Slides & Code: Securing your MVC site against Code Injection and X-Site Scripting

Here are the slides and code from yesterday's talk at Sydney ALT.NET.

See Steve Sanderson's post for the code/binary for subclassed aspx compiler and more information about the automatic encoding approach we covered in the talk.

26 08 2009

Windows / .NET Dev Tools

Recently I visited a .NET dev team to take a look at design, code and processes with a view to making recommendations to improve delivery speed. One of the more minor, but easily generalisable areas is around tooling. I often find that the little extra tools you pick up can make your work significantly more efficient. Here are a few free ones I use:

KDiff3
A brilliant merge tool that plugs nicely into TFS or SVN. SVN integration is automatic from the Kdiff3 installer. TFS integration is manual, but quite easy.

Console2
A tabbed console which works well with classic windows shell and powershell. Good support for resizing, copy paste, etc.

.NET Reflector
.NET decompiler for those dlls that don't have source. There is also a great plugin that lets you decompile entire assemblies to files on disk.

Fiddler
When you're debugging SOAP or RESTful web services, Fiddler is great. It lets you see the messages sent / received and even change and impersonate them.

QueryExpress
If you've got SQLExpress or just no tools installed, QueryExpress is a tiny (~100K) and quick query analyser style application for all breeds of MS SQLServer. Download in a few seconds, and be running queries before a minute is up.

Unlocker
Don't you hate it when Windows gets its locks in a mess and you can't delete/rename files? Unlocker will automatically pop up, show you which applications are holding file locks and let you release the locks.

Process Explorer
A more powerful and accurate Task Manager application which allows you to see file locks and many other types of information.

18 08 2009

Talk: Securing your MVC site against Code Injection and X-Site Scripting

I'll be giving a lightning talk on securing your ASP.NET MVC site against code injection and x-site scripting next Tuesday 25 August at the Sydney ALT.NET group. I'll be demonstrating potential pitfalls and dangers of arbitary code injection, and how you can protect against it, elegantly. We've got 6 interesting talks lined up for the night. See you there!

18 08 2009

Green & Red Local Builds (adding colour to the local build process)

build.JPGWell, who doesn't write tests and do continuous integration (CI) these days? Whether you use one of the many Cruise Control variants, or Team City or some other tool, you most likely get a handy colour coding of builds as either green or red (ie, good, or bad). But, you can take this a step further!

redbuild.JPGOften on .NET projects, we have a little batch file that we run before checking in (often with a pause at the end so it can be run from a shortcut), to confirm that no tests are broken locally. Well, it's not much fun peering at the ugly Nant output (or whatever build system you use). Instead, it is quite easy to add a couple of lines to your batch file and change the colour of the console to bright Red or bright Green depending on the success of the local build. It is great for telling what the result was at a glance. I can't claim credit the idea - it was something we used at EDI for our custom build system, but here's some batch file code I whipped up which I can claim is all mine, every last GOTO of it! Enjoy :-)

The following code uses NAnt, but you can replace it with MsBuild or any other build tool that returns a status code.

@echo off

color 07

tools\nant\NAnt.exe -buildfile:mybuild.build %*

IF ERRORLEVEL 1 goto RedBuild
IF ERRORLEVEL 0 goto GreenBuild

:RedBuild
color 4F
goto TheEnd

:GreenBuild
color 2F

:TheEnd
pause
20 11 2008

Slides from ACS REST Talk

Thanks to everyone who came along to the REST talk at ACS tonight. Here are the slides. They are quite a big download (10mb) as a result of all the images. When you review them, you might want to turn on the "Notes" view as I've added some text to go along with the image based slides.

1 10 2008

Sydney ALT.NET Launched & Ruby Slides

This evening we had the first Sydney Alt.Net meeting. It went really well. Our venue at the ThoughtWorks offices was pretty packed with about 35 interested people coming along. We started with a discussion of news in the .NET space, and then broke for food. After that we had my presentation on Ruby & Rails from a .NET perspective, followed by Richard's presentation on Rhino Mocks. We ended with a retrospective to gather feedback and thoughts for future meetings. Thanks to everyone for coming along and making it such a great night! And also a big thank you to ThoughtWorks for the venue, food and drink.

