Search Results

Search found 12490 results on 500 pages for 'property injection'.

Page 17/500 | < Previous Page | 13 14 15 16 17 18 19 20 21 22 23 24  | Next Page >

  • How do I protect my website from javascript injection attacks when using rich text editors?

    - by VJ
    Hi all I am using the markitup editor to get the value for one of my fields and storing it a sql server 2008 db. Now I guess the problem is people having script tags and javascript in the editor and injecting malicious scripts and I have my validate input turned false. So can anyone suggest me a way to write a custom validation method that maybe checks for script tags and removes them...or just guide me through the steps i need to do ?...also are there other things also that I should be worried about..?

    Read the article

  • Is it possible to use Dependency Injection/IoC on an ASP.NET MVC FilterAttribute ?

    - by Pure.Krome
    Hi folks, I've got a simple custom FilterAttribute which I use decorate various ActionMethods. eg. [AcceptVerbs(HttpVerbs.Get)] [MyCustomFilter] public ActionResult Bar(...) { ... } Now, I wish to add some logging to this CustomFilter Action .. so being a good boy, I'm using DI/IoC ... and as such wish to use this pattern for my custom FilterAttribute. So if i have the following... ILoggingService and wish to add this my custom FilterAttribute .. i'm not sure how. Like, it's easy for me to do the following... public class MyCustomFilterAttribute : FilterAttribute { public MyCustomFilterAttribute(ILoggingService loggingService) { ... } } But the compiler errors saying the attribute which decorates my ActionMethod (listed above...) requires 1 arg .. so i'm just not sure what to do :(

    Read the article

  • When using Dependency Injection with StructureMap how do I chooose among multiple constructors?

    - by Mark Rogers
    I'm trying to get structuremap to build Fluent Nhibernate's SessionSource object for some of my intregration tests. The only problem is that Fluent's concrete implementation of ISessionSource (SessionSource) has 3 constructors: public SessionSource(PersistenceModel model) { Initialize(new Configuration().Configure(), model); } public SessionSource(IDictionary<string, string> properties, PersistenceModel model) { Initialize(new Configuration().AddProperties(properties), model); } public SessionSource(FluentConfiguration config) { configuration = config.Configuration; sessionFactory = config.BuildSessionFactory(); dialect = Dialect.GetDialect(configuration.Properties); } I've tried configuring my ObjectFactory supplying an argument for the first constructor but it seems like it wants to try the second one. How do I configure my ObjectFactory so that I can choose the first constructor or perhaps even another one if I decide to use that?

    Read the article

  • Is this an injection attempt or a normal request?

    - by CheeseConQueso
    In cPanel's Analog Stats statistics module, I've noticed countless requests to connect to the following example: /?x=19&y=15 The numbers are random, but its always setting x and y variables. Another category of mysterious requests: /?id=http://nic.bupt.edu.cn/media/j1.txt?? There are other attempts at injections in the request log that have straight sql written into them as well. Example: /jobs/jobinfo.php?id=-999.9 UNION ALL SELECT 1,(SELECT concat(0x7e,0x27,count(table_name),0x27,0x7e) FROM information_schema.tables WHERE table_schema=0x73636363726F6F745F7075626C6963),3,4,5,6,7,8,9,10,11,12,13-- It looks like they are all reaching a 404, but I'm still wondering about the intent behind these. I know this is vague, but maybe someone knows that this is normal while using cPanel & phpMyAdmin services. Also, there was a search box installed on the site which could be the reason. Any suggestions as to what all these are?

    Read the article

  • Does video tag (HTML 5) injection via JavaScript work in any browsers?

