Saturday Morning: Website Security Time...

Recently a couple of our sites have been subject to SQL Injection Attacks but non have suffered so hard as the one I'm currently securing.

I spent all day yesterday on it and I've been up since 9AM when the head IT guy from our client called (and woke) me.

So after I get this thing done, and then enjoy what is left of my weekend I plan on writing up my learnings and educating my co-workers. Keep an eye out for a blog post or two.

Shout out's...

Just a quick shout out to Gav who's just got his blog up and running by the looks of things.

Check out http://www.sublunary.co.uk/

And to the inyerface folks for another excellent production this Friday and Saturday at the Library Theater in Sheffield.

How to move the viewstate to the bottom of your page source (C# ASP.NET 2.0, 3.0, 2.5, Visual Studio 2005, Visual Studio 2008)

Last week one of our new SEO bod, Ryan, asked Sel to move the viewstate to the bottom of the page source for the rest assured site. This helps to improve your SEOness as a lot of search engines only take so much of your source into account when spidering. So you really don't want to be feeding them 32k of base64 encoded gibberish when you could be giving them some beautifully crafted copy!

Andy did a couple of Google's and found some code which did the trick perfectly.

protected override void Render(System.Web.UI.HtmlTextWriter writer) {
    System.IO.StringWriter stringWriter = new System.IO.StringWriter();
    HtmlTextWriter htmlWriter = new HtmlTextWriter(stringWriter);
 
    base.Render(htmlWriter);
    string html = stringWriter.ToString();
 
    int StartPoint = html.IndexOf("<input type="hidden" name="__VIEWSTATE");
 
    if (StartPoint >= 0) {
        int EndPoint = html.IndexOf("/>", StartPoint) + 2;
        string viewstateInput = html.Substring(StartPoint, EndPoint - StartPoint);
        html = html.Remove(StartPoint, EndPoint - StartPoint);
        int FormEndStart = html.IndexOf("</form>") - 1;
        if (FormEndStart >= 0) {
            html = html.Insert(FormEndStart, viewstateInput);
        }
    }
    writer.Write(html);
}

This was ace and so today when I was asked to upload some ammends to a couple more of our clients sites I thought I would implement this for the same reasons as it only takes two seconds.

While it worked a treat on one of the sites, the other was not so good. Here's what the page should look like:

And here's what I got:


What has happened is this. The un-styled UL that you can see at the top of the page is the top half of the left hand navigation you can see in the 1st picture. This menu was implemented as a .NET user control and as such is treated like a page all of its own. The reason this happened is because the page was rendering out via our overridden method, but the control was not. So the HTML that the control generated was getting written to the output stream before the HTML of the Page ("Page" in the .NET Class sense, not the "web page" sense).

So this got me thinking, wouldn't it be nice to be able to have a single piece of code that could be applied to a site once, regardless of UserControls, MasterPages or any other intricacy, that would take care of moving the ViewState on every page of the site!?!

The answer: Yes!
The solution: an HttpModule...

An HttpModule is a piece of code that sits between your web application and IIS on the web server. What this module is going to do is intercept every response our application makes to a client and then, if the response is a HTML (read ASPX) page, look for and move the ViewState.

To do this we will filter the response stream using the Response.Filter property. I'll leave the full code until the end of the post but here are the main bits.

1) Create a new class that implements IHttpModule.

public sealed class IHttpViewstateMover : IHttpModule {

2) Add an event handler to the current request. This even then decides weather to add our filter to the response stream based on if it is outputting HTML.

public void Init (HttpApplication context) {
    context.ReleaseRequestState += new EventHandler(context_ReleaseRequestState);
}

void context_ReleaseRequestState (object sender, EventArgs e) {
    HttpResponse response = HttpContext.Current.Response;

    if ( response.ContentType == "text/html" ) {
        response.Filter = new ViewstateMover(response.Filter);
    }
}

3) If the entire HTML file has been output ...

