Tuesday, March 2, 2021

Handling Retry with Spring-Retry

 Suppose you have a method for which you want to retry at a specific interval if any exception occurs.

Below are the steps using Spring Retry:

Add below maven dependenciess:

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-aop</artifactId>

<version>3.0.5.RELEASE</version>

</dependency>

<dependency>

<groupId>org.aspectj</groupId>

<artifactId>aspectjweaver</artifactId>

<version>1.6.11</version>

</dependency>


<dependency>

<groupId>org.springframework.retry</groupId>

<artifactId>spring-retry</artifactId>

<version>1.1.2.RELEASE</version>

</dependency>

Steps for call:

                SimpleRetryPolicy retryPolicy = new SimpleRetryPolicy();

retryPolicy.setMaxAttempts(5); //Max retry # 


FixedBackOffPolicy backOffPolicy = new FixedBackOffPolicy();

backOffPolicy.setBackOffPeriod(1500); // Retry @ every1.5 seconds


RetryTemplate template = new RetryTemplate();

template.setRetryPolicy(retryPolicy);

template.setBackOffPolicy(backOffPolicy);


return template.execute(new RetryCallback<String, Exception>() {


public String doWithRetry(RetryContext context) throws Exception {

                            // Asumption method m1 is sending String as return type

 String outputStr =m1();

return outputStr;

}

});


RetryCallback should be defined with <[ReturnType Of Method],[Exception to be Retried]>.

Here in case, I have assumed the called method is returning String & retry in case of an instance of Exception is thrown.

Below are the classes need to import:

import org.springframework.retry.RetryCallback;

import org.springframework.retry.RetryContext;

import org.springframework.retry.backoff.FixedBackOffPolicy;

import org.springframework.retry.policy.SimpleRetryPolicy;

import org.springframework.retry.support.RetryTemplate;


Saturday, December 19, 2020

Secured Web Service testing with Burp Suite

After you have intercepted the request in Burp Suite, follow below steps to send request for secured web services

Sending Request to Repeater:

Right click under "Proxy"-->"Intercept"-->"Raw" tab

Click on option "Send to Repeater"

Goto Repeater tab. You will now be able to see the same request as intercepted over here also.

If the Web service is secured one; you will  have below details in SOAP header:

1. Username

2. Password in Digest mode (encrypted)

3. Nonce (Should be unique in each request)

4. Created date

For secured web service testing, you need to install WS-Security Extension from Burp Suite App store.

Steps for installation of WS-Security extension:

Goto "Extender" --> "BApp Store"

Navigate to "WS-Security" & install it.

Once installed , the extension will be seen as a new tab named "WS-Security"

Configuration of WS-Security:

Navigate to "WS-Security" tab

Provide the password in Plain text "Password" text box

Now click "Turn WS-Security on".

Configuration of Scope:

Goto "Target"--> "Scope"

Click on "Add" button

Provide the Web Service End Point URL

Configuring WS-Security details in request:

Now we need to configure below 3 details in "Extender" tab, so that the nonce, created date  & password digeest  can be done automatically by WS-Security extension.

Replace the password value in SOAP request with #WS-SecurityPasswordDigest

Replace the value in nonce tag with #WS-SecurityNonce

Replace the value in created tag with #WS-SecurityCreated

This will enable to dynamically change the values with the one configured in "WS-Security" tab while making the SOAP request.

Click on the "Send" button in under "Repeater" tab. 

You will see the reponse in right hand side. 






Web Service Testing with Burp Suite & SOAP UI

Installation of Burp Suite:

Pre-requisite:

Java 8 should be already installed.

Goto below link:

https://portswigger.net/burp/releases?initialTab=community

If you are using Java 8, then download the JAR version for release version 2020.2.Java 8 is no longer supported for version upper than this.

Start Burp Suite:

Goto windows command prompt.

Navigate to the folder where the JAR is downloaded.

Run the below command

java -jar burpsuite_community_v2020.2.1.jar

Intercepting request:

Once the Burp Suite is open, first step is to turn on interceptor.

Navigate to "Proxy" --> "Options" tab

By Default the Interceptor is hosted in 8080 port. This can be changed to port you want.

