Temporary workaround on determine_new_packagename in AOO build

Last week is a challenging week for me both in my day job and also open source work. When I'm making a full build on AOO, there was an error in function determine_new_packagename.

ERROR: ERROR: More than one new package in directory /home/kokhoe/workspace/aoo-trunk/main/instsetoo_native/unxlngx6.pro/Apache_OpenOffice/deb/install/en-US_inprogress/DEBS ( /home/kokhoe/workspace/aoo-trunk/main/instsetoo_native/unxlngx6.pro/Apache_OpenOffice/deb/install/en-US_inprogress/DEBS/openoffice-core06-4.1.0-1-linux-3.8-x86_64.deb /home/kokhoe/workspace/aoo-trunk/main/instsetoo_native/unxlngx6.pro/Apache_OpenOffice/deb/install/en-US_inprogress/DEBS/openoffice-core06-4.1.0-1-linux-3.8-x86_64)
in function: determine_new_packagename (packagepool)

My initial though is by removing the whole unxlngx6.pro directory will resolve the problem, but eventually it is not. There is also a defect has been raise but the work around is not working for me. Fortunately I met a peer who gave me a great help on this issue. This problem is due to the version of the EPM (stands for ESP Package Manager) installed in the system isn't compatible with AOO build. AOO require EPM version 3.7, other than this version the build will not pass. I am require to download the EPM version 3.7 source specifically, and build on my own.

A quick check on the version installed on my system, I see this:

epm --version

ESP Package Manager v4.2
Copyright 1999-2007 by Easy Software Products.

EPM is free software and comes with ABSOLUTELY NO WARRANTY; for details
see the GNU General Public License in the file COPYING or at
"http://www.fsf.org/gpl.html".  Report all problems to "epm@easysw.com".

To verify whether AOO build is using the EPM install in the system:

grep -i epm config.log

  $ ./configure --with-epm-url=http://epm.sourcearchive.com/downloads/3.7-1/epm_3.7.orig.tar.gz
configure:11566: checking whether to enable EPM for packing
configure:11577: checking for epm
configure:11595: found /usr/bin/epm
configure:11608: result: /usr/bin/epm
configure:11633: checking whether the found epm is the right epm
configure:11641: checking epm version
ac_cv_path_EPM=/usr/bin/epm
BUILD_EPM='NO'
EPM='/usr/bin/epm'
EPM_URL=''

This shows that AOO build is using the EPM installed in /usr/bin directory. Since I don't want to uninstall this component from my system, I have to configure the AOO build to bypass that version and route to my specific build. To do this, issue this command:

./configure --with-epm=<EPM_binary_location_in_file_system>

Note, the EPM binary must be build before this command is execute, don't expect the ./configure command will make the build from the source. I have also try --with-epm-url, this option will do the downloading and extraction work automatically but it doesn't work.

@Rule allows me to verify the message

Nice sharing from Stackoverflow peer suggesting a new solution on testing exception. This adds more flexibility to my test. Assuming I'm testing on a class that throw NullPointerException:

public class ClassCauseException {

 public void funcA() throws NullPointerException {
  throw new NullPointerException("Some NULL message");
 }
}

Usually I'll do this:

 @Test(expected=NullPointerException.class)
 public void testFuncB() {
  ClassCauseException c = Mockito.spy(new ClassCauseException());
  c.funcA();
 }

That will only tells me funcA will throw an NullPointerException. But I couldn't verify whether whether the right message is display. Anyhow there is a more elegant way for this issue. With @Rule, I'm allow to verify whether the display message when an Exception is being thrown. For example, when the following test is execute, I'm expecting an NullPointerException will be throw, and a message The NULL value should be display. Eventually the test will failed due to the actual message Some NULL message is display.

public class RuleExceptionTest {

 @Rule
 public ExpectedException exp = ExpectedException.none();
 
 @Test
 public void testFuncA() {
  exp.expect(NullPointerException.class);
  exp.expectMessage("The NULL value");
  ClassCauseException c = new ClassCauseException();
  c.funcA();
 }

}

This could be useful if I care the type of Exception being thrown and what message is being display.

