Search Results

Search found 1303 results on 53 pages for 'injection'.

Page 26/53 | < Previous Page | 22 23 24 25 26 27 28 29 30 31 32 33  | Next Page >

  • How to know my wireless card has injection enabled?

    - by shrimpy
    I am playing around with aircrack. And was trying to see whether my wireless card on my laptop can pass the injection test And I end up seeing the following... does it mean my wireless card is not able to run aircrack? root@myubuntu:/home/myubuntu# iwconfig lo no wireless extensions. eth0 no wireless extensions. eth1 IEEE 802.11bg ESSID:"" Nickname:"" Mode:Managed Frequency:2.437 GHz Access Point: Not-Associated Bit Rate:54 Mb/s Tx-Power:24 dBm Retry min limit:7 RTS thr:off Fragment thr:off Power Management:off Link Quality=5/5 Signal level=0 dBm Noise level=-57 dBm Rx invalid nwid:0 Rx invalid crypt:781 Rx invalid frag:0 Tx excessive retries:0 Invalid misc:0 Missed beacon:0 root@myubuntu:/home/myubuntu# aireplay-ng -9 eth1 ioctl(SIOCSIWMODE) failed: Invalid argument ARP linktype is set to 1 (Ethernet) - expected ARPHRD_IEEE80211, ARPHRD_IEEE80211_FULL or ARPHRD_IEEE80211_PRISM instead. Make sure RFMON is enabled: run 'airmon-ng start eth1 <#>' Sysfs injection support was not found either. root@myubuntu:/home/myubuntu#

    Read the article

  • Do I only have to worry about XSS and Sql injection?

    - by Pranali Desai
    Hi All, I am writing an application and for this to make it safe I have decided to HtmlEncode and HtmlDecode the data to avoid Javascript Injection and Paramaterised queries to avoid Sql injection. But I want to know whether these are the best ways to avoid these attacks and what are the other ways to damage the application that I should take into consideration.

    Read the article

  • Can a whitespace regex character be used to perform a javascript injection? [migrated]

    - by webose
    if I want to validate the input of a <textarea>, and want it to contain, for example, only numerical values, but even want to give users the possibility to insert new lines, I can selected wanted characters with a javascript regex that includes even the whitespace characters. /[0-9\s]/ The question is: do a whitecharacter can be used to perform injections, XSS,even if I think this last option is impossible, or any other type of attack ? thanks

    Read the article

  • How to return the handle of a window when we click on it, without any DLL injection?

    - by Doo Dee
    Hello! For one of my projects, I need to create a function that will return a handle to a window when the user click on it (any window displayed on screen, and anywhere inside that window). I know it is possible to use a global hook, but I think there must be a more simple way of doing that, without using any DLL injection. In fact, I could intercept the left mouse click or intercept when a window is activated. Can I use one of those 2 solutions without any DLL injection?

    Read the article

  • Solving a cyclical dependency in Ninject (Compact Framework)

    - by Alex
    I'm trying to use Ninject for dependency injection in my MVP application. However, I have a problem because I have two types that depend on each other, thus creating a cyclic dependency. At first, I understand that it was a problem, because I had both types require each other in their constructors. Therefore, I moved one of the dependencies to a property injection instead, but I'm still getting the error message. What am I doing wrong? This is the presenter: public class LoginPresenter : Presenter<ILoginView>, ILoginPresenter { public LoginPresenter( ILoginView view ) : base( view ) { } } and this is the view: public partial class LoginForm : Form, ILoginView { [Inject] public ILoginPresenter Presenter { private get; set; } public LoginForm() { InitializeComponent(); } } And here's the code that causes the exception: static class Program { /// <summary> /// The main entry point for the application. /// </summary> [MTAThread] static void Main() { // Show the login form Views.LoginForm loginForm = Kernel.Get<Views.Interfaces.ILoginView>() as Views.LoginForm; Application.Run( loginForm ); } } The exception happens on the line with the Kernel.Get<>() call. Here it is: Error activating ILoginPresenter using binding from ILoginPresenter to LoginPresenter A cyclical dependency was detected between the constructors of two services. Activation path: 4) Injection of dependency ILoginPresenter into property Presenter of type LoginForm 3) Injection of dependency ILoginView into parameter view of constructor of type LoginPresenter 2) Injection of dependency ILoginPresenter into property Presenter of type LoginForm 1) Request for ILoginView Suggestions: 1) Ensure that you have not declared a dependency for ILoginPresenter on any implementations of the service. 2) Consider combining the services into a single one to remove the cycle. 3) Use property injection instead of constructor injection, and implement IInitializable if you need initialization logic to be run after property values have been injected. Why doesn't Ninject understand that since one is constructor injection and the other is property injection, this can work just fine? I even read somewhere looking for the solution to this problem that Ninject supposedly gets this right as long as the cyclic dependency isn't both in the constructors. Apparently not, though. Any help resolving this would be much appreciated.