Check the status is "Running".

Now  Navigate to "Proxy"-->"Intercept" tab

Now turn on the Interceptor by clicking button "Intercept is on".

SOAP UI Proxy Configuration:

Download SOAP UI from below link:

https://www.soapui.org/downloads/soapui/soapui-os-older-versions/

Start SOAP UI.

Goto "Files"-->"Preferences"

Click on "Proxy Settings"

Select "Manual" option & provide Host "127.0.0.1" & Port as "8080" (same as Burp Suite interceptor port)

Now doing any SOAP request in SOAP UI will be intercepted in Burp Suite & will be shown in "Proxy"--> "Intecept"-->"Raw"




Wednesday, December 9, 2020

Concurrency In RxJava


RxJava achieves concurrency through the Schedulers. 

Most commonly used Schedulers are IO & Computation:

Schedulers.io : Used for IO bound tasks (e.g.network call or Database call.)

Schedulers.computation : Used for CPU bound tasks.  (e.g. sorting large array in Java code)

The difference of CPU bound Vs IO bound task:

In case of IO bound task, we can have more theads , than,  the no of CPU cores of running machine. Because CPU is idle when the IO operaion is called.

Whereas in case of CPU bound task, as it is purely computational (e.g. Performing sorting in Java ArrayList); hence we should avoid creating threads more than the no of CPU core in the running machine.


subscribeOn : runs the tasks in new thread (start to end)

observeOn  : threading is applied only on the downstram task. (Operations defined after observeOn call)


Example:

In below example, we have taken a String , then transform the String to uppercase  , then printed the value.


File Name: ObsSubsEx.java

import java.util.concurrent.TimeUnit;


import io.reactivex.Observable;

import io.reactivex.schedulers.Schedulers;

public class ObsSubsEx {


public static void main(String[] args) throws InterruptedException {


Observable.just("subscribeOn One").subscribeOn(Schedulers.computation()).map(ObsSubsEx::toUpper).subscribe(ObsSubsEx::printVal);


TimeUnit.SECONDS.sleep(1);


Observable.just("subscribeOn Two").map(ObsSubsEx::toUpper).subscribeOn(Schedulers.computation()).subscribe(ObsSubsEx::printVal);


TimeUnit.SECONDS.sleep(1);


Observable.just("observeOn").map(ObsSubsEx::toUpper).observeOn(Schedulers.computation()).subscribe(ObsSubsEx::printVal);


TimeUnit.SECONDS.sleep(1);

}

private static String toUpper(String val) {

System.out.println("Uppercase done on thread:"+Thread.currentThread().getName());

return val.toUpperCase();

}


private static void printVal(String val) {

System.out.println("Final value is:"+val+":Thread:"+Thread.currentThread().getName());

}

}


Let's see from output log how the flow works:

Uppercase done on thread:RxComputationThreadPool-1
Final value is:SUBSCRIBEON ONE:Thread:RxComputationThreadPool-1

Uppercase done on thread:RxComputationThreadPool-2
Final value is:SUBSCRIBEON TWO:Thread:RxComputationThreadPool-2

Uppercase done on thread:main
Final value is:OBSERVEON:Thread:RxComputationThreadPool-3

Conclusion:

As we can see, in case of subscribeOn , irrespective of where it is called, both methods toUpper & printVal runs in a seperate thread. i.e. Threading applies to all operation (upstream as well as downtream) 

Whereas in case of observeOn, toUpper  is running in "main" thread & printVal  runs in a seperate thread, as we have called observeOn after the transform. i.e. Threading applied to downstream operations.