Regex eof = new Regex("</html>", RegexOptions.IgnoreCase);

if ( !eof.IsMatch(strBuffer) ) {
    // code to follow...

re-position the viewstate and output the altered HTML to the stream.

    string finalHtml = _output_buffer.ToString();

    int StartPoint = finalHtml.IndexOf("<input type="hidden" name="__VIEWSTATE");
    if ( StartPoint >= 0 ) {
        int EndPoint = finalHtml.IndexOf("/>", StartPoint) + 2;
        string viewstateInput = finalHtml.Substring(StartPoint, EndPoint - StartPoint);
        finalHtml = finalHtml.Remove(StartPoint, EndPoint - StartPoint);
        int FormEndStart = finalHtml.IndexOf("</form>") - 1;
        if ( FormEndStart >= 0 ) {
            finalHtml = finalHtml.Insert(FormEndStart, viewstateInput);
        }
    }


    byte[] data = UTF8Encoding.UTF8.GetBytes(finalHtml);

    _output_stream.Write(data, 0, data.Length);

Simple as!

Now all you need to do us take the full code listing (below) and paste it into a C# file. Then add the following to your web.config inside the element:

So here's the code.

// Source code for IHttpViewstateMover.cs
using System;
using System.IO;
using System.Text;
using System.Text.RegularExpressions;
using System.Web;

/// <summary>
/// IHttpViewstateMover is a HttpModule that moves the viewstate
/// to the bottom of the HTML source to help with SEO
/// </summary>
public sealed class IHttpViewstateMover : IHttpModule {
    // the class is sealed so it cannot be inherited

    public void Dispose () {
        // nothing to dispose
    }

    public void Init (HttpApplication context) {
        context.ReleaseRequestState += new EventHandler(context_ReleaseRequestState);
    }

    void context_ReleaseRequestState (object sender, EventArgs e) {
        HttpResponse response = HttpContext.Current.Response;

        // Uncomment the following line if you only want to recieve a single call to ViewstateMover.Write
        // context.Response.Buffer = true;

        if ( response.ContentType == "text/html" ) {
            response.Filter = new ViewstateMover(response.Filter);
        }
    }


    /// <summary>
    /// ViewstateMover is the workhorse of the IHttpViewstateMover
    /// </summary>
    private class ViewstateMover : Stream {
        // this class is private as it serves no real purpose outside this implementation

        private Stream _output_stream;
        private long _position;
        private StringBuilder _output_buffer;

        /// <summary>
        /// Creates a new instance of the ViewstateMover class
        /// </summary>
        /// <param name="input_stream">The HttpResponse.Filter to work with</param>
        public ViewstateMover (Stream input_stream) {
            _output_stream = input_stream;
            _output_buffer = new StringBuilder();
        }

        #region Stream Members

        public override bool CanRead {
            get { return true; }
        }

        public override bool CanSeek {
            get { return true; }
        }

        public override bool CanWrite {
            get { return true; }
        }

        public override void Close () {
            _output_stream.Close();
        }

        public override void Flush () {
            _output_stream.Flush();
        }

        public override long Length {
            get { return 0; }
        }

        public override long Position {
            get { return _position; }
            set { _position = value; }
        }

        public override long Seek (long offset, SeekOrigin origin) {
            return _output_stream.Seek(offset, origin);
        }

        public override void SetLength (long length) {
            _output_stream.SetLength(length);
        }

        public override int Read (byte[] buffer, int offset, int count) {
            return _output_stream.Read(buffer, offset, count);
        }
        #endregion

        public override void Write (byte[] buffer, int offset, int count) {
            string strBuffer = UTF8Encoding.UTF8.GetString(buffer, offset, count);

            // check for the closing HTML tag
            Regex eof = new Regex("</html>", RegexOptions.IgnoreCase);

            if ( !eof.IsMatch(strBuffer) ) {
                _output_buffer.Append(strBuffer);
            } else {
                _output_buffer.Append(strBuffer);
                string finalHtml = _output_buffer.ToString();