    Read the article

  • Spring: Using "Lookup method injection" for my ThreadFactory looks not scalable.

    - by Michael Bavin
    Hi, We're building a ThreadFactory so everytime a singleton controller needs a new thread, i get a new instance everytime. Looking at Lookup method injection looks good but what if we have multiple threads. like: public abstract class ThreadManager { public abstract Thread createThreadDoA(); public abstract Thread createThreadDoB(); } and config: <bean id="threadManager" class="bla.ThreadManager" singleton="true"> <lookup-method name="createThreadA" bean="threadA" /> <lookup-method name="createThreadB" bean="threadB"/> </bean> <bean id="threadA" class="bla.ThreadA"> <bean id="threadB" class="bla.ThreadB"> and usage: threadManager.createThreadA(); I don't want to create an abstract "create" method for every new threadclass. Is it possible to make this generich like: threadManager.createThread(ThreadA.class); Thank you

    Read the article

  • C# and MySQL .NET Connector - Any way of preventing SQL Injection attacks in a generic class?

    - by John M
    My idea is to create some generic classes for Insert/Update/Select via a C# (3.5) Winforms app talking with a MySQL database via MySQL .NET Connector 6.2.2. For example: public void Insert(string strSQL) { if (this.OpenConnection() == true) { MySqlCommand cmd = new MySqlCommand(strSQL, connection); cmd.ExecuteNonQuery(); this.CloseConnection(); } } Then from anywhere in the program I can run a query with/without user input by just passing a SQL query string. Reading around on SO is starting to give me the indication that this may lead to SQL injection attacks (for any user-input values). Is there anyway of scrubbing the inputted strSQL or do I need to go and create individual parameterized queries in every method that needs to do a database function?

    Read the article

  • How do I get property injection working in Ninject for a ValidationAttribute in MVC?

    - by jaltiere
    I have a validation attribute set up where I need to hit the database to accomplish the validation. I tried setting up property injection the same way I do elsewhere in the project but it's not working. What step am I missing? public class ApplicationIDValidAttribute : ValidationAttribute { [Inject] protected IRepository<MyType> MyRepo; public override bool IsValid(object value) { if (value == null) return true; int id; if (!Int32.TryParse(value.ToString(), out id)) return false; // MyRepo is null here and is never injected var obj= MyRepo.LoadById(id); return (obj!= null); } One other thing to point out, I have the Ninject kernel set up to inject non-public properties, so I don't think that is the problem. I'm using Ninject 2, MVC 2, and the MVC 2 version of Ninject.Web.MVC. Thanks!

    Read the article

  • Oracle Inroduces a New Line of Defense for Databases

    - by roxana.bradescu
    Today at the 2011 RSA Conference, we announced the immediate availability of our new Oracle Database Firewall, the latest addition to a comprehensive portfolio of database security solutions. Oracle Database Firewall is a network-based software solution that monitors database traffic, and can detect and block SQL injection and other attacks from reaching Oracle and non-Oracle databases. According to the 2010 Verizon Data Breach Investigations Report, SQL injection attacks against databases are responsible for 89% of all breached data. SQL injection attacks are a technique for controlling responses from the database server through applications. This attack exploits the inherent trust between application layer and the back-end database. Previously the only way organizations had to safeguard against SQL injection attacks was a complete overhaul of their application code. Obviously a very costly, complex, and often impossible undertaking for most organizations. Enter the new Oracle Database Firewall. It can help prevent SQL injection attacks by establishing a defensive perimeter around your databases. The Oracle Database Firewall uses an innovative SQL grammar analysis to inspect the database traffic against pre-defined policies. Normal expected traffic is allowed to pass (and can be optionally logged to demonstrate regulatory compliance), ensuring no false positives or disruption to your business. SQL statements that are explicitly forbidden or unknown SQL statements can either pass, be logged, alert, block or be substitute with pre-defined SQL statements. Being able to substitute an unknown potentially harmful SQL statement with a harmless statement is especially powerful since it foils an attack while allowing the application to operate normally and preventing DoS attacks. So, if you're at RSA, stop by our booth or attend the session with Steve Moyle, Oracle Database Firewall CTO. Or if you want to learn more immediately, please watch our on-demand webcast and download the new Oracle Database Firewall Resource Kit with everything you need to get started today.

