Spring cross site scripting XSS issues solution

XSS (Cross-site Scripting) is one of the most common vulnerabilities with a web-application. And, it can be exploited by hackers very easily without using any sophisticated tool.

How does it work?
Most web-applications have forms (text-box etc.) to receive input-data from user. So, a web-application may have a input-text-field to get 'user-id'. The hacker may enter anything in it including "JavaScript". If the hacker enters JavaScript (a malicious code), the server may process it, and then return it. In this case, user-id is not authenticated and it is sent as it is on the error page.

If the user's input data is returned as it is, the java-script code may execute. And, hacker wins!!

I am posting solution for Spring… 

In Spring-MVC, form-tags are used to create jsp page. Spring MVC provides multiple options to encode the html-escape-sequences on server side.

  • At global level, it can be defined in web.xml file. This will be applicable to entire application. All form-tags would refer to this definition. The sample code is shown below:

         <context-param>
            <param-name>defaultHtmlEscape</param-name>
            <param-value>true</param-value>
        </context-param>

  • At page level, it is defined as a tag-declaration. The code is:

          Any form-tag, after the above declaration uses html-escape-sequence-encoding.

          <spring:htmlEscape defaultHtmlEscape="true" />

  • Third option is to define it as attribute for each form-tag. For example, a input-text can be defined as :

          <form:input path="name" htmlEscape="true" />

           Depending upon requirement, it can be implemented as global, page or tag level.

I hope this information helps. Please do post your comments 🙂

How To: Read web/META-INF/MANIFEST.MF in Web Application

Hi All, 

As you all know In web application inside web directory there is a META-INF directory. Inside which we have MANIFEST.MF that holds version information. I have to read the MANIFEST.MF from this directrory. Need the manifest info for the purpose of build info and have to show in footer of each page. It's easy to read it in case of JAR file and while searching on net I got mostly examples on jar,classpath related Manifest. But my requirement was to read web/META-INF/MANIFEST.MF file.

So I am posting here what I done:

Inside web application then using the ServletContext.getResourceAsStream
method should work and same I used.

// for a Servlet, you can get the ServletContext like this
 ServletContext aContext = getServletConfig().getServletContext();
 InputStream inputStream = aContext.getResourceAsStream("/META-INF/MANIFEST.MF");

In Spring application do following inside controller:

//Build Info
ServletContext aContext= getServletContext();
InputStream fis =aContext.getResourceAsStream("/META-INF/MANIFEST.MF");

Hope this helps you 🙂 . Do post your comments

svnant: java.lang.NoClassDefFoundError: com/trilead/ssh2/InteractiveCallback

Today I was integrating svn with ant using svnant plugin. I encountered the error

java.lang.NoClassDefFoundError: com/trilead/ssh2/InteractiveCallback 

Basically I was operating on SSH layer so it needs a additional support for connecting to the server.

this is looking for trilead-ssh2-build213.zip that can be found  at following url

Link: http://www.trilead.com/Download/Trilead_SSH_for_Java/ 

How to Delete .SVN folders in Linux and Windows

Hi all,

Yesterday I got a code for study that was actually maintained inside Subversion. The code I get was not a exported copy of subversion, because of this I get a deep hierarchy of code included ".svn" folder in each folder. Now before start working with the code in eclipse it was mandatory for me to remove the .svn folders.

Below I am providing solution for both OS (windows/Linux) to remove these recursive ".svn" folders. Hope you will find helpful.

Do post your comments 🙂

Solution under Windows: 

Right click on the folder and click Search..

Enter .svn as the filename to search for.

Click “More advanced options” and select:

– Search hidden files and folders

– Search subfolders

Press search button and delete the folders you find appropriate. 