Now if we call the observeOn before the map:

Observable.just("observeOn Two").observeOn(Schedulers.computation()).map(ObsSubsEx::toUpper).subscribe(ObsSubsEx::printVal);

Then we can see the methods run in a seperate thread

Uppercase done on thread:RxComputationThreadPool-4
Final value is:OBSERVEON TWO:Thread:RxComputationThreadPool-4

Further Reading:


http://tomstechnicalblog.blogspot.com/2016/02/rxjava-understanding-observeon-and.html

https://www.aanandshekharroy.com/articles/2018-01/rxjava-flowables

https://proandroiddev.com/understanding-rxjava-subscribeon-and-observeon-744b0c6a41ea

https://dzone.com/articles/server-sent-events-with-rxjava-and-sseemitter

Code Link in Github:





Wednesday, August 19, 2020

Linux On Windows 10

 Windows 10 update version 2004 has come up with WSL 2 (Windows Subsystem for Linux ;Version 2). This features enable you to use Linux environment seamlessly from windows system.

Pre-requisite before install of WSL2.

To check Windows 10 version, follow below steps

  1. Open the command prompt or powershell window
  2. Type winver
  3. A pop-up will appear & show you windows update verion. Please check if the version is 2004 or not.
  4. Please update windows if the version is below 2004.

WSL 2 enablement also requires the Virtualization to be enabled. 

To check if Virtualization is enabled or not follow below steps:

  1. Open Task Manager--> Goto Performance Tab --> Click on CPU.
  2. Now check if Virtualization is enabled or not.

Now proceed to install WSL2 as instructed in below link:

https://www.youtube.com/watch?v=D7Em1wjMiak&t=179s

Monday, August 17, 2020

Medium Post Unlock

 Medium has lock on posts if you are not a member. You can read upto 3 medium posts per month freely.

To read the Medium posts without being a member ,the trick is copy the url & open in incognitio tab for Chrome browser.

Thursday, June 4, 2020

Useful Links



Useful Commands:
Run Spring Boot application in a port assigned dynamically

mvn spring-boot:run -Dspring-boot.run.arguments=--server.port=8080

Monday, June 1, 2020

Git Commands

Below is the set of commands needs to be executed to update code from local system to Github repository 

git config --global user.name "<Your Name>"

git config --global user.email <E-mail id>

create folder: e.g. Test

Navigate to folder

git init

git remote add origin <github url>

git pull origin master

Make changes to the folder (Test)

git status

git add .

git commit -m "Test Comment"

git push origin master

In Windows a good alternative is TortoiseGit. It can be downloaded from below link:

https://tortoisegit.org/

Friday, May 29, 2020

Changing the context name in Tomcat

Sometimes, it may happen, you want to provide the application context name  different from the WAR file name while deploying in Tomcat.

Scenario:

WAR Name: ABC.war
The default url becomes: http://localhost:8080/ABC

Want to access the url as: http://localhost:8080/XYZ

There are 2 options available to do this change

Option #1:
Here is the steps that can be followed:

1. Navigate to <TOMCAT_HOME>/conf/server.xml
2. Goto the Host section & do the below changes
3. Change it to below:

 <Host name="localhost"  appBase="webapps"
      unpackWARs="false" autoDeploy="false" deployOnStartup="false">    

Please note, unpackWARs , deployOnStartup, autoDeploy all three should be marked as false, else 2 folders will be generated one with name ABC & another XYZ.

4. Add the context changes under Host

 <Host name="localhost"  appBase="webapps"
      unpackWARs="false" autoDeploy="false" deployOnStartup="false">  
<Context path="/XYZ" docBase="ABC.war"/>
 <!-- other preexisting configuration-->
<Host>
5. Start Tomcat going to <TOMCAT_HOME>/bin/startup.bat (windows) or <TOMCAT_HOME>/bin/startup.sh in Linux environment.

Option#2:
  1. Explode the ABC.war (unzip the WAR file)
  2. Place the exploded WAR in a folder outside Tomcat Directory (e.g. D:\mywebapps)
  3. So, now the exploded WAR path will be D:\mywebapps\ABC
  4. Create an xml file in <TOMCAT_HOME>/conf/Catalina/localhost named XYZ.xml (the name of expected context)
  5. Now add the below line in XYZ.xml
  6. <Context path="/XYZ" docBase="D:/mywebapps/ABC"/>
  7. docBase refer to the path where exploded WAR is placed.
  8. Start Tomcat going to <TOMCAT_HOME>/bin/startup.bat (windows) or <TOMCAT_HOME>/bin/startup.sh in Linux environment.