    Read the article

  • Please help! Delegate returns null via Dipendency Injection.

    - by Raj Aththanayake
    Can someone please help? I use Google code’s Moq framework for mocking within my Unit Tests and Unity for Dependency Injection. In my Test class private Mock<ICustomerSearchService> CustomerSearchServiceMock = null; private CustomerService customerService = null; private void SetupMainData() { CustomerSearchServiceMock = new Mock<ICustomerSearchService>(); customerService = new CustomerService (); // CustomerSearchService is a property in CustomerService and dependency is configuered via Unity customerService.CustomerSearchService = CustomerSearchServiceMock.Object; Customer c = new Customer () { ID = "AT" }; CustomerSearchServiceMock.Setup(s => s.GetCustomer(EqualsCondition)).Returns(c); } [TestMethod] public void GetCustomerData_Test_Method() { SetupMainData() var customer = customerService.GetCustomerData("AT"); } public static bool EqualsCondition(Customer customer) { return customer.ID.Equals("AT"); } In my Test class CustomerService class public class CustomerService : ICustomerService { [Dependency] public ICustomerSearchService CustomerSearchService { get; set; } public IEnumerable<SomeObject> GetCustomerData(string custID) { I GET Null for customer ?????} var customer = CustomerSearchService.GetCustomer (c => c.ID.Equals(custID)); //Do more things } } When I debug the code I can see CustomerSearchService has a proxy object, but the customer returns as null. Any ideas? Or is there something missing here? Note: ICustomerSearchService I have implemented below method. Customer GetCustomer(Func<Customer, bool> predicate);

    Read the article

  • Why do we (really) program to interfaces?