    - by JoshNaro
    I'm trying to dynamically spawn a video element on a page using JavaScript. JavaScript <script type="text/javascript"> $(document).ready(function() { var video = $(document.createElement('video')) .attr('id', 'VideoElement') .attr('controls', 'controls') .attr('src', 'videopath.mp4') // Changed 'href' attribute to 'src' .css({ width: 640, height: 360 }); $('#VideoContainer').append(video); }); HTML <body> <div id="VideoContainer"></div> </body> In Firefox I get the video harness, but the actual video doesn't load. In IE8 the video harness doesn't even appear. Is HTML 5 just not supported enough to accomplish this yet? Edit: Got this to work with Artiom's fix. Looks like this works fine with Chrome and Safari. I'm using a codec Firefox doesn't support, so it doesn't work there; although I suspect it will work with a supported codec. IE8 sure enough doesn't work (high five IE).

    Read the article

  • IoC Dependancy injection into Custom HTTP Module - how? (ASP.NET)

    - by Sosh
    Hi, I have a custom HTTP Module. I would like to inject the logger using my IoC framework, so I can log errors in the module. However, of course I don't get a constructor, so can't inject it into that. What's the best way to go about this? If you need the specific IoC container - I'm currently using Windsor, but may soon move to AutoFac. Thanks

    Read the article

  • Passing Services to MainViewModel - SHOULD I use a dependency injection container ?

    - by msfanboy
    Hello, I have this code: public partial class App : Application { protected override void OnStartup(StartupEventArgs e) { base.OnStartup(e); var mainVM = new MainViewModel ( new Service1(), ... new Service10(), ); var window = new MainWindow(); window.DataContext = mainVM; window.Show(); } } I pass all my Services instances to the MainViewModel. Within the MainViewModel I spread those services to other ViewModels via constructor parameter passing. Should I use any DI framework for the services in the App class? If yes whats the benefit of resolving the services instead of just creating the instance manually... ?

    Read the article

  • IValidatableObject vs Single Responsibility

    - by Boris Yankov
    I like the extnesibility point of MVC, allowing view models to implement IValidatableObject, and add custom validation. I try to keep my Controllers lean, having this code be the only validation logic: if (!ModelState.IsValid) return View(loginViewModel); For example a login view model implements IValidatableObject, gets ILoginValidator object via constructor injection: public interface ILoginValidator { bool UserExists(string email); bool IsLoginValid(string userName, string password); } It seems that Ninject, injecting instances in view models isn't really a common practice, may be even an anti-pattern? Is this a good approach? Is there a better one?

    Read the article

  • How do I inject test objects when the real objects are created dynamically?

    - by JW01
    I want to make a class testable using dependency injection. But the class creates multiple objects at runtime, and passes different values to their constructor. Here's a simplified example: public abstract class Validator { private ErrorList errors; public abstract void validate(); public void addError(String text) { errors.add( new ValidationError(text)); } public int getNumErrors() { return errors.count() } } public class AgeValidator extends Validator { public void validate() { addError("first name invalid"); addError("last name invalid"); } } (There are many other subclasses of Validator.) What's the best way to change this, so I can inject a fake object instead of ValidationError? I can create an AbstractValidationErrorFactory, and inject the factory instead. This would work, but it seems like I'll end up creating tons of little factories and factory interfaces, for every dependency of this sort. Is there a better way?

    Read the article

  • Test wordpress sites for SQL Injection on siteurl

    - by Scott B
    I have a client who's wordpress sites have gotten hacked twice by iframe scammers. Each time they've injected iframe code into the content of the sites. This last time, today, they simply changed the siteurl in wp_options to their iframe code. The result was obvious and appeared to simply botch the paths of the scripts that rely on I can't determine if its a password compromise (on FTP or WordPress itself) or a SQL injection to alter siteurl. Since the only thing that was altered is siteurl, I'm thinking perhaps SQL Injection. What are your thoughts? Any way to scan a site for potential SQL injection vulnerabilities? The only active plugins on the site are contact form 7 and google xml sitemaps.

    Read the article

  • How to retrieve the Description property from SettingsProperty?