Here's the slides from "Ruby and Rails from a .NET perspective". It's a bit hard to give you a transcript of the demos but here is a taste of some of the ruby commands we looked at today.

Basic IronRuby Console demo

4+4
"hello".class
$friends = ["James", "Richard", "Bill"]
$friends.find_all { |f| f.include? "a" }
$friends.collect { |f| f.length }
"-" * 100
$person_type = Struct.new(:name, :age, :sex)
$j = person_type.new("James", 27, "m")

Iron Ruby Calling WinForms

require 'System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'
Form = System::Windows::Forms::Form
MessageBox = System::Windows::Forms::MessageBox
Button = System::Windows::Forms::Button 

$b = Button.new
$b.text = "Hello Button"
$f = Form.new
$f.controls << $b
$f.show_dialog

Simple Rails App Demo

rails myapp
ruby script/generate scaffold Person name:string age:integer
rake db:migrate
ruby script/server
30 09 2008

First Sydney ALT.NET Meeting on 30 Sept

Exciting news! We now have an ALT.NET group in Sydney! Our first meeting is Tuesday 30 September. Meetings will be the last Tuesday of the month.

Rough agenda for the first meeting is:

6:00pm   Meet & Greet time and then Kick Off!
6:30pm   "Ruby, Rails and IronRuby from a .NET perspective" (me).
7:00pm   Break with food and drink
7:30pm   "Mocking with Rhino Mocks 3.5" (Richard Banks).
8:00pm   Wrap up & go home.

ThoughtWorks is sponsoring the event with a nice office location in the CBD, and also pizza and beer. So if you're planning to come, please comment or send me or Richard Banks a mail to help us get enough food and drinks for everyone.

Address is:
Level 8, 51 Pitt Street
Sydney NSW 2000 Australia
[Map]

ALT.NET is about designing and building the best solutions possible. This means continuous improvement, retrospection and often reaching outside the mainstream, considering Open Source frameworks and tools, Agile methodologies and ideas from other language communities such as Ruby, Java and Haskell.

For more info about ALT.NET, check out our Sydney ALT.NET Blog, and the main ALT.NET wiki.

See you on the 30th!

11 09 2008

REST and .NET talk at ACS on 1 October

I'll be giving a talk at the ACS (in Sydney CBD) on 1 October, about REST, designing good RESTful systems and implementing them in .NET. It will be quite similar to the REST Patterns in .NET talk I gave at Tech Ed. For more information, please check out the blurb at the ACS site.

10 09 2008

Slides from Tech Ed “Rest Patterns and .NET” Talk

Here's the slides from "REST Patterns and .NET". I've put some extra info in the notes on various slides, so suggest browsing with notes displayed.

You might also be interested in more information about the talk or the simple rest client with code I mentioned during the presentation.

5 09 2008

Simple REST Client

While preparing for my upcoming REST talk, I made a basic REST client. It's nothing special but allows you to set the verb, request body and see the status code and all the headers on the response. It's quite handy for debugging and exploration of RESTful services.

Feel free to download the:

Hope it is useful and saves you having to whip up your own little client!

8 08 2008

Tech Ed Talk: REST Patterns and .NET

I'll be giving a talk at Tech Ed this year on REST and how it can be implemented in .NET, much inspired by the thoughts of Jim Webber on good RESTful web services, and Garr Reynolds on the "Zen" presentation style. Here's some more info:

REST Patterns and .NET

Sydney Convention Centre, Darling Harbour
5 September 2008
10:15am - 11:30am
(ARC306)

REST has sparked furious debate, and reactions from fan-boy adoration to hate. As the arguments quiet and the dust settles, it is becoming clear that the RESTful style is a viable choice for the Enterprise. Framework support is growing rapidly. WCF now provides basic REST support. Meanwhile, the budding MVC framework opens the door to building services which leverage hypermedia. This talk will leave you with an understanding of the RESTful architectural style and provide you with recommendations on designing and building both simple and hypermedia driven web services in .NET.

Hope to see you there!

7 08 2008

Bounded Actions Using Lambda - IDisposable is old and ugly!

In .NET 2, it was all the rage to make hand-crafted, clever IDisposables that let you do a bounded action with clean up. Eg,

void SomeMethod()
{
        using (new SetCursorToWaitEggTimer())
        {
            VerySlowOperation();
        }
}

void VerySlowOperation()
{
    ... etc ...
}

This was kind of cute - you could make sure that, even if an exception was thrown, your clean up (eg, changing cursor back to normal) would occur. Implementing the IDisposable was a bit ugly but consuming it wasn't bad.