    - by Kyle Burns
    One of the earliest lessons I was taught in Enterprise development was "always program against an interface".  This was back in the VB6 days and I quickly learned that no code would be allowed to move to the QA server unless my business objects and data access objects each are defined as an interface and have a matching implementation class.  Why?  "It's more reusable" was one answer.  "It doesn't tie you to a specific implementation" a slightly more knowing answer.  And let's not forget the discussion ending "it's a standard".  The problem with these responses was that senior people didn't really understand the reason we were doing the things we were doing and because of that, we were entirely unable to realize the intent behind the practice - we simply used interfaces and had a bunch of extra code to maintain to show for it. It wasn't until a few years later that I finally heard the term "Inversion of Control".  Simply put, "Inversion of Control" takes the creation of objects that used to be within the control (and therefore a responsibility of) of your component and moves it to some outside force.  For example, consider the following code which follows the old "always program against an interface" rule in the manner of many corporate development shops: 1: ICatalog catalog = new Catalog(); 2: Category[] categories = catalog.GetCategories(); In this example, I met the requirement of the rule by declaring the variable as ICatalog, but I didn't hit "it doesn't tie you to a specific implementation" because I explicitly created an instance of the concrete Catalog object.  If I want to test the functionality of the code I just wrote I have to have an environment in which Catalog can be created along with any of the resources upon which it depends (e.g. configuration files, database connections, etc) in order to test my functionality.  That's a lot of setup work and one of the things that I think ultimately discourages real buy-in of unit testing in many development shops. So how do I test my code without needing Catalog to work?  A very primitive approach I've seen is to change the line the instantiates catalog to read: 1: ICatalog catalog = new FakeCatalog();   once the test is run and passes, the code is switched back to the real thing.  This obviously poses a huge risk for introducing test code into production and in my opinion is worse than just keeping the dependency and its associated setup work.  Another popular approach is to make use of Factory methods which use an object whose "job" is to know how to obtain a valid instance of the object.  Using this approach, the code may look something like this: 1: ICatalog catalog = CatalogFactory.GetCatalog();   The code inside the factory is responsible for deciding "what kind" of catalog is needed.  This is a far better approach than the previous one, but it does make projects grow considerably because now in addition to the interface, the real implementation, and the fake implementation(s) for testing you have added a minimum of one factory (or at least a factory method) for each of your interfaces.  Once again, developers say "that's too complicated and has me writing a bunch of useless code" and quietly slip back into just creating a new Catalog and chalking any test failures up to "it will probably work on the server". This is where software intended specifically to facilitate Inversion of Control comes into play.  There are many libraries that take on the Inversion of Control responsibilities in .Net and most of them have many pros and cons.  From this point forward I'll discuss concepts from the standpoint of the Unity framework produced by Microsoft's Patterns and Practices team.  I'm primarily focusing on this library because it questions about it inspired this posting. At Unity's core and that of most any IoC framework is a catalog or registry of components.  This registry can be configured either through code or using the application's configuration file and in the most simple terms says "interface X maps to concrete implementation Y".  It can get much more complicated, but I want to keep things at the "what does it do" level instead of "how does it do it".  The object that exposes most of the Unity functionality is the UnityContainer.  This object exposes methods to configure the catalog as well as the Resolve<T> method which is used to obtain an instance of the type represented by T.  When using the Resolve<T> method, Unity does not necessarily have to just "new up" the requested object, but also can track dependencies of that object and ensure that the entire dependency chain is satisfied. There are three basic ways that I have seen Unity used within projects.  Those are through classes directly using the Unity container, classes requiring injection of dependencies, and classes making use of the Service Locator pattern. The first usage of Unity is when classes are aware of the Unity container and directly call its Resolve method whenever they need the services advertised by an interface.  The up side of this approach is that IoC is utilized, but the down side is that every class has to be aware that Unity is being used and tied directly to that implementation. Many developers don't like the idea of as close a tie to specific IoC implementation as is represented by using Unity within all of your classes and for the most part I agree that this isn't a good idea.  As an alternative, classes can be designed for Dependency Injection.  Dependency Injection is where a force outside the class itself manipulates the object to provide implementations of the interfaces that the class needs to interact with the outside world.  This is typically done either through constructor injection where the object has a constructor that accepts an instance of each interface it requires or through property setters accepting the service providers.  When using dependency, I lean toward the use of constructor injection because I view the constructor as being a much better way to "discover" what is required for the instance to be ready for use.  During resolution, Unity looks for an injection constructor and will attempt to resolve instances of each interface required by the constructor, throwing an exception of unable to meet the advertised needs of the class.  The up side of this approach is that the needs of the class are very clearly advertised and the class is unaware of which IoC container (if any) is being used.  The down side of this approach is that you're required to maintain the objects passed to the constructor as instance variables throughout the life of your object and that objects which coordinate with many external services require a lot of additional constructor arguments (this gets ugly and may indicate a need for refactoring). The final way that I've seen and used Unity is to make use of the ServiceLocator pattern, of which the Patterns and Practices team has also provided a Unity-compatible implementation.  When using the ServiceLocator, your class calls ServiceLocator.Retrieve in places where it would have called Resolve on the Unity container.  Like using Unity directly, it does tie you directly to the ServiceLocator implementation and makes your code aware that dependency injection is taking place, but it does have the up side of giving you the freedom to swap out the underlying IoC container if necessary.  I'm not hugely concerned with hiding IoC entirely from the class (I view this as a "nice to have"), so the single biggest problem that I see with the ServiceLocator approach is that it provides no way to proactively advertise needs in the way that constructor injection does, allowing more opportunity for difficult to track runtime errors. This blog entry has not been intended in any way to be a definitive work on IoC, but rather as something to spur thought about why we program to interfaces and some ways to reach the intended value of the practice instead of having it just complicate your code.  I hope that it helps somebody begin or continue a journey away from being a "Cargo Cult Programmer".

    Read the article

  • Java EE 7 Survey Results!

