Shambling Towards Perfection

As it turns out, security is actually harder than the internets originally led me to believe. Preventing SQL injection is as simple as making sure to use PreparedStatements (and not doing anything stupid like concatenating user supplied values with safe strings in the PreparedStatements), but preventing XSS is a whole 'nother kettle of fish. So I'm following the advice given on the linked site, and using their library to take care of escaping. I was using Apache Commons StringEscapeUtils for this but it only has one type of escaping for HTML, when apparently multiple different types are needed depending on where in the HTML the user-generated content is going. The Apache documentation doesn't really specify what it's doing, so I don't feel comfortable using it for either encoding inside regular HTML elements or inside attributes. I'm still using Java's own URLEncoder for encoding URL parameter values, as it seems to do the same thing as OWASP's UR...

I meant to mention this yesterday in one of my posts but forgot. I had originally downloaded jars for both slf4j and JCL , plus the jar that connects the two . I know I didn't do this for funsies; it was purely to get my code to compile so I could use the export-to-XML feature of DBUnit . However, I stumbled across a page that listed the dependencies of DBUnit and it didn't include JCL, just slf4j. I had updated all my jars so I figured maybe things had changed and removed the connector jar and the JCL jar... And poof, everything still compiled! Maybe I was somehow confused before (of followed bad advice on a blog/Stackoverflow post) and downloaded things unnecessarily, or maybe they've changed things in a more recent release, but either way I don't have to use both slf4j and JCL. Which is great, because when I tried to use them both the names of classes and the line numbers that were doing the logging got lost. Anyhow I now have things working very well with just s...

So apparently slf4j is a logging abstraction framework meant to let you use the actual logging implementation of your choice. So slf4j lets you use Jakarta Commons Logging (and this is what DBUnit does), which is ALSO a logging abstraction framework meant to let you use the actual logging implementation of your choice. So I STILL need yet another library in order to get logging to files instead of to System.err. I just... For crying out loud. Fine then. I just downloaded log4j . Are you finally satisfied, logging libraries??? Argh. :(

I met with my adviser for the first time last Wednesday, and we decided our next meeting would be September 24 and then we'll meet every two weeks thereafter. Since the 24th would fall in the middle of a sprint I decided to extend the first one to end this Saturday, the 29th (I was also under the weather several days last week, so it was a good move all around). On the 30th I'll upload all my code to the version control system my prof has set up (svn) and configure everything so that it will run on the department servers. I'll be demoing my latest work at every meeting, so every other Sunday will be configuration day. I realize continuous builds on the department machines would be better but it's not exactly practical, so I'm settling for continuous builds on my home machine. Since my last post I have successfully configured Tomcat to use SSL and jbcrypt . The latter involved writing a custom realm but turned out to be quite trivial; I simply extended JDBCRealm ...

I have finally overcome some technical difficulties, including finding a CS department machine that was actually up so I could retrieve info I needed that had been stored with my original code, and remembering that I had installed 32-bit Eclipse on my machine originally, because 2 years ago when I set it up Eclipse didn't play well with 64-bit Java. The latter resulted in my shiny new 64-bit Java 7 not working with the old version of Eclipse. Getting 64-bit Eclipse in the latest version (Juno) solved that problem. All the technologies, libraries, plug-ins, etc. I need for the project are now fully updated to the latest versions, and I was able to get my project running on my home machine (using Tomcat as the application server). It had been so long since I'd set things up that I'd forgotten how, so I did prove that the instructions I wrote up for my professor to follow worked very well. Go me. I have also been looking more into Java libraries that may help with variou...