Solution under Linux/Unix: 

find ./ -name ".svn" | xargs rm -Rf 

or

find . -type d -name ‘.svn’ -print0 | xargs -0 rm -rdf 


Javascript – Add Float numbers upto 2 Decimal

Hi,

Today I was creating a page that is basically a calculator page have many text fields. All of them can accept number upto 2 decimal and onBlur() I have to total that numbers and display on the page

 <script language="JavaScript" type="text/javascript">

function something()
{
    var val = parseFloat('2.22') + parseFloat('3.33');
    val = parseInt( val * 100 ) / 100;
    alert(val)

}

</script>

it results 5.5500000000000001 but my expected result was 5.55

Continue reading “Javascript – Add Float numbers upto 2 Decimal”

Lucene 2.3 – working example of Indexer and Searcher

Hi All,

Now days I was working on Lucene a Java API that offers you search capability for your application.
Lucene is a powerful search library that lets you easily add search to any application. One of the key
factors behind Lucene’s popularity is its simplicity, but don’t let that fool you under the hood there are
sophisticated, state of the art Information Retrieval techniques quietly at work.

Current version available is 2.3.2.

The book i am referring for Lucene is Manning series "Lucene in Action ", but problem with this book is , this is handling Lucene 1.4 version that is entirely different from the latest one. There are many new syntax changes because of that you will no be able to run this books example with 2.3 Version.

I have modified its basic Indexer and Searcher example to run with latest version and posting here for your reference.

Indexer.java

This will create Index of directory provided by the user 

Continue reading “Lucene 2.3 – working example of Indexer and Searcher”

“Learning jQuery” Book review

Book review by Techcrony.info | Publisher: Packt. Author(s): Jonathan Chaffer and Karl Swedberg | Reviewed on: April 8th, 2008'


jQuery is a fast and concise JavaScript Library that simplifies HTML document traversing, event handling, animating, and Ajax interactions for rapid web development. jQuery is designed to change the way that you write JavaScript.

jQuery is one of at least a dozen JavaScript frameworks that have exploded onto the scene during the last few years, and for good reason. The Web 2.0 era has called upon JavaScript in a big way, turning to it as the driving force behind all the gliz and glamour that defines any Web 2.0 site. This huge increase in workload for JavaScript has called out for JavaScript frameworks that do the heavy lifting of common Web 2.0 tasks for us, from common visual effects such as fading, DOM traversal/ manipulation, to of course, Ajax interaction. jQuery has risen to become one of the most popular JavaScript framework due to its small footprint and focus on just the core tasks shared by almost any Web 2.0 project. A few books have sprung up to go beyond the jQuery documentation in explaining all that this framework has to offer, one of them being "Learning jQuery" (Packt Publishing).

"Learning jQuery" compliments the official jQuery documentation nicely, as its focus is on how to harness the power of jQuery to replace things you're used to do using raw JavaScript. The book is structured so that each chapter acts as a building block to the next, and requires no previous knowledge of jQuery to begin. The book's TOC is as follows:

Chapter 1: Getting Started
Chapter 2: Selectors–How to Get Anything You Want
Chapter 3: Events–How to Pull the Trigger
Chapter 4: Effects–How to Add Flair to Your Actions
Chapter 5: DOM Manipulation–How to Change Your Page on Command
Chapter 6: AJAX–How to Make Your Site Buzzword-Compliant
Chapter 7: Table Manipulation
Chapter 8: Forms with Function
Chapter 9: Shufflers and Rotators
Chapter 10: Plug-ins
Appendix A: Online Resources
Appendix B: Development Tools
Appendix C: JavaScript Closures

Chapter one quickly prepares you for the syntax conventions used by jQuery before opening the flood gates. Each chapter thereon examines a different area handled by "normal" JavaScript, and how that process can be simplified greatly using jQuery. One of the greatest strengths of jQuery lies in its DOM and elements traversal abilities, and in Chapter 2, the reader is shown how to turn their understanding of CSS and XPath Selectors as basis for actually accessing those elements, using jQuery. It also explains the concept of "chaining" in jQuery, or the ability to perform multiple actions on multiple elements all in one scoop. The sharp turn from introduction to getting straight to the heart of jQuery does mean you better have a firm grasp on JavaScript and CSS already before picking up this book, or you'll get lost very quickly. This is more of a praise than a criticism however- jQuery is what you're going to get with this book, nothing more (or less depending on how you see it).

In Chapter 3, the reader is shown how to attach and remove events to elements using jQuery, and how jQuery expedites things in terms of cross browser compatibility and more subtle issues like taking care of potential memory leaks in IE. Essential event related tasks like preventing event bubbling, event propagation, and cancelling default actions are also discussed within the context of using jQuery.