Why Eclipse Kepler complaining invalid overload of endl?

This code cout << "blah blah blah" << endl; not suppose to be an error. Interestingly Eclipse Kepler state that this was an error:

Invalid overload of 'endl'

My mistake again? A stupid though passing by my brain, urging me to trying out this experiment:

    ...
    cout << "blah blah blah";
    cout << endl;
    ...

And this will compile OK. Miracle happen? Anyhow there is a cure for this problem:

1. Windows menu > choose Preferences option > select Code Analysis on left panel.
2. Under Syntax and Semantic Errors > change Invalid overload's severity from Error to Warning.

I wasn't really sure why Eclipse have such configuration, a message drop to Eclipse forum regarding this problem, and they reply that there was a fix on this error. Should be on the way on next release I guess.

No sign of vulnerability on authentication module done using Servlet

Actually I was trying to discover the CSRF thing happened on the web app. I'm trying to find out this vulnerability through ZAProxy to understand the real fact happens behind the scene. To do this, I made an web app that purely done using Servlet, not involving any JSP. This Servlet program allow users to authenticate themselves before render the protected resource.

This is the Servlet configuration in Deployment Descriptor:

 <servlet>
   <servlet-name>TestServlet</servlet-name>
   <servlet-class>org.huahsin.TestServlet</servlet-class>
 </servlet>
  
 <servlet-mapping>
    <servlet-name>TestServlet</servlet-name>
    <url-pattern>/test</url-pattern>
   </servlet-mapping>
  
   <security-constraint>
    <web-resource-collection>
     <web-resource-name>Wildcard means whole apps requires authentication</web-resource-name>
     <url-pattern>/*</url-pattern>
     <http-method>GET</http-method>
     <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
     <role-name>tomcat</role-name>
    </auth-constraint>
    <user-data-constraint>
     <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
   </security-constraint>

 <login-config>
  <auth-method>BASIC</auth-method>
 </login-config>

public class TestServlet extends HttpServlet {
 protected void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
  response.setContentType("text/html");
  PrintWriter out = response.getWriter();
  out.println("This is a Test Servlet.");
  
  Enumeration headerNames = request.getHeaderNames();
  while( headerNames.hasMoreElements() ) {
   String headerName = (String) headerNames.nextElement();
   out.println("Header Name: < i >" + headerName);
   String headerValue = request.getHeader(headerName);
   out.println("< /i >, Header Value: < i >" + headerValue);
   out.println("< /i >");
  }
  
  out.println("< hr / >");
  
  String authHeader = request.getHeader("authorization");
  String encodeValue = authHeader.split(" ")[1];
  out.println("Base64-encoded Authorization Value: < i >" + encodeValue);
  String decodeValue = Base64.base64Decode(encodeValue);
  out.println("< /i >Base64-encoded Authorization Value: < i >" + decodeValue + "< /i >");
 }
}

The users are define in Tomcat server, when the page launch, a prompt to user to enter a valid login credential in order to view the content. Unfortunately ZAProxy not able to do any test on it as it doesn't contain any JSP page. Since ZAProxy couldn't run any test on it, I move on to plan B. This time I create a JSP page, this JSP will replace the server authentication:

 <form action="login" method="POST" name="loginForm">
Username:<input name="txtUserName" type="text" value="" />
  Password:<input name="txtPassword" type="password" value="" />
  <input type="submit" value="login" />
  <input type="reset" value="clear" />
 </form>

Next thing is to remove the <security-constraint> from Deployment Descriptor to get rid of server authentication and allow user to authenticate through a web page. That's all about the change. When I run the test again on ZAProxy, there is no sign of vulnerability found on this example, I think I need to move on to bigger challenge to realize CSRF thing.