    - by BadNinja
    For each item in my application's settings, I've added text to its Description Property which I want to retrieve at runtime. I'm sure I'm missing some basic logical nuance here, but everything I've tried has failed. Clearly, my understanding of what value needs to be passed to the Attributes property of the SettingsProperty class is wrong. I'm further confused by the fact that when I iterate through all they keys returned by SettingsProperty.Attributes.Keys, I can see "System.Configuration.SettingsDescriptionAttribute", but when I pass that string in as the key to the Attributes property, null is returned. Any insight into how to properly retrieve the value Description Property would be very much appreciated. Thanks. :) public void MyMethod() { SettingsPropertyCollection MyAppProperties = Properties.Settings.Default.Properties; IEnumerator enumerator = MyAppProperties.GetEnumerator(); // Iterate through all the keys to see what we have.... while (enumerator.MoveNext()) { SettingsProperty property = (SettingsProperty)enumerator.Current; ICollection myKeys = property.Attributes.Keys; foreach (object theKey in myKeys) System.Diagnostics.Debug.Print(theKey.ToString()); // One of the keys returned is: System.Configuration.SettingsDescriptionAttribute } enumerator.Reset(); while (enumerator.MoveNext()) { SettingsProperty property = (SettingsProperty)enumerator.Current; string propertyValue = property.DefaultValue.ToString(); // This fails: Null Reference string propertyDescription = property.Attributes["System.Configuration.SettingsDescriptionAttribute"].ToString(); // Do stuff with strings... } }

    Read the article

  • Doesn't Spring really support Interface injection at all?

    - by mrCoder
    Hi I know that Spring doesn't supports Interface injection and I've read that many a times. But today as I came across an article about IOC by Martin Fowler (link), it seems using ApplicationContextAware in Spring is some what similar to the Interface injection. when ever Spring' context reference is required in our Spring bean, we'll implement ApplicationContextAware and will implement the setApplicationContext(ApplicationContext context) method, and we'll include the bean in the config file. Is not this the same as Interface injection, where where telling the Spring to inject (or), say, pass the reference of the context into this bean? Or I m missing something here? Thanks for any information! ManiKanta