Now, with the sexy C# 3 syntax, you can do something similar much more elegantly. Eg,

void SomeMethod()
{
       DoWithWaitEggTimer(VerySlowOperation);
}

void DoWithWaitEggTimer(Action action)
{
    try
    {
        Mouse.OverrideCursor = Cursors.Wait;
        action();
    }
    finally
    {
        Mouse.OverrideCursor = null;
    }
}

If you're feeling like more adventures, you can also start passing these delegates around and injecting them. For example:

class SomeClass
{
    public Action RunSlowCode
    {
    	get { return runSlowCode ?? new Action(a => a.Invoke()); }
    	set { runSlowCode = value; }
    }
    Action runSlowCode;

    void DoSomethingSlow()
    {
         RunSlowCode(PullDataFromExternalSystem);
    }
}

This approach allows you to inject the delegate for what happens when slow code is run. So you could inject DoWithWaitEggTimer() or something new like DoWithWaitMessageDisplayedToUser(). Similarly, it could be used for unit testing or injecting between layers in your application.

26 05 2008

C# Default Access Modifier for Class Members - and drop that private habit!

The default access modifier for the members of a C# class (eg, fields, methods, and properties) is 'private'. As such, I recommend never using the redundant 'private' keyword for class members. Leaving off the private nicely separates your privates from your public/inheritable interface in syntax highlighting. It also saves people having to read redundant code - you wouldn't want your code to be full of un-needed casts, or redundant 'this.' references, would you?

26 05 2008

WPF Control Inheritance With Generics

Working in WPF is quite exciting - there's a lot of new possibilities, especially with easy control composition, much improved binding and Expression Blend to make sexy interfaces. One of the things you're likely to want to do though, when writing anything more than a toy application, is to have a base class for your UserControls or Windows, to share common functionality. It is also quite likely you will want to use generics in conjunction with control inheritance. With both the code behind, and the XAML, it's not immediately obvious how to do generic inheritance. It is a bit fiddly to get going, and sometimes the errors are not helpful. Here's a simple example that outlines how to bring it together.


The base control

namespace WpfGenericsDemo
{
    public class BaseUserControl<T> : UserControl where T : IPresenter
    {
        public BaseUserControl()
        {
            ... various configurations ...
        }

         ... Awesome functionality to share ...
    }
}


The child control code-behind

namespace WpfGenericsDemo
{
    public partial class ChildUserControl : BaseUserControl<ChildPresenter>
    {
        public ChildUserControl()
        {
            InitializeComponent();
        }

         ... More code ...
    }
}


The child control XAML

<WpfGenericsDemo:BaseUserControl x:Class="WpfGenericsDemo.ChildUserControl"
    x:TypeArguments="WpfGenericsDemo:ChildPresenter"
    xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
    xmlns:WpfGenericsDemo="clr-namespace:WpfGenericsDemo">

    ... The rest of your awesome XAML ...

</WpfGenericsDemo:BaseUserControl>


Notes

  • Your top level node is the parent class of the control you want to create (eg, BaseUserControl). You specify the control class you want to create with 'x:class' (eg, ChildUserControl)
  • 'x:TypeArguments' is the way you specify the generic type (eg, ChildPresenter)
  • You need to namespace your classes - eg, with 'xmlns:WpfGenericsDemo' which uses a clr-namespace style reference
  • Only your top level node can be genericised in XAML

26 05 2008

NUnit Test Runners Were Not All Made Equal

NUnit tests can be run using a variety of different runners. Some common ones are:

The NUnit GUI and Test Driven create a new instance of the test class for each test run. This leads to more isolation but potentially slower performance.

Resharper and NUnit MSBuild Task re-use the same instance of the test class when running each test in the class. This can lead to unintended interaction between tests. Using these runners, it is vital to to assign initial values to instance variables in SetUp, rather than when they are defined or in the constructor.

If you use a mix of different test runners, you can end up with tests that pass on some machines and fail on others (eg, Test Driven locally works fine, but you use NUnit MSBuild Task on your build box and get intermittent failures).

8 04 2008