How to configure Tomcat to support JEE6?

I have a servlet program create under Tomcat 6 environment, I found it interesting there was an error on login() and logout() as these methods are undefined.

protected void processRequest(HttpServletRequest request, HttpServletResponse response) {
    ...
    request.login(userName, password);
    ...
    ...
    request.logout();
}

As I check in the documentation in JEE6, the login() and logout() was there but not in JEE5. I did a check on the project facet in Eclipse IDE, the project was using Dynamic Web Module 2.5 and Java 1.6. Can I conclude that my tomcat is actually working with JEE5? I am so curious what else did I miss configure in order to support JEE6?

As I did a deep search, this can not be done. Why? Because Tomcat isn't an enterprise server. I found the clue from here. To proof me right, I run quick test on WAS Liberty Profile and Tomcat EE by configuring the target runtime in Eclipse IDE. Both of them compile without any error. Cheers!

By the way, I though I suppose to aware of this since I have been doing enterprise software for 3 years?

Is it possible to make a standalone application with Maven?

Hey, I've been using Maven on web application project for most of the time, ever wonder could it be done on standalone project? The answer is yes. Make a quick search on Google, this tutorial will shows up. But that is a little bit too complicated. Can it be a little more easier? The answer is yes. (Sorry, I'm a lazy programmer.)

When launching a new Maven project, filter with maven-archetype-quickstart in the Archetype selection dialog box, pick that one and follow the instruction all the way down. A standalone project without web stuff in the project setting will be ready to accept new code.

Next question is how could I run it? This is what I have been done on my POM.xml:

  <build>
   <pluginmanagement>
    <plugins>
     <plugin>
      <groupid>org.codehaus.mojo</groupid>
      <artifactid>exec-maven-plugin</artifactid>
      <version>1.2.1</version>
     </plugin>
    </plugins>
   </pluginmanagement>
   
   <plugins>
    <plugin>
     <groupid>org.codehaus.mojo</groupid>
     <artifactid>exec-maven-plugin</artifactid>
     <version>1.2.1</version>
     <executions>
      <execution>
       <goals>
        <goal>exec</goal>
       </goals>
      </execution>
     </executions>
     <configuration>
      <mainclass>org.huahsin.Selenium2.App</mainclass>
     </configuration>
    </plugin>
   </plugins>
  </build>

In Eclipse Maven goal, put package exec:java to launch the standalone application. Take note there are some details on the exec command, read it from here.

Selenium not navigate to given URL

What a silly day for me! I was setting up a Selenium project using Maven in Eclipse IDE, somehow the browser was launched but not navigating to the given URL. It just showing blank screen after launched.

Remember in some years back, I have encountering this issue before but this problem is due to the network was behind a proxy server. Since I'm doing it at home, I'm sure I don't have any proxy server setup. I give up to do it on Maven, make it a traditional project, import the Selenium JAR manually. It works! (What a joke!)

I spend my whole day looking at the source code, searching for the root cause then only I find out it is actually cause by the Maven configuration. Code snippet below shows the original Maven configuration:

  <dependencies>
    <dependency>
      <groupid>junit</groupid>
      <artifactid>junit</artifactid>
      <version>3.8.1</version>
      <scope>test</scope>
    </dependency>
    <dependency>
     <groupid>org.seleniumhq.selenium</groupid>
     <artifactid>selenium-remote-driver</artifactid>
     <version>2.33.0</version>
    </dependency>
    <dependency>
     <groupid>org.seleniumhq.selenium</groupid>
     <artifactid>selenium-firefox-driver</artifactid>
     <version>2.33.0</version>
    </dependency>
  </dependencies>

See that the Selenium version number was set to 2.33, have a check on the Selenium site (as of this writing), the latest version was 2.39. To conclude this, using the wrong version may cause the Selenium not navigate to the given URL.