    - by reza_rahman
    On November 8th, the Java EE EG posted a survey to gather broad community feedback on a number of critical open issues. For reference, you can find the original survey here. We kept the survey open for about three weeks until November 30th. To our delight, over 1100 developers took time out of their busy lives to let their voices be heard! The results of the survey were sent to the EG on December 12th. The subsequent EG discussion is available here. The exact summary sent to the EG is available here. We would like to take this opportunity to thank each and every one the individuals who took the survey. It is very appreciated, encouraging and worth it's weight in gold. In particular, I tried to capture just some of the high-quality, intelligent, thoughtful and professional comments in the summary to the EG. I highly encourage you to continue to stay involved, perhaps through the Adopt-a-JSR program. We would also like to sincerely thank java.net, JavaLobby, TSS and InfoQ for helping spread the word about the survey. Below is a brief summary of the results... APIs to Add to Java EE 7 Full/Web Profile The first question asked which of the four new candidate APIs (WebSocket, JSON-P, JBatch and JCache) should be added to the Java EE 7 Full and Web profile respectively. As the following graph shows, there was significant support for adding all the new APIs to the full profile: Support is relatively the weakest for Batch 1.0, but still good. A lot of folks saw WebSocket 1.0 as a critical technology with comments such as this one: "A modern web application needs Web Sockets as first class citizens" While it is clearly seen as being important, a number of commenters expressed dissatisfaction with the lack of a higher-level JSON data binding API as illustrated by this comment: "How come we don't have a Data Binding API for JSON" JCache was also seen as being very important as expressed with comments like: "JCache should really be that foundational technology on which other specs have no fear to depend on" The results for the Web Profile is not surprising. While there is strong support for adding WebSocket 1.0 and JSON-P 1.0 to the Web Profile, support for adding JCache 1.0 and Batch 1.0 is relatively weak. There was actually significant opposition to adding Batch 1. 0 (with 51.8% casting a 'No' vote). Enabling CDI by Default The second question asked was whether CDI should be enabled in Java EE environments by default. A significant majority of 73.3% developers supported enabling CDI, only 13.8% opposed. Comments such as these two reflect a strong general support for CDI as well as a desire for better Java EE alignment with CDI: "CDI makes Java EE quite valuable!" "Would prefer to unify EJB, CDI and JSF lifecycles" There is, however, a palpable concern around the performance impact of enabling CDI by default as exemplified by this comment: "Java EE projects in most cases use CDI, hence it is sensible to enable CDI by default when creating a Java EE application. However, there are several issues if CDI is enabled by default: scanning can be slow - not all libs use CDI (hence, scanning is not needed)" Another significant concern appears to be around backwards compatibility and conflict with other JSR 330 implementations like Spring: "I am leaning towards yes, however can easily imagine situations where errors would be caused by automatically activating CDI, especially in cases of backward compatibility where another DI engine (such as Spring and the like) happens to use the same mechanics to inject dependencies and in that case there would be an overlap in injections and probably an uncertain outcome" Some commenters such as this one attempt to suggest solutions to these potential issues: "If you have Spring in use and use javax.inject.Inject then you might get some unexpected behavior that could be equally confusing. I guess there will be a way to switch CDI off. I'm tempted to say yes but am cautious for this reason" Consistent Usage of @Inject The third question was around using CDI/JSR 330 @Inject consistently vs. allowing JSRs to create their own injection annotations. A slight majority of 53.3% developers supported using @Inject consistently across JSRs. 28.8% said using custom injection annotations is OK, while 18.0% were not sure. The vast majority of commenters were strongly supportive of CDI and general Java EE alignment with CDI as illistrated by these comments: "Dependency Injection should be standard from now on in EE. It should use CDI as that is the DI mechanism in EE and is quite powerful. Having a new JSR specific DI mechanism to deal with just means more reflection, more proxies. JSRs should also be constructed to allow some of their objects Injectable. @Inject @TransactionalCache or @Inject @JMXBean etc...they should define the annotations and stereotypes to make their code less procedural. Dog food it. If there is a shortcoming in CDI for a JSR fix it and we will all be grateful" "We're trying to make this a comprehensive platform, right? Injection should be a fundamental part of the platform; everything else should build on the same common infrastructure. Each-having-their-own is just a recipe for chaos and having to learn the same thing 10 different ways" Expanding the Use of @Stereotype The fourth question was about expanding CDI @Stereotype to cover annotations across Java EE beyond just CDI. A significant majority of 62.3% developers supported expanding the use of @Stereotype, only 13.3% opposed. A majority of commenters supported the idea as well as the theme of general CDI/Java EE alignment as expressed in these examples: "Just like defining new types for (compositions of) existing classes, stereotypes can help make software development easier" "This is especially important if many EJB services are decoupled from the EJB component model and can be applied via individual annotations to Java EE components. @Stateless is a nicely compact annotation. Code will not improve if that will have to be applied in the future as @Transactional, @Pooled, @Secured, @Singlethreaded, @...." Some, however, expressed concerns around increased complexity such as this commenter: "Could be very convenient, but I'm afraid if it wouldn't make some important class annotations less visible" Expanding Interceptor Use The final set of questions was about expanding interceptors further across Java EE... A very solid 96.3% of developers wanted to expand interceptor use to all Java EE components. 35.7% even wanted to expand interceptors to other Java EE managed classes. Most developers (54.9%) were not sure if there is any place that injection is supported that should not support interceptors. 32.8% thought any place that supports injection should also support interceptors. Only 12.2% were certain that there are places where injection should be supported but not interceptors. The comments reflected the diversity of opinions, generally supportive of interceptors: "I think interceptors are as fundamental as injection and should be available anywhere in the platform" "The whole usage of interceptors still needs to take hold in Java programming, but it is a powerful technology that needs some time in the Sun. Basically it should become part of Java SE, maybe the next step after lambas?" A distinct chain of thought separated interceptors from filters and listeners: "I think that the Servlet API already provides a rich set of possibilities to hook yourself into different Servlet container events. I don't find a need to 'pollute' the Servlet model with the Interceptors API"