Wednesday, March 4, 2020

Thread Dump in Java

Steps to take thread dump in Java in Windows

1. Download PSTools from below link
https://docs.microsoft.com/en-us/sysinternals/downloads/pstools
2. Use below command to take thread dump:

psexec -s <Path_to_JDK_bin_folder>\jstack.exe -l <process_id> ><PATH_WITH_FILE_NAME_FOR_DUMP>

e.g.
psexec -s D:\jdk1.8.0_171\bin\jstack.exe -l 319732 >D:\dump.txt

3. Download IBM Thread Dump Analyzer(TDA) from below link
https://public.dhe.ibm.com/software/websphere/appserv/support/tools/jca/jca465.jar

4. Double click on the jar to open
5. Click on File-->Open Thread Dumps.
6. Choose the thread dump file
7. Click on Analysis-->Thread Status Analysis
 


Details on TDA can be found here 



Useful Production Profiling links

Few days ago I was looking for a Profiling to be done on Production environment. Earlier, I used to use JProfiler & JavaMelody for performance / issue debugging in production environment.

But , of late I found Alibaba has created a new profiling tool for production usage. The below link contains the details. Please check out. Seems interesting

https://medium.com/@Alibaba_Cloud/troubleshooting-production-issues-with-alibabas-arthas-68d8ec2824d7


Friday, November 29, 2019

Useful Information on Application Security

1. Sql Injection Checking Library:
https://github.com/rkpunjal/sql-injection-safe

2. Checking Vulnerable libraries in application:

Add below plugin in pom.xml of you application. This will provide the list of libraries which are vulnerable. A file named dependency-check-report.html will be generated in target folder of you maven based app
 <plugin>
              <groupId>org.owasp</groupId>
              <artifactId>dependency-check-maven</artifactId>
              <version>5.2.4</version>
              <executions>
                  <execution>
                      <goals>
                          <goal>check</goal>
                      </goals>
                  </execution>
              </executions>
            </plugin>
More details can be found in below link:
https://jeremylong.github.io/DependencyCheck/dependency-check-maven/

3. Security Guidelines Tutorial:

https://code.likeagirl.io/pushing-left-like-a-boss-part-1-80f1f007da95

4. Code Review Checklist
https://github.com/softwaresecured/secure-code-review-checklist

5. Burp Extension:
https://github.com/snoopysecurity/awesome-burp-extensions



Http Client Code Auto Generation

Many a times we write http client code in various programming language by our own. Postman (a Chrome Browser extension), provides an way to auto-generate the HTTP client code. Below are the steps to proceed:

1. Open the Postman extension from Chrome
2. Hit the url you wnat to develop the client code
3. Provide other details in Authorization/Header tabs
4. Provide the Content in Body tab
5. Click on the Code link in Right Side.
6. You will be provided with list of options with Programming language like Java/Python etc.
7. Choose the option & your code is there.
8. You can now add the code in your application with the library used.

Happy Coding !
  

SQL Injection testing using SqlMap & Postman



SqlMap is very powerful tool for Automated Sql Injection testing for Web Application/API (SOAP/REST). This blog describes the procedure to get started with testing



SqlMap & Python Installation:

1.Download Python 2.7.16.
2.Goto https://www.python.org/downloads/release/python-2716/
3.Choose Windows x86-64 MSI installer option for Windows Installation
4.Add the folder where Python is installed in Path (Environment variable). e.g. If Python is installed in C:\Python27 then add this path in Path Variable in Windows
5.Download the .Zip version of SQLMap from http://sqlmap.org/
6.Extract in any folder in any Drive (e.g. D:\sqlmapproject)

Preparation of Test Data:
Here we are going to test Sql Injection in url http://testphp.vulnweb.com/listproducts.php?cat=1
1.Open Chrome Browser
2.Open Postman extension in Chrome. Install from Chrome Web Store if Postman is not installed
3.Hit the url mentioned above using GET request
4.Click on the Right Side of Postman in Link "Code"
5,Choose Http Option.
6.Copy the content & paste in a text file (e.g. attack.txt)

Sql Injection Testing:


1.Open Windows Command prompt
2.Navigate to the folder where SqlMap is extracted (D:\sqlmapproject)
3.Copy the attack.txt in D:\sqlmapproject
4.Run below command. adding --flush-session --fresh-queries will enable to execute the test cases freshly; else the old cached data will be shown in command prompt.
python sqlmap.py -r attack.txt --dbs --flush-session --fresh-queries
This will run all the sql injection test cases automatically & provide the output




Using the same way REST/SOAP API can be tested

Notes: In Windows 10, you might get an error Python not installed & need to install from Microsoft Store. In that case, declare the Python installation path at the top as below:



Friday, October 18, 2019

JavaMelody Report generation issue



Recently I have upgraded some of my application in Tomcat 9 from Tomcat 6. After migration, I found the Java Melody report is not generating properly. The sql statistics were not coming.


Upon investigating, I found the JavaMelody Listener should be ordered first among other listeners. As I was using Spring, hence Spring context Listener has to come in 2nd place & Java Melody Session Listener should come first in order.


Below is the snapshot of web.xml with ordering configuration:


Required JARs:
itext-2.1.7.jar

javamelody-core-1.42.0.jar

jrobin-1.5.9.jar



Url format to access Java Melody Report:


http://<Host>:<port>/<ContextRoot>/monitoring

Web.xml structure with ordering configuration:

<?xml version="1.0" encoding="ISO-8859-1"?>

<web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://java.sun.com/xml/ns/javaee

http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"

metadata-complete="true">

<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/applicationContext.xml</param-value>
</context-param>

<filter>
<filter-name>monitoring</filter-name>
<filter-class>net.bull.javamelody.MonitoringFilter</filter-class>
</filter>

<filter-mapping>
<filter-name>monitoring</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

<listener>
<listener-class>net.bull.javamelody.SessionListener</listener-class>
</listener>

<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>


<!-- Other servlet details with mapping details-->
<servlet>
<servlet-name>CXFServlet</servlet-name>
<servlet-class>org.apache.cxf.transport.servlet.CXFServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
<servlet-name>CXFServlet</servlet-name>
<url-pattern>/services/*</url-pattern>
</servlet-mapping>

</web-app>

In case still the report is not showing then ensure the jdbc connections are prefixed with "jdbc/<Connection Name>" format.

In case for Spring 5, JDK 8, Tomcat 9.x upgrade to javamelody-core-1.99.3.jar

Wednesday, October 16, 2019

Useful links for Machine Learning in Java


Topic modelling using Mallet:

https://jentery.github.io/507/mallet.html

https://programminghistorian.org/en/lessons/topic-modeling-and-mallet

Mallet Output Visual Interpretation in Excel Macro:

https://wp.nyu.edu/exceltextanalysis/visualize-mallet-topics/

Sentiment Analysis Tool:

Stanford CoreNLP:

https://stanfordnlp.github.io/CoreNLP/tutorials.html

https://www.toptal.com/java/email-sentiment-analysis-bot

https://blog.openshift.com/day-20-stanford-corenlp-performing-sentiment-analysis-of-twitter-using-java/


Vader:

https://github.com/apanimesh061/VaderSentimentJava

Maven dependency for Vader:

<dependency>

<groupId>com.github.apanimesh061</groupId>

<artifactId>vader-sentiment-analyzer</artifactId>

<version>1.0</version>

</dependency>


<!-- https://mvnrepository.com/artifact/log4j/log4j -->

<dependency>

<groupId>log4j</groupId>

<artifactId>log4j</artifactId>

<version>1.2.17</version>

</dependency>

<!-- https://mvnrepository.com/artifact/org.apache.lucene/lucene-analyzers-common -->

<dependency>

<groupId>org.apache.lucene</groupId>

<artifactId>lucene-analyzers-common</artifactId>

<version>8.2.0</version>

</dependency>

Tuesday, October 15, 2019

Java 8 Heap Memory Issue

Recently I have migrated one of my application from JDK 6 to JDK 8. Once I have migrated to Java 8, I observed the Heap memory is completely getting saturated & CPU consumption is also very high and application is becoming unresponsive.