                // original code from http://www.hanselman.com/blog/MovingViewStateToTheBottomOfThePage.aspx
                int StartPoint = finalHtml.IndexOf("<input type="hidden" name="__VIEWSTATE");
                if ( StartPoint >= 0 ) {
                    int EndPoint = finalHtml.IndexOf("/>", StartPoint) + 2;
                    string viewstateInput = finalHtml.Substring(StartPoint, EndPoint - StartPoint);
                    finalHtml = finalHtml.Remove(StartPoint, EndPoint - StartPoint);
                    int FormEndStart = finalHtml.IndexOf("</form>") - 1;
                    if ( FormEndStart >= 0 ) {
                        finalHtml = finalHtml.Insert(FormEndStart, viewstateInput);
                    }
                }


                byte[] data = UTF8Encoding.UTF8.GetBytes(finalHtml);
                // write the page countents out to the user
                _output_stream.Write(data, 0, data.Length);
            }
        }
    }
}

As ever, the code is provided as is, with no kind of waranty so please test thoroughly before you place in a production environment. You use this code at your own risk.

On Aire

I started thinking about On Aire ages ago as a project that would enable me and my work mates to do things we don't get chance to look at and explore in our 9-to-5 but to date all that has come from it is a blog post and a domain registration...

Now that summer has (almost) got a hold of the UK I find that Gina and myself are asking more and more where we could go out for food or a relaxed drink in comfortable yet stylish (poncy twat?) sorroundings.

And so this has started me thinking again about the idea behind On Aire, to provide a personalized guide to *evening entertainments* (tm) in the area of the river Aire (which is about 90% of Leeds depending on how liberal you are).

So hopefully my ever expanding network of half started projetcs will be growing once again with the addition of a social network stylée food/drink bar/resturante recomendation thing.

I'm going to try and get Brain and the Flash guys on board with a nice AIR app (half of the projects name sake, trying to be all web 2.ohhhhhhhhhhhhhhhhhhh or something) that will make suggestions where you might eat or drink that day or evening.

In theory this could be expanded to any and all kind of events and other fandangled features but I think I want to get some feature, no matter how small, online soon so that it might start getting used and so spur me and the (possible) team on to expan the thing.

So hopefully I and some of the other guys at work will start posting over on the On Aire blog and might even get something on the site. I've got some ideas for the design of the site and features of the app so I'm gonna try and pitch them to the lads and see if I can get something rolling.

Watch this (or that) space for more...

Adobe AIR comes to the UK

On April the 9th me and Brian (I wish he would start to update his twitter again) will be attending the Adobe AIR tour in London.

I'm going to try and think up a little AIR app to celebrate this but I'm going to wait untill the top secret project has finished before I get stuck into that.

I'm also going to try and get Brian to help me out with the ideas and production.

Mumblings of a web developer

Thought I'd link up my twitter in here

http://twitter.com/GregB

check it out if you dare

Click this shit

Just found this on my phone along with a bunch more crazy photos of last nights ridiculousness. Might get up and get a shower, or i might lay here and feel sorry for my self some more.

Click that shit!

HTTP monitoring on windows

As a web developer watching data being sent over your network connection is often important and sometimes essential for reliably debugging your work (when you're not sure if you clagged togheter code is making spurious requests in the background or not).

Today I'm still building the top secret Flash project which is going well and is now into thousands of lines of code and it's starting to get complicated. Flash 8 on my Dell M70 takes around 30 seconds to build the swf.

Any way, so I needed to watch the HTTP trafic coming out of my SWF to make sure it was doing what it was supposed to do. I considdered running it through a web page and using firebug's net monitor or getting Charles installed but it occured to me that the most reliable source (on windows at least) would be a microsoft tool that I'd seen Matt pratting about with a while ago, Microsoft Network Monitor 3.1.

Once you have downloaded and installed that, simply click "Create a new capture tab" and then in capture filter tab paste the following:

contains (Property.HttpHost, "the.domain.name")

where "the.domain.name" is the host name of the server you wish to watch traffic for then press the start button and you will see all your HTTP (web) traffic from any application to that domain

WOW

This is ace.

It's like all that microsoft *seadragon* or what ever it was called

http://www.cooliris.com/

Downloading and Deleting Temporary Files

Recently while working on some functionality for one of our clients I found myself in a position where I needed to add some images to a zip file. This zip file then needed to be sent to the end user as a download (Content-disposition: attachment;).

Once the user had downloaded the file, the zip file needed to be deleted so as not to leave temp files on the servers disk.

