Shimon Krokhmal's blog

I'm sure that if you reading this blog, you have encountered a bug or two (at least).
Now, as you know, often you have to solve bugs of other people that have been fired/left/not available at the moment or just frustrated from it and need a fresh pair of eyes to look at it.

So, you need to deal with the bug, just you and him, like a dual,
What do you do? , how do you confront this mysterious daemon?
 
Most of the people that inherit a bug, clueless regarding his data, try to confront with it straight forward.
Ask a common developer how would he handle a bug, 9 of 10 answers will be "debug".
well, i think it's wrong, it's like knowing that there is a giant brick wall and still running at full speed right in to it.
(unless you are "The Hulk", it won't work)

here is how I'm dealing with a bug :

• Bring it to your own game court - whenever you have a situation, it's always happens in some environment.
  it's crucial to know it as it was your own place.
  suppose you have a .Net Web application running on a windows server 2003, you need to know damn sure all the environment laws regarding it.
  thing like how IIS handle requests or how security configurations should be, are vital to your diagnosis of the problem.
  
• Understand the symptoms right - i have a TV series that i watch , called "House", it's about a brilliant diagnostician doctor that works mostly in unconventional ways and solves the most bizarre cases by doing that.
  i tend to refer this TV series as an educational show on how to handle strange cases and how to approach them.
  on one of it's episodes they had a brilliant dialog:
  - "House, the patients kidneys are shutting down"
  - "Great, we have another symptom"
  
• Write it down - get yourself a notebook or even a giant white-board to write all these symptoms that you have found, it should be right in-front of you all the time until you have solved the case.
  
• Ask yourself What can cause it ? - preferably do this out loud, ask your self that question regarding each symptom that you found, maybe even with a team , that could confirm it or deny your theories.
  
• What was changed ? - this is the most important question that you need to ask yourself.
  things does not go wild on their own,if it worked before and now does not, then something is changed.
  this would be our biggest clue to solve the problem !
  this could be an environmental change, a change in the situation that the application handles or a coding change,
  each one of these can cause a problem, we need to understand which exactly is it.
  
• Develop a theory - this is the fun part, now you have all the data that you need to solve this bug.
  you know how the environment behaves, you have the symptoms to the problem, things that was been changed, and possible causes to our symptoms.
  now you need the sit a few minutes and think what is the reason that fits to all our gathered data.
  
• Blind tests are the devil - most of them will give you nothing and consume much of your precious time, Get a theory that you think that fits the symptoms and then test it, not the other way around.
  
• Develop a solution to the problem - after we have our theory and we tested it, we need to develop a solution that fixes the problem, this is the easy part.

for example, here is a problem that i have encountered almost a year ago:

8007000e System resource exceeded
Microsoft OLE DB Provider for ODBC Drivers error '8007000e'
[Microsoft][ODBC Microsoft Access Driver] System resource exceeded.

lets try to follow these guidelines and solve the problem:

Bring it to your own game court - this is a windows environment that runs an asp web application based on Microsoft access.
Understand the right symptoms - we have a database that denies any further connections due to resource limits.
Write it down - take a moment to look at those symptoms.
Ask yourself what can cause it - it could be an environmental cause, like connection limits are not enough, or coding mistake that suffers from not closing an opened connection.
What was changed ?  - code wasn't changed, all system configurations was not changed, traffic to your site is doubled.
Develop a theory - since the traffic was doubled, the connections are doubled as well, and thus reaching to the connection limit of our application.
why the application does not clearing the connection resources ? - because the code that opens them does not close them, thus the connections piled up and reaching the connection limit way before the recycling process started.
Test it - recycle the connection pool, simulate traffic that won't be in the connections limit(simultaneously), but can be piled up to reach the limit.
Develop a solution to the problem - if you are intrested for this solution , you can check out my post about it

Well,
after months I'm talking about it and couple of sleepless nights to prepare it, here it is.

So, what do have here ?