From thread dump it becomes clear JAXB was taking the memory. Below approach was taken to resolve the issue.

1. Limit the Metaspace max size:
As Metaspace in Java 8 has no limit  hence it was taking the complete heap memory over a period of time; hence set the metaspace max limit using below one in JVM Argument
-XX:MaxMetaspaceSize=512m  - sets the maximum size of the Metaspace to 512 MB
2. JAXB configuration optimization: 
As my application uses lots of XML marshalling & unmarshalling. Hence below addition configuration was required in JVM Argument
-Dcom.sun.xml.bind.v2.bytecode.ClassTailor.noOptimize=true

Useful link for MetaSpace:

http://java-latte.blogspot.com/2014/03/metaspace-in-java-8.html

Friday, April 12, 2019

UTF-8 encoding issue in Response in Tomcat


I have observed UTF-8 encoding issue for JSON response in Tomcat. By default tomcat uses ISO-8859-1. Below are the solution approaches:


Tomcat response (response is appended with ISO-8859-1 charset by Tomcat)
Content-Type: application/json;charset=ISO-8859-1

Solution:
Approach #1:
Add the below code in custom filter or servlet before sending the response

response.setCharacterEncoding("UTF-8");

Approach #2: (Better approach)
Use filter provided by Spring framework as mentioned below; which make the response to UTF-8 (Can add any other charset also).
Please add the below part in web.xml. The respective jar exists in spring-web dependency module.

Snippet to add in web.xml:

<filter>
    <filter-name>encodingFilter</filter-name>
    <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
    <init-param>
        <param-name>encoding</param-name>
        <param-value>UTF-8</param-value>
    </init-param>
    <init-param>
        <param-name>forceEncoding</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>

<filter-mapping>
    <filter-name>encodingFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>


Externalize of properties file in Tomcat

Below is the approach that can be used for externalize ApplicationResource properties file in Tomcat 7 & 9.


Steps:

1.       The change needs to be done in <tomcat_installation_path>/conf/Catalina/localhost/<APP_NAME>.xml (where data sources are defined)
2.       E.g. ApplicationResource.properties file is kept in D:/AppProperties/TestApp path

3.       For Tomcat 7.x , need to add the folder in classpath by using below tag under <Context> tag
a.       <Resources className="org.apache.naming.resources.VirtualDirContext"
               extraResourcePaths="/WEB-INF/classes=D:/AppProperties/TestApp"/>

4.       For Tomcat 8.x/9.x, you can provide the properties file instead of directory itself, by using below tag under <Context> tag
a.       <Resources>
    <PreResources className="org.apache.catalina.webresources.FileResourceSet"
            base="D:/AppProperties/TestApp/ApplicationResource.properties"
            webAppMount="/WEB-INF/classes/ApplicationResource.properties" />
     </Resources>

b. Alternatively, to configure directory the below one can be used

<Resources>
<PreResources className="org.apache.catalina.webresources.DirResourceSet"
base="D:/AppProperties/TestApp"
webAppMount="/WEB-INF/classes"/>

</Resources>
5.       This will load the properties file from the external location; hence remove the properties file from WEB-INF/classes

Tuesday, October 2, 2018

How to do a full-text search in SVN repository



SVN clients like TortoiseSVN does not come with the content search support. It can be done by using Git SCM client.

Installation:

Please follow the below steps on Windows

Goto https://git-scm.com/download/win

Download & install the exe file

Copying SVN Content to Local Drive:
Create a folder in any drive. e.g. D:\myrepo

Go to windows command prompt

Then from command prompt navigate to D:\myrepo (using cd)

Clone the SVN repository to the local drive (D:\myrepo) by executing below command

git svn clone <SVN_URL>

You will be prompted for username/password in command prompt while downloading the SVN content

Search the content:

Once the download is finished in D:\myrepo; execute the below command providing the text to be searched in <keyword>.

git grep -i <keyword> [e.g. git grep -i abcd]

-i is used to provide case-insensitive content search. To make the search case-sensitive remove -i option


The list of files with contents will be printed in the command prompt

Tuesday, March 6, 2018

Google AI tutorial/crash courses

Google tutorial/crash courses for learning AI:
https://ai.google/education/#?modal_active=none