    Read the article

  • Using Unity – Part 4

    - by nmarun
    In this part, I’ll be discussing about constructor and property or setter injection. I’ve created a new class – Product3: 1: public class Product3 : IProduct 2: { 3: public string Name { get; set; } 4: [Dependency] 5: public IDistributor Distributor { get; set; } 6: public ILogger Logger { get; set; } 7:  8: public Product3(ILogger logger) 9: { 10: Logger = logger; 11: Name = "Product 1"; 12: } 13:  14: public string WriteProductDetails() 15: { 16: StringBuilder productDetails = new StringBuilder(); 17: productDetails.AppendFormat("{0}<br/>", Name); 18: productDetails.AppendFormat("{0}<br/>", Logger.WriteLog()); 19: productDetails.AppendFormat("{0}<br/>", Distributor.WriteDistributorDetails()); 20: return productDetails.ToString(); 21: } 22: } This version has a property of type IDistributor and takes a constructor parameter of type ILogger. The IDistributor property has a Dependency attribute (Microsoft.Practices.Unity namespace) applied to it. IDistributor and its implementation are shown below: 1: public interface IDistributor 2: { 3: string WriteDistributorDetails(); 4: } 5:  6: public class Distributor : IDistributor 7: { 8: public List<string> DistributorNames = new List<string>(); 9:  10: public Distributor() 11: { 12: DistributorNames.Add("Distributor1"); 13: DistributorNames.Add("Distributor2"); 14: DistributorNames.Add("Distributor3"); 15: DistributorNames.Add("Distributor4"); 16: } 17: public string WriteDistributorDetails() 18: { 19: StringBuilder distributors = new StringBuilder(); 20: for (int i = 0; i < DistributorNames.Count; i++) 21: { 22: distributors.AppendFormat("{0}<br/>", DistributorNames[i]); 23: } 24: return distributors.ToString(); 25: } 26: } ILogger and the FileLogger have the following definition: 1: public interface ILogger 2: { 3: string WriteLog(); 4: } 5:  6: public class FileLogger : ILogger 7: { 8: public string WriteLog() 9: { 10: return string.Format("Type: {0}", GetType()); 11: } 12: } The Unity container creates an instance of the dependent class (the Distributor class) within the scope of the target object (an instance of Product3 class that will be called by doing a Resolve<IProduct>() in the calling code) and assign this dependent object to the attributed property of the target object. To add to it, property injection is a form of optional injection of dependent objects.The dependent object instance is generated before the container returns the target object. Unlike constructor injection, you must apply the appropriate attribute in the target class to initiate property injection. Let’s see how to change the config file to make this work. The first step is to add all the type aliases: 1: <typeAlias alias="Product3" type="ProductModel.Product3, ProductModel"/> 2: <typeAlias alias="ILogger" type="ProductModel.ILogger, ProductModel"/> 3: <typeAlias alias="FileLogger" type="ProductModel.FileLogger, ProductModel"/> 4: <typeAlias alias="IDistributor" type="ProductModel.IDistributor, ProductModel"/> 5: <typeAlias alias="Distributor" type="ProductModel.Distributor, ProductModel"/> Now define mappings for these aliases: 1: <type type="ILogger" mapTo="FileLogger" /> 2: <type type="IDistributor" mapTo="Distributor" /> Next step is to define the constructor and property injection in the config file: 1: <type type="IProduct" mapTo="Product3" name="ComplexProduct"> 2: <typeConfig extensionType="Microsoft.Practices.Unity.Configuration.TypeInjectionElement, Microsoft.Practices.Unity.Configuration"> 3: <constructor> 4: <param name="logger" parameterType="ILogger" /> 5: </constructor> 6: <property name="Distributor" propertyType="IDistributor"> 7: <dependency /> 8: </property> 9: </typeConfig> 10: </type> There you see a constructor element that tells there’s a property named ‘logger’ that is of type ILogger. By default, the type of ILogger gets resolved to type FileLogger. There’s also a property named ‘Distributor’ which is of type IDistributor and which will get resolved to type Distributor. On the calling side, I’ve added a new button, whose click event does the following: 1: protected void InjectionButton_Click(object sender, EventArgs e) 2: { 3: unityContainer.RegisterType<IProduct, Product3>(); 4: IProduct product3 = unityContainer.Resolve<IProduct>(); 5: productDetailsLabel.Text = product3.WriteProductDetails(); 6: } This renders the following output: This completes the part for constructor and property injection. In the next blog, I’ll talk about Arrays and Generics. Please see the code used here.

    Read the article

  • Are there any drawbacks to class-based Javascript injection?