I tried a few things like calling File.Delete("path/to/file.zip") after doing Response.TransferFile() or Response.WriteFile() but I found that the page never loaded. I guess it was deleting the file bfore it had chance to stream the file to the client.

Eventually I came up with the code below which reads the entire file into a BinaryWriter and the write it out to the Response's OutputStream. The stream is then flushed and the file can be deleted.

    string theFile = "path/to/your.file";
    FileInfo theFileInfo = new FileInfo(theFile);

    if(theFileInfo.Exists) {
        // Clear any output
        Response.Clear();
        Response.BufferOutput = true;
        // should be the MIME-Type of your file
        Response.ContentType = "application/x-zip-compressed";
        // set the name of the file as it will be downloaded
        Response.AddHeader("Content-Disposition", "attachment; filename=the.file");

        // Open the OutputStream into a BinaryWriter
        BinaryWriter br = new BinaryWriter(Response.OutputStream);
        // Read the entire temporary file and write it into the BinaryWriter
        br.Write(File.ReadAllBytes(theFileInfo.FullName));
        // Flush and Close the Writer
        br.Flush();
        br.Close();
  
        // Fulsh the Response object
        Response.Flush();
  
        // Delete the temporary file
        File.Delete(theFileInfo.FullName);
        // End the execution of the page
        Response.End();
    }

While this does get the job done it isn't perfect. The entire file is read into memory before being sent to the client. This means if you are sending large files to many clients at the same time you could have some trouble with the server running out of memory and all manner of other crazy things happening (possibly).

As ever, use at your own risk.

IPod what!

I'm sat on to virgin cross country service from Leeds to Sheffield and there is a girl sat next to me seemingly using an old laptop kitted out with iTunes to do nothing else but listen to music. I on the other hand am listening to music on my IPod, while blogging from my phone. Technology ay?!

More...

More mindless drivel and ramblings now available free over at twentysix Opinions.

Banana Cake v0.011111 alpha beta gama delta something or other LIVE!

Today I put the first version of Banana Cake live on an internal web server and invited my co-developers here at twentysix leeds to become my testers.

We've got a couple of current projects set up on there and I hope the guys will use it to track what they are doing and hopefully provide me with some excellent and useful feedback over the next few weeks.

If they do and and they find it useful day to day then my plan is to roll it out to the entire office ( a whole 25 users !) . With a bit of luck I'll have come up with a real name for it by then and sorted out the dicey interface although gay Dave says he likes the way it looks as it is...

I'm off to look at the bugs list for Banana Cake and get some issues sorted.

Read the comments

the first four comments are definitely worth a giggle

http://valleywag.com/352426/11-million-paid-for-worlds-stupidest-domain-name/

Still no internet

The internet at work is still Jaffed so for the last two days I've been using my K800i as a modem via the wonderful T-Mobile Web 'n' Walk plus which connects at a staggering 115Kbps (about 40KB/s download if i'm lucky) which beats the pants off our poxy broadband here at work(connects at 8Mbps and downloads at about 2KB/s. But hopefully that should all be changing next week when we get a second line installed.

So for now, I'm not doing much online (this blog is turning into a blog about not being able to style up this blog!) but I have got a couple of other things on the go.

inyerface theatre company
This website is a favour for some friends and I'm going to meet them soon to get phase 1 (news and performances sections) live while I work on phase 2 which will bring images to the site in the form of photo galleries.

Banana Cake...
... is the working name for a simple bug tracking app that I'm in the process of building.
This came about after my moan the other day that I was bored with work/the internet and so I decided to get off my arse and do something about it.

Banana Cake is about 15% done (in about 4hrs spread over 2 and a half evenings) so I'm hopeful I'll actually produce something before I lose steam (like I usually do). Once I've got it to a reasonable state I'm going to unleash it on my work colleagues where it will hopefully fill a gap in our infrastructure (have you ever tried setting up bugzilla, nightmare) and get some useful feedback for it.

I might even buy a domain for it and try and make something of it! But before any of that happens I've got my tax return to do before the end of the month... bloody inland revenue!

Damn Internet

So after my post last week about redesigning this blog the internet at work has been bloody slow so all I have managed to do is hack the template and change the background colour.

But I like it. One day I'll follow up what I say...