    Read the article

  • Creating a dynamic proxy generator with c# – Part 2 – Interceptor Design

    - by SeanMcAlinden
    Creating a dynamic proxy generator – Part 1 – Creating the Assembly builder, Module builder and caching mechanism For the latest code go to http://rapidioc.codeplex.com/ Before getting too involved in generating the proxy, I thought it would be worth while going through the intended design, this is important as the next step is to start creating the constructors for the proxy. Each proxy derives from a specified type The proxy has a corresponding constructor for each of the base type constructors The proxy has overrides for all methods and properties marked as Virtual on the base type For each overridden method, there is also a private method whose sole job is to call the base method. For each overridden method, a delegate is created whose sole job is to call the private method that calls the base method. The following class diagram shows the main classes and interfaces involved in the interception process. I’ll go through each of them to explain their place in the overall proxy.   IProxy Interface The proxy implements the IProxy interface for the sole purpose of adding custom interceptors. This allows the created proxy interface to be cast as an IProxy and then simply add Interceptors by calling it’s AddInterceptor method. This is done internally within the proxy building process so the consumer of the API doesn’t need knowledge of this. IInterceptor Interface The IInterceptor interface has one method: Handle. The handle method accepts a IMethodInvocation parameter which contains methods and data for handling method interception. Multiple classes that implement this interface can be added to the proxy. Each method override in the proxy calls the handle method rather than simply calling the base method. How the proxy fully works will be explained in the next section MethodInvocation. IMethodInvocation Interface & MethodInvocation class The MethodInvocation will contain one main method and multiple helper properties. Continue Method The method Continue() has two functions hidden away from the consumer. When Continue is called, if there are multiple Interceptors, the next Interceptors Handle method is called. If all Interceptors Handle methods have been called, the Continue method then calls the base class method. Properties The MethodInvocation will contain multiple helper properties including at least the following: Method Name (Read Only) Method Arguments (Read and Write) Method Argument Types (Read Only) Method Result (Read and Write) – this property remains null if the method return type is void Target Object (Read Only) Return Type (Read Only) DefaultInterceptor class The DefaultInterceptor class is a simple class that implements the IInterceptor interface. Here is the code: DefaultInterceptor namespace Rapid.DynamicProxy.Interception {     /// <summary>     /// Default interceptor for the proxy.     /// </summary>     /// <typeparam name="TBase">The base type.</typeparam>     public class DefaultInterceptor<TBase> : IInterceptor<TBase> where TBase : class     {         /// <summary>         /// Handles the specified method invocation.         /// </summary>         /// <param name="methodInvocation">The method invocation.</param>         public void Handle(IMethodInvocation<TBase> methodInvocation)         {             methodInvocation.Continue();         }     } } This is automatically created in the proxy and is the first interceptor that each method override calls. It’s sole function is to ensure that if no interceptors have been added, the base method is still called. Custom Interceptor Example A consumer of the Rapid.DynamicProxy API could create an interceptor for logging when the FirstName property of the User class is set. Just for illustration, I have also wrapped a transaction around the methodInvocation.Coninue() method. This means that any overriden methods within the user class will run within a transaction scope. MyInterceptor public class MyInterceptor : IInterceptor<User<int, IRepository>> {     public void Handle(IMethodInvocation<User<int, IRepository>> methodInvocation)     {         if (methodInvocation.Name == "set_FirstName")         {             Logger.Log("First name seting to: " + methodInvocation.Arguments[0]);         }         using (TransactionScope scope = new TransactionScope())         {             methodInvocation.Continue();         }         if (methodInvocation.Name == "set_FirstName")         {             Logger.Log("First name has been set to: " + methodInvocation.Arguments[0]);         }     } } Overridden Method Example To show a taster of what the overridden methods on the proxy would look like, the setter method for the property FirstName used in the above example would look something similar to the following (this is not real code but will look similar): set_FirstName public override void set_FirstName(string value) {     set_FirstNameBaseMethodDelegate callBase =         new set_FirstNameBaseMethodDelegate(this.set_FirstNameProxyGetBaseMethod);     object[] arguments = new object[] { value };     IMethodInvocation<User<IRepository>> methodInvocation =         new MethodInvocation<User<IRepository>>(this, callBase, "set_FirstName", arguments, interceptors);          this.Interceptors[0].Handle(methodInvocation); } As you can see, a delegate instance is created which calls to a private method on the class, the private method calls the base method and would look like the following: calls base setter private void set_FirstNameProxyGetBaseMethod(string value) {     base.set_FirstName(value); } The delegate is invoked when methodInvocation.Continue() is called within an interceptor. The set_FirstName parameters are loaded into an object array. The current instance, delegate, method name and method arguments are passed into the methodInvocation constructor (there will be more data not illustrated here passed in when created including method info, return types, argument types etc.) The DefaultInterceptor’s Handle method is called with the methodInvocation instance as it’s parameter. Obviously methods can have return values, ref and out parameters etc. in these cases the generated method override body will be slightly different from above. I’ll go into more detail on these aspects as we build them. Conclusion I hope this has been useful, I can’t guarantee that the proxy will look exactly like the above, but at the moment, this is pretty much what I intend to do. Always worth downloading the code at http://rapidioc.codeplex.com/ to see the latest. There will also be some tests that you can debug through to help see what’s going on. Cheers, Sean.

    Read the article

  • Use MacBook Pro airport for injection with kismac

    - by Am1rr3zA
    Hi, I want use kismac to break my WEP wireless password with my MacBook Pro but when I go to step that want to inject packets it's doesn't do anything! I some where read that MacBook Pro wireless cards don't support injection! Is that right? How can I solve this? If I must buy USB Wireless Modem which one is better ?