    - by jonathanconway
    A phenomena I'm seeing more and more of is Javascript code that is tied to a particular element on a particular page, rather than being tied to kinds of elements or UI patterns. For example, say we had a couple of animated menus on a page: <ul id="top-navigation"> ... </ul> <!-- ... --> <ul id="product-list"> ... </ul> These two menus might exist on the same page or on different pages, and some pages mightn't have any menus. I'll often see Javascript code like this (for these examples, I'm using jQuery): $(document).ready(function() { $('ul#top-navigation').dropdownMenu(); $('ul#product-selector').dropdownMenu(); }); Notice the problem? The Javascript is tightly coupled to particular instances of a UI pattern rather than the UI pattern itself. Now wouldn't it be so much simpler (and cleaner) to do this instead? - $(document).ready(function() { $('ul.dropdown-menu').dropdownMenu(); }); Then we can put the 'dropdown-menu' class on our lists like so: <ul id="top-navigation" class="dropdown-menu"> ... </ul> <!-- ... --> <ul id="product-list" class="dropdown-menu"> ... </ul> This way of doing things would have the following benefits: Simpler Javascript - we only need to attach once to the class. We avoid looking for specific instances that mightn't exist on a given page. If we remove an element, we don't need to hunt through the Javascript to find the attach code for that element. I believe techniques similar to this were pioneered by certain articles on alistapart.com. I'm amazed these simple techniques still haven't gained widespread adoption, and I still see 'best-practice' code-samples and Javascript frameworks referring directly to UI instances rather than UI patterns. Is there any reason for this? Is there some big disadvantage to the technique I just described that I'm unaware of?

    Read the article

  • How does CDI injection work in MDBs and @Scheduled beans?

    - by Nils-Petter Nilsen
    I'm working on a large Java EE 6 application that is deployed on JBoss 6 Final. My current tasks involve using @Inject consistently instead of @EJB, but I'm running into some problems on some types of beans, specifically @MessageDriven beans and beans with @Scheduled methods. What happens is that if I'm unlucky with the timing (for @Schedule) or if there are messages in the MDBs' queues at startup, instantiation of the beans will fail because the injected resources (which are EJBs themselves) are not bound yet. Because I use @Inject, I'm guessing that the EJB container considers my beans to be ready, since the container itself does not care about @Inject; it probably simply assumes that since there are no @EJB injections, the beans are ready for use. The injected CDI proxies will then fail because the resources to inject aren't actually bound yet. Tiny example: @Stateless @LocalBean public class MySupportingBean { public void doSomething() { ... } } @Singleton public class MyScheduledBean { @Inject private MySupportingBean supportingBean; @Schedule(second = "*/1", hour = "*", minute = "*", persistent = false) public void onTimeout() { supportingBean.doSomething(); } } The above example will probably not fail often because there are only two beans, but the project I'm working on binds lots of EJBs, which will amplify the problem. But it might fail because there is no guarantee that MySupportingBean is bound first, and if onTimeout is invoked before MySupportingBean is bound, then instantiation of MyScheduledBean will fail. If I used @EJB instead, MyScheduledBean wouldn't be bound until the dependency to MySupportingBean was satisfied. Note that the example will not fail in onTimeout itself, but when CDI attempts to inject MySupportingBean. I've read a lot of posts on different forums where many people argue that @Inject is always better. Generally, I agree, but how do they handle @Schedule or @MessageDriven combined with @Inject? In my experience, it comes down to dumb luck whether the beans will work or not in those cases, and the beans will fail arbitrarily, depending on which order the EJBs are deployed in, and when @Schedule or onMessage are invoked.

    Read the article

  • I need to parameterize against sql injection in asp classic, what things should I take some time to

    - by Tchalvak
    I can already see that I'm not going to enjoy the experience, but I have to do some sql cleanup on this 1000 file asp classic web-app, and before I get to hacking away at it I'd like to be aware of any major gotchas to watch out for with asp classic/sql parameter preparing/asp whitespace altering. What are some good quick overview resources, and what should I watch out for?

    Read the article

  • ASP.NET MVC: trying out a script injection hangs Visual Studio 2010 completely?