Chapter 4 looks at jQuery's built in abilities for rendering effects like element fading, sliding in/out, movement across the page etc. jQuery isn't exactly an effects centric library like MooTools, but there are still areas it covers that the jQuery documentation itself does a poor job of, such as the animate() method and how to queue effects.

Chapter 5 breaks down DOM and HTML manipulation using jQuery, a task that is currently quite tedious for the purists that go through the standard DOM methods on their own to accomplish. You'll learn things like using jQuery to insert new elements, move elements, copying and appending elements to the document
on demand.

In Chapter 6, "Learning jQuery" woes the Web 2.0 crowd by going into detail jQuery's Ajax abilities, and how it makes light work of common tasks such as performing GET/POST requests, fetching data as either JSON or XML and parsing it using jQuery. There are quite a few Ajax related methods in jQuery, some redundant IMO, and this chapter does start to lose focus by trying to cover too many of them, instead of limiting itself to just methods that do not overlap in function. Nonetheless, it's still better than the jQuery documentation, that's for sure.

Up until this point, all the chapters have been "building blocks" in nature, one paving the way to the next. However, starting in Chapter 7,  "Table Manipulation", breaks away from this roadmap and looks at common tasks of the day that can be simplified and enhanced using jQuery. There are additional jQuery tips you pick up as you read these chapters, though the focus now is more on the application rather than new techniques. Chapter 8 "Forms with Function" arguably has the most mass appeal, containing numerous examples that are manageable in size and somewhat self contained, from the obligatory required fields validation, checking for specific data types like numbers, currency etc, to Ajax infused forms.

The concept of "closures" in JavaScript is interwoven into every aspect of jQuery when it comes to its deployment, and to that end, the final section of this book, "Appendix C" provides a good tutorial on JavaScript closures. It's a fitting and nice conclusion to a great book.

There currently aren't many other jQuery books to compare "Learning jQuery" to, but it really doesn't matter. If you're new to jQuery or JavaScript frameworks in general yet aren't new to JavaScript itself, it's hard to go wrong with picking up "Learning jQuery" to learn jQuery.

Reference:

1) Learning jQuery by Packt Publishing

2) Learning jQuery Blog

Javascript: Member Not found

I was using the following code to open the pdf files using popup. 

User come to a page that has 2 links that open with the below function. both opens a  pdf. If the user clicks the pdf link and then minimizes it and then clicks the other link  the Member not found error generates.

WRONG 

function popUp(strURL, strType, strWidth, strHeight, winName, leftPos, topPos) {
    var strOptions="";
    if (strType=="nocontrols") {
        strOptions="scrollbars,resizable,height="+ strHeight+",width="+strWidth+",left="+leftPos+",top="+topPos;
    }
    if (strType=="controls") {
        strOptions="toolbar,menubar,location,scrollbars,resizable,height="+strHeight+",width="+strWidth+",left="+leftPos+",top="+topPos;
    }
  var   newWin = window.open(strURL, winName, strOptions);   

newWin.focus() 

 The problem was when the window opens it lost is reference & parent window throws the error use the following modified code to resolve this issue.

 RIGHT

var newWin;
function popUp(strURL, strType, strWidth, strHeight, winName, leftPos, topPos) {
    var strOptions="";
    if (strType=="nocontrols") {
        strOptions="scrollbars,resizable,height="+ strHeight+",width="+strWidth+",left="+leftPos+",top="+topPos;
    }
    if (strType=="controls") {
        strOptions="toolbar,menubar,location,scrollbars,resizable,height="+strHeight+",width="+strWidth+",left="+leftPos+",top="+topPos;
    }
    newWin = window.open("", winName, strOptions);
    newWin.close();
    newWin = window.open(strURL, winName, strOptions);
    if (window.focus)
    {
    newWin.focus()
    }
}

 

org.apache.tomcat.dbcp.dbcp.SQLNestedException: Cannot load JDBC driver class ‘org.hsqldb.jdbcDriver’