Useful Links for JEE Devlopment



1. Links on Burlap Web service creation. A very easy way for Java to Java remoting:

http://www.devx.com/java/Article/27300/0/page/1

http://www.christianschenk.org/blog/webservices-with-hessian-and-burlap/




2. J2EE application Deployment Problem:

Problem:

java.lang.IllegalStateException: Web app root system property already set to

a different value: 'webapp.root'

Resolution

http://forum.springsource.org/archive/index.php/t-32873.html

http://forum.springsource.org/archive/index.php/t-24073.html


3. Solution on Axis 2 issue on Upgrade to 1.7.4 from 1.4.1:

Configuration required:

<parameter name="disableREST" locked="false">true</parameter>
Detail explanation in below blog

http://alloutfornoloss.com/axis2-epr-issue/

4.REST API Naming convention:
https://google.github.io/styleguide/jsoncstyleguide.xml?showone=Property_Name_Format#Property_Name_Format

Printing the DBMS_OUTPUT.PUT_LINE output from oracle to System.out in Java

Often we need to debug a Oracle stored procedure which is called from Java. In that case, it is helpful to log the DBMS_OUTPUT.put_line from Java using JDBC driver.
The below link guides a way to retrieve DBMS_OUTPUT.put_line from JDBC:

https://asktom.oracle.com/pls/asktom/f?p=100:11:0::::P11_QUESTION_ID:45027262935845

Eclipse Papyrus: An easy way to create UML diagrams

 As a software designer/architect one would always need to take the help of UML. There are many open source tools available in market to create UML diagrams.

Visual Paradigm,Star UML to name a few. But my best personal choice is Eclipse Papyrus. This tool is very easy to learn to create UML diagrams.


Check out youtube videos on how to create various UML diagrams using Eclipse Papyrus:
https://www.youtube.com/playlist?list=PLoWne5q-c9E_Q2_eAUZKPDA5K0V-O5zXs


Check out Eclipse Papyrus here


https://www.eclipse.org/papyrus/


Download Link

https://www.eclipse.org/papyrus/download.html

Saturday, March 3, 2018

Axis 2 Directory traversal vulnerability


Axis 2 Directory traversal  security vulnerability


Recently I have encountered one security issue of Axis 2 (1.4.1) service. The attacker can navigate to the axis.xml using the link https://victim.com/axis2/services/Version?xsd=../conf/axis2.xml & can see the Axis 2 username & password. Then attacker can deploy any malicious service to hack the system.
The issue seems to happen if the Axis 2 version <1.5.3. Upgrading the existing version to 1.5.3 (at minimal, upper versions also support) solves the problem.

The root cause of the issue is below configuration in Axis 2 1.4.1 version:
<transportReceiver name="http"
                       class="org.apache.axis2.transport.http.SimpleHTTPServer">
        <parameter name="port">8080</parameter>

SimpleHTTPServer does not block any request & hence directory traversal is possible.

I have followed the below steps to upgrade the Axis 2 from 1.4.1 to 1.5.3
1.     Upgrade the Axis 2 version to 1.5.3. & update the jars

2.     Once the JARS have been upgraded, change the below ones in conf\axis2.xml

replace

<transportReceiver name="http"
                       class="org.apache.axis2.transport.http.SimpleHTTPServer">
        <parameter name="port">8080</parameter>

with below one

<transportReceiver name="http"
                       class="org.apache.axis2.transport.http.AxisServletListener">
        <parameter name="port">8080</parameter>
    </transportReceiver>

    <transportReceiver name="https"
                       class="org.apache.axis2.transport.http.AxisServletListener">
        <parameter name="port">8443</parameter>
    </transportReceiver>
3.     Comment TCPTransportSender in axis2.xml
<!--
    <transportSender name="tcp"
                     class="org.apache.axis2.transport.tcp.TCPTransportSender"/>-->

Simplifying Third-Party API Integration in Java with OpenFeign

Integrating third-party APIs is a common requirement in modern applications. Traditionally, developers rely on tools like Apache HttpClient ...