    - by Mark Redman
    Wondering if anyone has an idea of whats going on: I am new to ASP.NET MVC and am trying out a few things with jquery/ajax. The basic scenario is a dropdownlist with an add button next to it. Clicking the add button launches a jquery ui dialog with a textbox form, entering a value saves the item to the database and refreshes the drop-downlist. The dropdownlist is re-populated using a JSON result. This all works ok. I thought I would try a script injetion attack, ie add the text: alert("oh dear") to seee what would happen and to check if I need to encode anything. When I try and save this item (similar to the same process of adding a plain text entry) Visual Studio 2010 Beta 2 hangs completely. Any ideas? UPDATE: It happens when posting: "</"

    Read the article

  • The Debut of Oracle Database Firewall at RSA 2011

    - by Troy Kitch
    We're very proud of the coverage and headlines Oracle Database Firewall made this past week during RSA Conference 2011 in San Francisco. In case you missed our previous post, we announced the availability of this latest addition to the Oracle Defense-in-Depth database security solutions. The announcement was picked up many publications including eWeek, CRN, InformationWeek and more. Here is just some of the press on this very important security solution: "It's rare to find a new product category these days, but I think a new product from Oracle fills the bill. In the crowded enterprise security field, that's saying something." Enterprise System Journal: A New Approach to Database Security By James E. Powell "Databases and the content they store are among the most valuable IT assets - and the most targeted by hackers. In an effort to help secure databases, Oracle today is launching the new Oracle Database Firewall as an approach to defend databases against SQL injection and other database attacks." Database Journal: Oracle Debuts Database Firewall (also appeared in InternetNews.com) By Sean Michael Kerner "Oracle Database Firewall understands SQL-statement formats, and can be configured to blacklist and whitelist traffic based on source. When it detects suspicious statements within SQL traffic -- ones that might indicate SQL injection attacks, for example -- it can replace them with neutral statements that will keep the session running without allowing potentially harmful traffic through." Network World: Oracle Database Firewall defuses SQL injection attacks By Tim Green "The firewall uses "SQL grammar analysis" to prevent SQL injection attacks and other attempts to grab information. The Oracle Database Firewall features white and black lists policies, exceptions and rules that mark the time of day, IP address, application and user." ZDNet: RSA Roundup: Oracle Database Firewall By Larry Dignan "The database giant announced Oracle Database Firewall on Feb. 14 at the RSA Conference in San Francisco. The firewall application establishes a "defensive perimeter" around databases by monitoring and enforcing normal application behavior in real-time, the company said." eWEEK: Oracle Database Firewall Delivers Vendor-Agnostic Security By Fahmida Y. Rashid

    Read the article

  • Top 25 security issues for developers of web sites

    - by BizTalk Visionary
    Sourced from: CWE This is a brief listing of the Top 25 items, using the general ranking. NOTE: 16 other weaknesses were considered for inclusion in the Top 25, but their general scores were not high enough. They are listed in the On the Cusp focus profile. Rank Score ID Name [1] 346 CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') [2] 330 CWE-89 Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') [3] 273 CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') [4] 261 CWE-352 Cross-Site Request Forgery (CSRF) [5] 219 CWE-285 Improper Access Control (Authorization) [6] 202 CWE-807 Reliance on Untrusted Inputs in a Security Decision [7] 197 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [8] 194 CWE-434 Unrestricted Upload of File with Dangerous Type [9] 188 CWE-78 Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection') [10] 188 CWE-311 Missing Encryption of Sensitive Data [11] 176 CWE-798 Use of Hard-coded Credentials [12] 158 CWE-805 Buffer Access with Incorrect Length Value [13] 157 CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP File Inclusion') [14] 156 CWE-129 Improper Validation of Array Index [15] 155 CWE-754 Improper Check for Unusual or Exceptional Conditions [16] 154 CWE-209 Information Exposure Through an Error Message [17] 154 CWE-190 Integer Overflow or Wraparound [18] 153 CWE-131 Incorrect Calculation of Buffer Size [19] 147 CWE-306 Missing Authentication for Critical Function [20] 146 CWE-494 Download of Code Without Integrity Check [21] 145 CWE-732 Incorrect Permission Assignment for Critical Resource [22] 145 CWE-770 Allocation of Resources Without Limits or Throttling [23] 142 CWE-601 URL Redirection to Untrusted Site ('Open Redirect') [24] 141 CWE-327 Use of a Broken or Risky Cryptographic Algorithm [25] 138 CWE-362 Race Condition Cross-site scripting and SQL injection are the 1-2 punch of security weaknesses in 2010. Even when a software package doesn't primarily run on the web, there's a good chance that it has a web-based management interface or HTML-based output formats that allow cross-site scripting. For data-rich software applications, SQL injection is the means to steal the keys to the kingdom. The classic buffer overflow comes in third, while more complex buffer overflow variants are sprinkled in the rest of the Top 25.

    Read the article

< Previous Page | 22 23 24 25 26 27 28 29 30 31 32 33  | Next Page >