Friday, April 12, 2019

UTF-8 encoding issue in Response in Tomcat


I have observed UTF-8 encoding issue for JSON response in Tomcat. By default tomcat uses ISO-8859-1. Below are the solution approaches:


Tomcat response (response is appended with ISO-8859-1 charset by Tomcat)
Content-Type: application/json;charset=ISO-8859-1

Solution:
Approach #1:
Add the below code in custom filter or servlet before sending the response

response.setCharacterEncoding("UTF-8");

Approach #2: (Better approach)
Use filter provided by Spring framework as mentioned below; which make the response to UTF-8 (Can add any other charset also).
Please add the below part in web.xml. The respective jar exists in spring-web dependency module.

Snippet to add in web.xml:

<filter>
    <filter-name>encodingFilter</filter-name>
    <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
    <init-param>
        <param-name>encoding</param-name>
        <param-value>UTF-8</param-value>
    </init-param>
    <init-param>
        <param-name>forceEncoding</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>

<filter-mapping>
    <filter-name>encodingFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>


Externalize of properties file in Tomcat

Below is the approach that can be used for externalize ApplicationResource properties file in Tomcat 7 & 9.


Steps:

1.       The change needs to be done in <tomcat_installation_path>/conf/Catalina/localhost/<APP_NAME>.xml (where data sources are defined)
2.       E.g. ApplicationResource.properties file is kept in D:/AppProperties/TestApp path

3.       For Tomcat 7.x , need to add the folder in classpath by using below tag under <Context> tag
a.       <Resources className="org.apache.naming.resources.VirtualDirContext"
               extraResourcePaths="/WEB-INF/classes=D:/AppProperties/TestApp"/>

4.       For Tomcat 8.x/9.x, you can provide the properties file instead of directory itself, by using below tag under <Context> tag
a.       <Resources>
    <PreResources className="org.apache.catalina.webresources.FileResourceSet"
            base="D:/AppProperties/TestApp/ApplicationResource.properties"
            webAppMount="/WEB-INF/classes/ApplicationResource.properties" />
     </Resources>

b. Alternatively, to configure directory the below one can be used

<Resources>
<PreResources className="org.apache.catalina.webresources.DirResourceSet"
base="D:/AppProperties/TestApp"
webAppMount="/WEB-INF/classes"/>

</Resources>
5.       This will load the properties file from the external location; hence remove the properties file from WEB-INF/classes

Tuesday, October 2, 2018

How to do a full-text search in SVN repository



SVN clients like TortoiseSVN does not come with the content search support. It can be done by using Git SCM client.

Installation:

Please follow the below steps on Windows

Goto https://git-scm.com/download/win

Download & install the exe file

Copying SVN Content to Local Drive:
Create a folder in any drive. e.g. D:\myrepo

Go to windows command prompt

Then from command prompt navigate to D:\myrepo (using cd)

Clone the SVN repository to the local drive (D:\myrepo) by executing below command

git svn clone <SVN_URL>

You will be prompted for username/password in command prompt while downloading the SVN content

Search the content:

Once the download is finished in D:\myrepo; execute the below command providing the text to be searched in <keyword>.

git grep -i <keyword> [e.g. git grep -i abcd]

-i is used to provide case-insensitive content search. To make the search case-sensitive remove -i option


The list of files with contents will be printed in the command prompt

Tuesday, March 6, 2018

Google AI tutorial/crash courses

Google tutorial/crash courses for learning AI:
https://ai.google/education/#?modal_active=none

Useful Links for JEE Devlopment



1. Links on Burlap Web service creation. A very easy way for Java to Java remoting:

http://www.devx.com/java/Article/27300/0/page/1

http://www.christianschenk.org/blog/webservices-with-hessian-and-burlap/




2. J2EE application Deployment Problem:

Problem:

java.lang.IllegalStateException: Web app root system property already set to

a different value: 'webapp.root'

Resolution

http://forum.springsource.org/archive/index.php/t-32873.html

http://forum.springsource.org/archive/index.php/t-24073.html


3. Solution on Axis 2 issue on Upgrade to 1.7.4 from 1.4.1:

Configuration required:

<parameter name="disableREST" locked="false">true</parameter>
Detail explanation in below blog

http://alloutfornoloss.com/axis2-epr-issue/

4.REST API Naming convention:
https://google.github.io/styleguide/jsoncstyleguide.xml?showone=Property_Name_Format#Property_Name_Format

Printing the DBMS_OUTPUT.PUT_LINE output from oracle to System.out in Java

Often we need to debug a Oracle stored procedure which is called from Java. In that case, it is helpful to log the DBMS_OUTPUT.put_line from Java using JDBC driver.
The below link guides a way to retrieve DBMS_OUTPUT.put_line from JDBC:

https://asktom.oracle.com/pls/asktom/f?p=100:11:0::::P11_QUESTION_ID:45027262935845

Eclipse Papyrus: An easy way to create UML diagrams

 As a software designer/architect one would always need to take the help of UML. There are many open source tools available in market to create UML diagrams.

Visual Paradigm,Star UML to name a few. But my best personal choice is Eclipse Papyrus. This tool is very easy to learn to create UML diagrams.


Check out youtube videos on how to create various UML diagrams using Eclipse Papyrus:
https://www.youtube.com/playlist?list=PLoWne5q-c9E_Q2_eAUZKPDA5K0V-O5zXs


Check out Eclipse Papyrus here


https://www.eclipse.org/papyrus/


Download Link

https://www.eclipse.org/papyrus/download.html

Saturday, March 3, 2018

Axis 2 Directory traversal vulnerability


Axis 2 Directory traversal  security vulnerability


Recently I have encountered one security issue of Axis 2 (1.4.1) service. The attacker can navigate to the axis.xml using the link https://victim.com/axis2/services/Version?xsd=../conf/axis2.xml & can see the Axis 2 username & password. Then attacker can deploy any malicious service to hack the system.
The issue seems to happen if the Axis 2 version <1.5.3. Upgrading the existing version to 1.5.3 (at minimal, upper versions also support) solves the problem.

The root cause of the issue is below configuration in Axis 2 1.4.1 version:
<transportReceiver name="http"
                       class="org.apache.axis2.transport.http.SimpleHTTPServer">
        <parameter name="port">8080</parameter>

SimpleHTTPServer does not block any request & hence directory traversal is possible.

I have followed the below steps to upgrade the Axis 2 from 1.4.1 to 1.5.3
1.     Upgrade the Axis 2 version to 1.5.3. & update the jars

2.     Once the JARS have been upgraded, change the below ones in conf\axis2.xml

replace

<transportReceiver name="http"
                       class="org.apache.axis2.transport.http.SimpleHTTPServer">
        <parameter name="port">8080</parameter>

with below one

<transportReceiver name="http"
                       class="org.apache.axis2.transport.http.AxisServletListener">
        <parameter name="port">8080</parameter>
    </transportReceiver>

    <transportReceiver name="https"
                       class="org.apache.axis2.transport.http.AxisServletListener">
        <parameter name="port">8443</parameter>
    </transportReceiver>
3.     Comment TCPTransportSender in axis2.xml
<!--
    <transportSender name="tcp"
                     class="org.apache.axis2.transport.tcp.TCPTransportSender"/>-->

Simplifying Third-Party API Integration in Java with OpenFeign

Integrating third-party APIs is a common requirement in modern applications. Traditionally, developers rely on tools like Apache HttpClient ...