Updates from March, 2011 Toggle Comment Threads | Keyboard Shortcuts

  • Nickolas Golubev 20:19 on March 29, 2011 Permalink | Reply  

    MySQL website comprimised by blind SQL injection attack 

    I found this new story to be quite ironic: http://www.h-online.com/security/news/item/MySQL-allegedly-hacked-via-SQL-injection-1216281.html

    Apparently the public facing mysql.com site was attacked through a blind SQL injection attack: ( https://secure.wikimedia.org/wikipedia/en/wiki/SQL_injection#Blind_SQL_injection ) and the internal database structure published by the hacker as proof.

    It really shows why Injection is #1 on the OWASP Top 10 list ( http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project )  when a large SQL vendor (Owned by Oracle) can’t even protect  against Blind SQL Injection on their public facing site!

     
  • Nickolas Golubev 16:55 on March 24, 2011 Permalink | Reply  

    Cryptic Hibernate Reverse Engineering Wizard Error 

    Today I tried to create some POJOs / HBM files automatically from a legacy database using the Netbeans 6.8 Hibernate tools. Everything was going great before and I could connect to the database using my hibernate.cfg.xml file in the actual code but then I ran the “Hibernate Reverse Engineering Wizard”…

    Problem #1: It could not find my hibernate.cfg.xml and I had to copy this file into my actual package directory where I was trying to generate the files.

    Problem #2: Okay the hibernate.cfg.xml was now read but a new error showed up “Database drivers are not added to the project classpath. Go to project properties to add database library.”

    After some digging around I finally figured out that the error is somewhat cryptic. The Microsoft SQL Server JDBC 4 library was actually in the path but the real problem was the connection string and the lack of specifying a connection driver class.


    Previously I had:

    name="hibernate.connection.url">
    jdbc:sqlserver://MY_SERVER:1433

    This had to be changed to:

    com.microsoft.sqlserver.jdbc.SQLServerDriver
    jdbc:sqlserver://MY_SERVER:1433;databaseName=MY_DATABASE


    Now the wizard did not error out any-more, success!



    Problem #3: While the wizard no longer errored out it also did not show a list of available tables, no matter though it did generate a very generic hibernate.reveng.xml file. The “New Hibernate Mapping Files and POJOs From Database” wizard accepted this file and created POJOs / HBM for every single table in the database. The only issue here was that I had to manually delete the default sys. schema tables which were of no use to me.

     
  • Nickolas Golubev 20:03 on March 22, 2011 Permalink | Reply  

    Unicode Technical Report #36 Unicode Security Considerations 

    This is an interesting read from the Unicode company:
    http://unicode.org/reports/tr36/ “Unicode Technical Report #36 Unicode Security Considerations”

    A great read on how Unicode character input and subsequent normalisation can be used as an attack vector.

     
  • Nickolas Golubev 16:06 on March 22, 2011 Permalink | Reply  

    Full circle: POJO to XSD to JAXB Generated Object 

    I have been exploring the most simple ways to serialise / generate XML from a POJO. I have used XStream a few years ago but wanted to try the JAXB Marshaller instead.

    I added some @XmlRootElement annotations to my POJO and child POJO (I guess making them less POJO like in the process).

    Then the @XmlTransient annotation had to be added to the child’s parent reference in order to avoid the “A cycle is detected in the object graph. This will cause infinitely deep XML” error and make JAXB ignore this reference on serialization.

    Generating XML at that point was pretty simple:

    java.io.StringWriter xmlSW = new StringWriter();
    JAXBContext jaxbContext = JAXBContext.newInstance(myPojo.getClass()); Marshaller marshaller = jaxbContext.createMarshaller();
    marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, true);
    marshaller.setProperty(Marshaller.JAXB_ENCODING, "UTF-8");
    marshaller.marshal(myPojo, xmlSW);
    log.debug("Our XML: " + xmlSW.toString());

    Then to get the XSD and write it system.out:

    java.io.StringWriter xsdSW = new StringWriter();
    JAXBContext jaxbContext = JAXBContext.newInstance(myPojo.getClass());
    final List results = new ArrayList();
    jaxbContext.generateSchema(
    new SchemaOutputResolver(){

    @Override
    public Result createOutput(String ns, String file)
    throws IOException {
    DOMResult result = new DOMResult();
    result.setSystemId(file);
    results.add(result);
    return result;
    }
    });


    DOMResult domResult = results.get(0);
    Document doc = (Document) domResult.getNode();
    OutputFormat format = new OutputFormat(doc);
    format.setIndenting(true);
    XMLSerializer serializer = new XMLSerializer(xsdSW, format);
    serializer.serialize(doc);

    log.debug("Our XSD: " + xsdSW.toString());

    The cool thing that can be done now with the XSD is to run it through the JAXB generator which will re-create the parent and child classes automatically, with even more (somewhat assumed) annotations.

    Just thought it was a cool how you can go from POJO to XML/XSD back to a POJO relatively easily. Sort of similar to what you can do with WSDLs and creating web services and web service client’s with skeleton code around them using JAXB.

     
c
compose new post
j
next post/next comment
k
previous post/previous comment
r
reply
e
edit
o
show/hide comments
t
go to top
l
go to login
h
show/hide help
shift + esc
cancel