    Read the article

  • Expando Object and dynamic property pattern

    - by Al.Net
    I have read about 'dynamic property pattern' of Martin Fowler in his site under the tag 1997 in which he used dictionary kind of stuff to achieve this pattern. And I have come across about Expando object in c# very recently. When I see its implementation, I am able to see IDictionary implemented. So Expando object uses dictionary to store dynamic properties and is it what, Martin Fowler already defined 15 years ago?

    Read the article

  • Throwing exception from a property when my object state is invalid

    - by Rumi P.
    Microsoft guidelines say: "Avoid throwing exceptions from property getters", and I normally follow that. But my application uses Linq2SQL, and there is the case where my object can be in invalid state because somebody or something wrote nonsense into the database. Consider this toy example: [Table(Name="Rectangle")] public class Rectangle { [Column(Name="ID", IsPrimaryKey = true, IsDbGenerated = true)] public int ID {get; set;} [Column(Name="firstSide")] public double firstSide {get; set;} [Column(Name="secondSide")] public double secondSide {get; set;} public double sideRatio { get { return firstSide/secondSide; } } } Here, I could write code which ensures that my application never writes a Rectangle with a zero-length side into the database. But no matter how bulletproof I make my own code, somebody could open the database with a different application and create an invalid Rectangle, especially one with a 0 for secondSide. (For this example, please forget that it is possible to design the database in a way such that writing a side length of zero into the rectangle table is impossible; my domain model is very complex and there are constraints on model state which cannot be expressed in a relational database). So, the solution I am gravitating to is to change the getter to: get { if(firstSide > 0 && secondSide > 0) return firstSide/secondSide; else throw new System.InvalidOperationException("All rectangle sides should have a positive length"); } The reasoning behind not throwing exceptions from properties is that programmers should be able to use them without having to make precautions about catching and handling them them. But in this case, I think that it is OK to continue to use this property without such precautions: if the exception is thrown because my application wrote a non-zero rectangle side into the database, then this is a serious bug. It cannot and shouldn't be handled in the application, but there should be code which prevents it. It is good that the exception is visibly thrown, because that way the bug is caught. if the exception is thrown because a different application changed the data in the database, then handling it is outside of the scope of my application. So I can't do anything about it if I catch it. Is this a good enough reasoning to get over the "avoid" part of the guideline and throw the exception? Or should I turn it into a method after all? Note that in the real code, the properties which can have an invalid state feel less like the result of a calculation, so they are "natural" properties, not methods.

    Read the article

  • Un nouveau type d'attaques par injection SQL plus sophistiquées découvert par un cabinet de sécurité toucherait plus de 20.000 sites

    Un nouveau type plus sophistiqué d'attaques par injection SQL Découvert par un cabinet de sécurité, il toucherait plus de 20 000 sites Les attaques par injection SQL font partie des vulnérabilités les plus courantes dont sont victimes les applications Web. Mais cette « popularité » fait aussi que plusieurs mécanismes de défense ont été mis au point et sont couramment utilisés. Face à cette situation, des pirates auraient développé une nouvelle variante d'attaque par injection SQL. Elle utilise, selon la récente découverte de la société de sécurité Web Armorise, une forme simple de peer-to-peer. Traditionnellement, les attaques par injection SQL sont effectuées en exploitant...

    Read the article

  • escaping a dollar in the middle of an ant property

    - by jk
    I have a property whose value contains a $. I'd like to use this property as a regexp in a propertyregexp. Ant appears to resolve the property as a paramater to the propertyregexp, but then the dollar gets interpreted as a regexp symbol. Example: <property name="a" value="abc$" /> <property name="b" value="xyz" /> <path id="paths"> <pathelement location="abc$/def" /> <pathelement location="abc$/ghi" /> </path> <pathconvert property="list" refid="paths" pathsep="${line.separator}" dirsep="/" /> <propertyregex property="list" input="${list}" override="true" regexp="${a}(.*)" replace="${b}\1" /> <echo message="${list}" /> I'd like to the pair xyz/def and xyz/ghi. Is this possible? I'm using Ant 1.8.