1 powerPoint presentation that explains what is Session Hijacking and XSS.
1 XSS demo.
0 Session hijacking Demo .... (why you ask ? - I'm planning to do another lecture on the topic for some those who missed it yesterday...)
0 Code included. (like the demos ....will be uploaded some time soon....)

long story short :
this presentation talks about the threats in Session hijacking.
and how to prevent it. - while its not a 100% solution, it certainly raises the bar for hackers to succeed in the session hijacking attack.

some wise man said to me once,
"for every defense that ever made, someone thought how to break it,
 the only thing we can do, is to narrow down the amount of people that is capable to perform it."

enjoy.

comments are welcomed :)

Security.pps (324 KB)

Security is one of the most important subjects when creating some business (not necessary a web business or even computer related).
think about investing lot of time developing your business, and then seeing it all ripped apart, just because a sensitive information was reviled to some unwanted individuals, or even worse, gone global to the public.
Of course, security in not only related to stealing data, messing with the business reputation can be devastating just as much as the mentioned above.

When developing Web applications, security is highly important due to the reason that the application is running in the most hostile environment, I mean, everybody can access it, meaning that everyone is a potential threat to the system.

Cross Site Scripting (AKA XSS) is one of the known and ancient methods to exploit security holes on the web.
The idea of the method is injecting client side script code to a web application, which will perform an additional task at the client side.
It may seem to some as a harmless thing, but actually, it can trigger much dangerous attacks such as session hijacking, one-click attacks and Phishing.

Well, this post actually not about how to conduct an XSS attack, but how to avoid being an XSS victim.

 So, what do you have to do in order to prevent XSS? - INPUT VALIDATION.

 Let's take a look what does the .Net framework has to offer on this matter

• ValidateRequest – page directive
• Built-in .Net validation controls (such as "required field validator", "Range Validator", and so…)
• Server Side validation.

ValidateRequest directive – Enabled by default, supposed to "protect" All the input to the page from XSS.
It looks for "<" and ">" tags, probably by some regulars expressions, the problem with this option is that it limits ALL inputs, even the intended ones (such as XML, HTML tags and so…).

Built-in .Net validation controls – The framework provides probably all the input validation that you will need when writing it.
Starting from required fields, numerics values, Regular expressions, and even write your own custom validation.
The problem with it, that it gives the developer a feeling that once the validation is made, it can't be tempered by the client, which IS NOT TRUE.

Note that the common use of these tools is on the client side, which makes the whole validation process irrelevant.

Ask yourself as a developer if you setting the "EnableClientScript" property on the validation control when you use it? – The common answer will be yes, because it improves performance by saving round trips to the server.

But if the question would be, have you did some extra coding to ensure server side validation to occur? – Unfortunately, the common answer will be NO.

Note to yourself – This is no' 1 reason for XSS vulnerabilities in ASP.NET applications.

Server Side validation – This is where your coding skills starts to kick in.

This is where you need to stop, and start thinking about security for your application.
A rooky developer will probably go straight to developing a page , neglecting the security aspect, while the more experienced developer will design a total solution, considering many aspects of the application, security would be one of the top issues (if not the first).

Lets see some examples :

Lets create this asp.net page :

As you know, Microsoft didn't intended that you access the SPS database, but via object model only.
the problem that it has many bugs, performance issues, security issues and lots lots problems that will make the programmer's life a living hell.

So, lets see how can we break the 1st guideline of SPS programming - "do not use the SPS database directly".
man , I'm feeling like a criminal now, presenting a guide how to do something that Microsoft invested a lot of effort to prevent us from doing.

Lets get down to business,
don't count that the connection string is laying in some property, this one we need to do some dirty work.

A little background how we are going to do it:

The connection string looks like this :

"Integrated Security=SSPI;Server=someServer;database=SomeDatabase"

as you can see, the only thing that can change here is the server name and the database name.

lets create a core function that will receive DB collection and the desired site guid and construct the connection string.

private string GetConnectionStringForSite(SPContentDatabaseCollection DBs, Guid siteGuid)
{
    string rc = "";
    SPContentDatabase oDB = null;

    for(int i=0; i<DBs.Count;i++)
    {
        // Get the database
        oDB = DBs[i];

        SqlCommand c = new SqlCommand();
        string strConn = "Integrated Security=SSPI;Server=" + oDB.Server + ";database=" + oDB.Name;

        using(SqlConnection conn = new SqlConnection(strConn))
        {
            // Set the Connection
            c.Connection = conn;
            try
            {
                // Open the connection
                conn.Open();

                c.CommandText = "SELECT FullUrl FROM Sites where Id=@Id";

