never know if an error is caused by your end of the stick.

To post a SOAP request to a remote Web server, the recipe is simple:

1. Build a sample SOAP request and save it on a text file, maybe called "soap.txt"


2. To send the request to the remote server type the following command:

 

curl -H "Content-Type: text/xml; charset=utf-8" \
-H "SOAPAction:" \
-d @soap.txt -X POST http://someurl

That's it! 

 

Trying to automatically update my Windows XP, I got a crash from my browser, every single time, while trying to install the automatic updates ActiveX control.

The solution is to go to: Tools / Internet Options / Advanced / Security. Take the check off the "Enable memory protection to help mitigate online attacks" option.

I've been fiddling with Netbeans 6.5 and Java EE 5 in order to keep up to date with some of the trends in web development on a JEE architecture. When trying to perform a tutorial on the Netbeans DVD Starter Kit, with JSF and Data bounded controls and I found myself having a problem.

I followed the tutorial's steps (enumerated below, give or take a step):

1. Add the database connection to the IDE


2. Create a new project for a JSF Web Application


3. Add a Drop-down control from the Woodstock control palette


4. Add a property attribute for the control


5. Drag & drop the the database table onto the control to perform the data binding


6. Configure the Key/Value field on the drop-down

Executing the above using the JavaDB samples bundled with the IDE performed surprisingly OK, right on the first compilation and execution. However, when I performed the above steps for a neat Oracle 11g database, the Cached Row Set did not work properly and the data binding window did not display the fields available.

Searching on the Web, I found this page about Netbeans and JDBC drivers. So my first lead was the JDBC driver. I changed the driver to be used and reconfigured the connection (I was using JDBC4 and changed it to JDBC3). Tried it and still no luck.

I copied the referred jdbc url to the Service Tab on Netbeans and established the connection. But It still did not work. But something told me it should be the connection string, so I checked the web.xml file for the application and it pointed to lookups on a resource file. I edited the resource file and found the problem: the changes made on the services tab are not refactored on the application.

In conclusion, I edited the resource file, saved it and the second time around the data bind operation worked perfectly!

Nevertheless, I made an identical page using JSTL and the performance was much better. I found that JSF carries some overhead, undesired when performance is essencial.

When maintaining a live system, sometimes one must undo a committed transaction on the database. In other words, delete some records and their trails.

A difficulty that sometimes arises on complex relational models, with cascade deletion disabled, is to find out what records on other data tables are pointing to the ones I want to erase.

On Oracle, to find out which tables have a foreign key that points to the primary key of the records we want to delete, one just issue the command:

select * from ALL_CONSTRAINTS where R_CONSTRAINT_NAME = '[Your PK constraint name]'

This statement returns as a result the tables that have a foreign key constraint pointing to the targeted table's primary key.