    Read the article

  • Get the property, as a string, from an Expression<Func<TModel,TProperty>>

    - by Jaxidian
    I use some strongly-typed expressions that get serialized to allow my UI code to have strongly-typed sorting and searching expressions. These are of type Expression<Func<TModel,TProperty>> and are used as such: SortOption.Field = (p => p.FirstName);. I've gotten this working perfectly for this simple case. The code that I'm using for parsing the "FirstName" property out of there is actually reusing some existing functionality in a third-party product that we use and it works great, until we start working with deeply-nested properties(SortOption.Field = (p => p.Address.State.Abbreviation);). This code has some very different assumptions in the need to support deeply-nested properties. As for what this code does, I don't really understand it and rather than changing that code, I figured I should just write from scratch this functionality. However, I don't know of a good way to do this. I suspect we can do something better than doing a ToString() and performing string parsing. So what's a good way to do this to handle the trivial and deeply-nested cases? Requirements: Given the expression p => p.FirstName I need a string of "FirstName". Given the expression p => p.Address.State.Abbreviation I need a string of "Address.State.Abbreviation" While it's not important for an answer to my question, I suspect my serialization/deserialization code could be useful to somebody else who finds this question in the future, so it is below. Again, this code is not important to the question - I just thought it might help somebody. Note that DynamicExpression.ParseLambda comes from the Dynamic LINQ stuff and Property.PropertyToString() is what this question is about. /// <summary> /// This defines a framework to pass, across serialized tiers, sorting logic to be performed. /// </summary> /// <typeparam name="TModel">This is the object type that you are filtering.</typeparam> /// <typeparam name="TProperty">This is the property on the object that you are filtering.</typeparam> [Serializable] public class SortOption<TModel, TProperty> : ISerializable where TModel : class { /// <summary> /// Convenience constructor. /// </summary> /// <param name="property">The property to sort.</param> /// <param name="isAscending">Indicates if the sorting should be ascending or descending</param> /// <param name="priority">Indicates the sorting priority where 0 is a higher priority than 10.</param> public SortOption(Expression<Func<TModel, TProperty>> property, bool isAscending = true, int priority = 0) { Property = property; IsAscending = isAscending; Priority = priority; } /// <summary> /// Default Constructor. /// </summary> public SortOption() : this(null) { } /// <summary> /// This is the field on the object to filter. /// </summary> public Expression<Func<TModel, TProperty>> Property { get; set; } /// <summary> /// This indicates if the sorting should be ascending or descending. /// </summary> public bool IsAscending { get; set; } /// <summary> /// This indicates the sorting priority where 0 is a higher priority than 10. /// </summary> public int Priority { get; set; } #region Implementation of ISerializable /// <summary> /// This is the constructor called when deserializing a SortOption. /// </summary> protected SortOption(SerializationInfo info, StreamingContext context) { IsAscending = info.GetBoolean("IsAscending"); Priority = info.GetInt32("Priority"); // We just persisted this by the PropertyName. So let's rebuild the Lambda Expression from that. Property = DynamicExpression.ParseLambda<TModel, TProperty>(info.GetString("Property"), default(TModel), default(TProperty)); } /// <summary> /// Populates a <see cref="T:System.Runtime.Serialization.SerializationInfo"/> with the data needed to serialize the target object. /// </summary> /// <param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo"/> to populate with data. </param> /// <param name="context">The destination (see <see cref="T:System.Runtime.Serialization.StreamingContext"/>) for this serialization. </param> public void GetObjectData(SerializationInfo info, StreamingContext context) { // Just stick the property name in there. We'll rebuild the expression based on that on the other end. info.AddValue("Property", Property.PropertyToString()); info.AddValue("IsAscending", IsAscending); info.AddValue("Priority", Priority); } #endregion }

    Read the article

< Previous Page | 13 14 15 16 17 18 19 20 21 22 23 24  | Next Page >