Shambling Towards Perfection

Yesterday I met with my advisor to demo what I accomplished in sprint 2. Of course most of it was behind-the-scenes so there wasn't a lot to show, but he seemed pleased with my progress thus far. We discussed the security issues I've been researching and the insanity of trying to secure a web app in general, and he said security would be a good topic to discuss in the project summary paper thing I'll have to write. So I'm already getting a general idea of what will have to go in the paper, which is good. We also discussed what I hope to accomplish in sprint 3 and some plans for sprint 4. Right now there's a ton of steps involved in setting up the project for the first time (configuration files to edit and put various places, editing of tomcat's xml files, creating the database, etc. etc.) and so he'd like to simplify all that so that he can deploy my project on his own machine more easily. So we agreed that that will go in as an item for sprint 4. I'll c...

So I finished sprint 2 today. Yet again my biggest problem is finding enough time to put in as much work as I'd like. I suspect this will be an ongoing problem. I am mostly pleased with how much I accomplished though. I finished 3 backlog items: Fix fake data insertion code (1 hour), Add additional sanitization of input and other security measures (6 hours), and Add logging statements throughout the code (3). The only somewhat troubling aspect is that I'm still not 100% sure I've considered all the possible security issues. I've done a LOT of googling, but this information is extremely scattered. There's no comprehensive "Java web app security guide" that I've been able to find (though the OWASP stuff is very good and somewhat close). Mostly I've gone searching for one thing, and a random link or post will lead me to other things. It seems like you have to know what all the issues are in advance and then start searching for solutions to those iss...

As it turns out, security is actually harder than the internets originally led me to believe. Preventing SQL injection is as simple as making sure to use PreparedStatements (and not doing anything stupid like concatenating user supplied values with safe strings in the PreparedStatements), but preventing XSS is a whole 'nother kettle of fish. So I'm following the advice given on the linked site, and using their library to take care of escaping. I was using Apache Commons StringEscapeUtils for this but it only has one type of escaping for HTML, when apparently multiple different types are needed depending on where in the HTML the user-generated content is going. The Apache documentation doesn't really specify what it's doing, so I don't feel comfortable using it for either encoding inside regular HTML elements or inside attributes. I'm still using Java's own URLEncoder for encoding URL parameter values, as it seems to do the same thing as OWASP's UR...

I've been researching what's required to make my application less vulnerable to things like SQL injection or other malicious attacks. Imagine my surprise when I discovered that I've apparently already done the two biggest things, which are using PreparedStatements and escaping special characters . I've googled quite a bit and these are the main things I've found so far. According to the latter article I do need to do a few more small things, such as specifying the character encoding in my headers, but that seems to be about it... I'll be double-checking all my SQL to make sure there are no inappropriate uses of Statements, but apparently this issue is going to be a lot faster and easier than I expected. Rather shocking, really... Hopefully google hasn't lead me astray. In other news I'm leaning towards revising the issue "Add error checking, unit testing, and integration testing using JUnit, DBUnit, FindBugs, etc." to just focusing on Find...

The goal for sprint 2 will be improving stability and security (mostly a continuation of sprint 1, obviously). The sprint backlog items are: Priority Description Points 300 Add error checking, unit testing, and integration testing using JUnit, DBUnit, FindBugs, etc. 16 290 Add logging statements throughout the code 3 270 Add additional sanitization of input and other security measures 8 255 Fix fake data insertion code 2 The total ideal man hours is 29, which is hopefully a more reasonable amount for slightly less than 2 weeks (since I'm leaving a dayish for planning, setting up the demo and doing the retrospective). All of these carried over from the last sprint with the exception of the last item. I discovered during the last sprint that my fake data insertion code no longer worked due to changes I had made towards the end of the semester when I first developed the application. I really need those routines in order to have adequate data for testing, so they need fix...