Problem 

org.apache.tomcat.dbcp.dbcp.SQLNestedException: Cannot load JDBC driver class 'org.hsqldb.jdbcDriver'
    at org.apache.tomcat.dbcp.dbcp.BasicDataSource.createDataSource(BasicDataSource.java:766)
    at org.apache.tomcat.dbcp.dbcp.BasicDataSource.getConnection(BasicDataSource.java:540)
    at org.springframework.orm.hibernate3.LocalDataSourceConnectionProvider.getConnection(LocalDataSourceConnectionProvider.java:81)
    at org.hibernate.cfg.SettingsFactory.buildSettings(SettingsFactory.java:84)
    at org.hibernate.cfg.Configuration.buildSettings(Configuration.java:2009)
    at org.hibernate.cfg.Configuration.buildSessionFactory(Configuration.java:1292)
    at org.springframework.orm.hibernate3.LocalSessionFactoryBean.newSessionFactory(LocalSessionFactoryBean.java:805)
    at org.springframework.orm.hibernate3.LocalSessionFactoryBean.buildSessionFactory(LocalSessionFactoryBean.java:745)
    at org.springframework.orm.hibernate3.AbstractSessionFactoryBean.afterPropertiesSet(AbstractSessionFactoryBean.java:134)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1143)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1110)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:431)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:254)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:144)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:251)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:163)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:271)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:128)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyPropertyValues(AbstractAutowireCapableBeanFactory.java:1047)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:843)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:427)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:254)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:144)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:251)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:163)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:271)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:128)
Caused by: java.lang.ClassNotFoundException: org.hsqldb.jdbcDriver
    at java.net.URLClassLoader$1.run(URLClassLoader.java:199)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.net.URLClassLoader.findClass(URLClassLoader.java:187)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:289)
    at java.lang.ClassLoader.loadClass(ClassLoader.java:235)
    at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:302)
    at java.lang.Class.forName0(Native Method)
    at java.lang.Class.forName(Class.java:141)
    at org.apache.tomcat.dbcp.dbcp.BasicDataSource.createDataSource(BasicDataSource.java:760)

Solution 

 Tomcat is unable to find the hsqldb.jar please put this inside "tomcat\common\lib" directory.

& your problem is solved my friend 🙂  . 

Ant within Eclipse: switching JDKs and finding tools.jar – com.sun.tools.javac.Main is not on the classpath.

I've been doing quite a lot of work creating new Ant build processes and grokking Eclipse (installing and reinstalling on different machines), and this is a problem that keeps recurring. This morning I cleaned up vast amounts of garbage on my main Windows machine, garbage left over from old J2SDK installs (I had FOUR–when will Sun fix the install problem?) and I reinstalled JDK 1.4.2_03 and then tried running everything again within Eclipse (v3.0 M7). Needless to say, Ant was running fine before, after I had pointed to tools.jar but now that I had changed JDKs it wasn't guaranteed that it would run–and it didn't. While it is possible that this is so well known that people do it without thinking, it certainly isn't clearly documented, and it's a situation that people will probably find regularly doing a clean install of Eclipse and the JDK on a machine, or when upgrading JDKs after the settings have been done long ago–and forgotten. 🙂

First, the situation. On restart, Eclipse correctly detected the new JRE (clearly from the registry entries created by the JDK/JRE install) to the one the JSDK installs in C:\Program Files\Java\… but it's better to change the pointer to the JRE within the JDK IMO. Even then, Ant doesn't work. The error message you get is for Ant:

[javac] BUILD FAILED: [build file location here]
Unable to find a javac compiler;
com.sun.tools.javac.Main is not on the classpath.
Perhaps JAVA_HOME does not point to the JDK

Of course, JAVA_HOME is pointing to the right location, in both the OS environment and within Eclipse (This variable can be set within Eclipse through Window > Preferences > Java > Classpath Variables).

So how to fix the Ant build problem?

I found various solutions searching, for example running Eclipse with "eclipse -vm [JDKPATH]\bin" but that didn't quite satisfy me (I wanted something that could be configured within the environment). Other solutions to the problem where even more esoteric.

The best solution I've found (after a little bit of digging through Eclipse's options) is to edit Ant's runtime properties. Go to Window > Preferences > Ant > Runtime. Choose the Classpath tab. Select the Global Properties node in the tree and click Add External JARs. Select tools.jar from your JDK directory (e.g., j2sdk1.4.2_03\lib\tools.jar). Click Apply and OK, and you should be on your way. Not too hard when you know what to do. Now if this could only be done automatically by Eclipse on install…