                // Set the parameter
                c.Parameters.Add(new SqlParameter("@Id",System.Data.SqlDbType.UniqueIdentifier));
                c.Parameters["@Id"].Value = siteGuid;

                // Execute reader
                SqlDataReader reader = c.ExecuteReader(System.Data.CommandBehavior.SingleRow);

                // check if we have rows
                bool hasRows = reader.HasRows;

                // Close the connection and the reader
                reader.Close();
                conn.Close();

                // Check if it got rows
                if(hasRows)
                {
                    // Set the return value
                    rs = strConn;

                    // Stop iterating through the DB's
                    break;
                }

                // Close the reader
                reader.Close();
            }
            finally
            {
                // Close the connection
                if(conn.State != System.Data.ConnectionState.Closed) conn.Close();
                oDB = null;
            }
        }
    }
    return rc;
}

this function will be placed in a dedicated class, i call is "SPSDB"

lets create the class itself and its private members

    public class SPSDB
    {
        private string _conString = "";
        private string _vsUrl = "";

        public String URL
        {
            get{return _vsURL;}
        }
    }

now we need to write the constructor and the connection "factory"

the constructor will look like this :

public SPSDB(string siteUrl)
{
    using(Microsoft.SharePoint.Administration.SPGlobalAdmin ga = new Microsoft.SharePoint.Administration.SPGlobalAdmin())
    {
        Microsoft.SharePoint.Administration.SPVirtualServerCollection VSc = ga.VirtualServers;

        SPVirtualServer vs = null;
        Guid g;
        bool isFound = false;
        
        // Run through all the VS collection
        for(int i=0; i<VSc.Count;i++)
        {
            // Get the virtual server reference
            vs = VSc[i];

            // if the current vs is not from the needed state than continue to the next VS
            if(vs.state != SPVirtualServerState.Ready)
                continue;

            // Run through all the sites in the vs
            for(int j=0; j< vs.Sites.Count;j++)
            {
                using(SPSite s = vs.Sites[j])
                {
                    // Check if we found the needed vs
                    if(s.Url.ToLower() == siteUrl.ToLower())
                    {
                        // Save the needed data
                        isFound = true;
                        g = s.ID;
                        _vsURL = vs.Url.ToString();
                        _conString = GetConnectionStringForSite(vs.ContentDatabases,g);
                        break;
                    }
                }
            }

            // Check if the vs has been found
            if(curVs != null)
                break;

            // Clear the virtual server object
            vs = null;

            // Clear memory
            GC.Collect();
            GC.WaitForPendingFinalizers();
        }

        // Throw an exception if the site guid is not there
        if(!isFound)
            throw new Exception("the given site url cannot be found");
        
    }
}

and the factory method will look like this :

public SqlConnection GetCon()
{
    return new SqlConnection(_conString);
}

thats it!
now to use it you can do it like this :

SPSDB dbstuff = new SPSDB("http://www.krokhmal.com");

using(SqlConnection con = dbstuff.GetCon())
{
    // Your DB code here ...
}

I've added a file attachment to this post with the mentioned class.
enjoy.

the main reason that I've started to play with threads is because the industry WILL (sooner or later) move to a multi-core guided programing, and it WILL become mainstream (mark my words :) ).

any way, lets start from the beginning, and why do we need threads.
according to the definition : "Threads are a way for a program to split itself into two or more simultaneously (or pseudo-simultaneously) running tasks. Threads and processes differ from one operating system to another, but in general, the way that a thread is created and shares its resources is different from the way a process does."

so, in other words, we will use threads when we need to perform simultaneous tasks.
these kind of actions made when you have unused processing time while waiting for other task to finish.

so, back to the .Net world, how would we do that ?

to use threads, we need to include the library :

the next thing we need i to know how to to lunch a thread with a task.

• we need to create a task to be done.
• a ThredStart delegate which will point to our task.
• a new thread ( or an old one from a thread pool ) - which is better and when will be explained in some later posts.
• start the thread.

so :

lets create some task :

        private void BurnCPUwithOneThread()
        {
            for(int i=0; i< 5000000;i++)
            {
                lblcounter.Text = i.ToString();
            }
        }

and one more :

        private void BurnCPUwithTwoThreads()
        {
            for(int i=0; i< 5000000;i++)
            {
                lblCounter2.Text = i.ToString();
            }
        }

now we will create the delegate and the threads, and activate them.