Software dev, tech, mind hacks and the occasional personal bit

Category: C# Page 2 of 4

Slides & Code: Securing your MVC site against Code Injection and X-Site Scripting

Here are the slides and code from yesterday’s talk at Sydney ALT.NET.

See Steve Sanderson’s post for the code/binary for subclassed aspx compiler and more information about the automatic encoding approach we covered in the talk.

Windows / .NET Dev Tools

Recently I visited a .NET dev team to take a look at design, code and processes with a view to making recommendations to improve delivery speed. One of the more minor, but easily generalisable areas is around tooling. I often find that the little extra tools you pick up can make your work significantly more efficient. Here are a few free ones I use:

KDiff3
A brilliant merge tool that plugs nicely into TFS or SVN. SVN integration is automatic from the Kdiff3 installer. TFS integration is manual, but quite easy.

Console2
A tabbed console which works well with classic windows shell and powershell. Good support for resizing, copy paste, etc.

.NET Reflector
.NET decompiler for those dlls that don’t have source. There is also a great plugin that lets you decompile entire assemblies to files on disk.

Fiddler
When you’re debugging SOAP or RESTful web services, Fiddler is great. It lets you see the messages sent / received and even change and impersonate them.

QueryExpress
If you’ve got SQLExpress or just no tools installed, QueryExpress is a tiny (~100K) and quick query analyser style application for all breeds of MS SQLServer. Download in a few seconds, and be running queries before a minute is up.

Unlocker
Don’t you hate it when Windows gets its locks in a mess and you can’t delete/rename files? Unlocker will automatically pop up, show you which applications are holding file locks and let you release the locks.

Process Explorer
A more powerful and accurate Task Manager application which allows you to see file locks and many other types of information.

Talk: Securing your MVC site against Code Injection and X-Site Scripting

I’ll be giving a lightning talk on securing your ASP.NET MVC site against code injection and x-site scripting next Tuesday 25 August at the Sydney ALT.NET group. I’ll be demonstrating potential pitfalls and dangers of arbitary code injection, and how you can protect against it, elegantly. We’ve got 6 interesting talks lined up for the night. See you there!

Green & Red Local Builds (adding colour to the local build process)

build.JPGWell, who doesn’t write tests and do continuous integration (CI) these days? Whether you use one of the many Cruise Control variants, or Team City or some other tool, you most likely get a handy colour coding of builds as either green or red (ie, good, or bad). But, you can take this a step further!

redbuild.JPGOften on .NET projects, we have a little batch file that we run before checking in (often with a pause at the end so it can be run from a shortcut), to confirm that no tests are broken locally. Well, it’s not much fun peering at the ugly Nant output (or whatever build system you use). Instead, it is quite easy to add a couple of lines to your batch file and change the colour of the console to bright Red or bright Green depending on the success of the local build. It is great for telling what the result was at a glance. I can’t claim credit the idea – it was something we used at EDI for our custom build system, but here’s some batch file code I whipped up which I can claim is all mine, every last GOTO of it! Enjoy 🙂

The following code uses NAnt, but you can replace it with MsBuild or any other build tool that returns a status code.

@echo off

color 07

tools\\nant\\NAnt.exe -buildfile:mybuild.build %*

IF ERRORLEVEL 1 goto RedBuild
IF ERRORLEVEL 0 goto GreenBuild

:RedBuild
color 4F
goto TheEnd

:GreenBuild
color 2F

:TheEnd
pause

Slides from ACS REST Talk

Thanks to everyone who came along to the REST talk at ACS tonight. Here are the slides. They are quite a big download (10mb) as a result of all the images. When you review them, you might want to turn on the “Notes” view as I’ve added some text to go along with the image based slides.

Sydney ALT.NET Launched & Ruby Slides

This evening we had the first Sydney Alt.Net meeting. It went really well. Our venue at the ThoughtWorks offices was pretty packed with about 35 interested people coming along. We started with a discussion of news in the .NET space, and then broke for food. After that we had my presentation on Ruby & Rails from a .NET perspective, followed by Richard’s presentation on Rhino Mocks. We ended with a retrospective to gather feedback and thoughts for future meetings. Thanks to everyone for coming along and making it such a great night! And also a big thank you to ThoughtWorks for the venue, food and drink.

Here’s the slides from “Ruby and Rails from a .NET perspective”. It’s a bit hard to give you a transcript of the demos but here is a taste of some of the ruby commands we looked at today.

Basic IronRuby Console demo

4+4
"hello".class
$friends = ["James", "Richard", "Bill"]
$friends.find_all { |f| f.include? "a" }
$friends.collect { |f| f.length }
"-" * 100
$person_type = Struct.new(:name, :age, :sex)
$j = person_type.new("James", 27, "m") 

Iron Ruby Calling WinForms

require 'System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' 
Form = System::Windows::Forms::Form  
MessageBox = System::Windows::Forms::MessageBox  
Button = System::Windows::Forms::Button 

$b = Button.new
$b.text = "Hello Button"
$f = Form.new
$f.controls << $b
$f.show_dialog 

Simple Rails App Demo

rails myapp
ruby script/generate scaffold Person name:string age:integer
rake db:migrate
ruby script/server

First Sydney ALT.NET Meeting on 30 Sept

Exciting news! We now have an ALT.NET group in Sydney! Our first meeting is Tuesday 30 September. Meetings will be the last Tuesday of the month.

Rough agenda for the first meeting is:

6:00pm   Meet & Greet time and then Kick Off!
6:30pm   “Ruby, Rails and IronRuby from a .NET perspective” (me).
7:00pm   Break with food and drink
7:30pm   “Mocking with Rhino Mocks 3.5” (Richard Banks).
8:00pm   Wrap up & go home.

ThoughtWorks is sponsoring the event with a nice office location in the CBD, and also pizza and beer. So if you’re planning to come, please comment or send me or Richard Banks a mail to help us get enough food and drinks for everyone.

Address is:
Level 8, 51 Pitt Street
Sydney NSW 2000 Australia
[Map]

ALT.NET is about designing and building the best solutions possible. This means continuous improvement, retrospection and often reaching outside the mainstream, considering Open Source frameworks and tools, Agile methodologies and ideas from other language communities such as Ruby, Java and Haskell.

For more info about ALT.NET, check out our Sydney ALT.NET Blog, and the main ALT.NET wiki.

See you on the 30th!

REST and .NET talk at ACS on 1 October

I’ll be giving a talk at the ACS (in Sydney CBD) on 1 October, about REST, designing good RESTful systems and implementing them in .NET. It will be quite similar to the REST Patterns in .NET talk I gave at Tech Ed. For more information, please check out the blurb at the ACS site.

Slides from Tech Ed “Rest Patterns and .NET” Talk

Here’s the slides from “REST Patterns and .NET”. I’ve put some extra info in the notes on various slides, so suggest browsing with notes displayed.

You might also be interested in more information about the talk or the simple rest client with code I mentioned during the presentation.

Simple REST Client

While preparing for my upcoming REST talk, I made a basic REST client. It’s nothing special but allows you to set the verb, request body and see the status code and all the headers on the response. It’s quite handy for debugging and exploration of RESTful services.

Feel free to download the:

Hope it is useful and saves you having to whip up your own little client!

UPDATE: Source now available on GitHub!

Page 2 of 4

Powered by WordPress & Theme by Anders Norén