Comment LinkedIn a "volé" mes données

Je suis pourtant un utilisateur averti.
Très précautionneux.
Mais je me suis fait avoir.

Le déclic

Allant faire un tour sur LinkedIn par une belle soirée, je découvre une suggestion de contact quelque peu étrange, un contact que LinkedIn ne peut pas connaître. Pour la simple et bonne raison que j'ai une relation strictement privée avec cette personne (pas extra-conjugale non, je vous ai vu venir !).

Comment LinkedIn a bien pu savoir ? Comment a-t-il pu me suggérer précisément ce contact ?

La réflexion

Alors bien sur, je me suis posé des questions :

N'ai-je vraiment aucun lien avec ce contact sur LinkedIn?

Non, sûr et certain !

Est-ce que ce contact a pu consulter mon profil sur LinkedIn ?

De cette manière, cela aurait généré une suggestion inverse : LinkedIn sachant qu'il me cherchait, me l'aurait proposé en retour. Mais en fait, ce n'est simplement pas probable. J'estime grossièrement cette probabilité à 1%, car :

• pour ce contact je suis noyé dans la masse.
• le compte est inactif (je suis allé voir de manière "sécurisé")
• il n'est pas logique (je me comprends) qu'il consulte mon profil

Aurais-je déjà importé des contacts ?

Non, je ne connecte pas LinkedIn à Google et n'y importe aucune liste.

La prise de conscience

Alors quoi ?
Comment souvent, Google (oui je sais c'est pas mieux) me répond. Et je ne suis pas le seul à constater que quelque chose ne tourne pas rond.

Je vous laisserai le soin d'aller vous renseigner sur tout un tas de constats effectués par tout un tas d'utilisateurs, mais c'est pas net.

La gestion de la vie privée

J'avais consulté il y a bien longtemps les règles de gestion de vie privée dans mon profil. Cela a bien évolué depuis.
Et tout est coché par défaut...

>> Nettoyage

Il n'empêche, les configurations réajustées ne répondent pas à ma question...

Ah ?!

L'application LinkedIn Android !!!!!!!!!

Cette application que je n'utilise pas, que j'ai installé il y a bien longtemps "au cas où", qui s'installe avec tout un tas de permissions.
Mais quand même, ils n'oseraient pas "se servir" sans me demander explicitement ?

On dirait pourtant bien que c'est passé par là...

Je suis à 99% certain de ne jamais avoir demandé une quelconque synchronisation entre mes données téléphone et mon compte :

• Je n'utilise pas cette application
• Je ne synchronise jamais mes listes de contact

Et pourtant en consultant mon profil LinkedIn, je constante une liste démentielle de contacts importés.
Ceux de mon téléphone...

Et maintenant ?

Bien sûr, c'est trop tard maintenant.
Je ne saurais jamais comment cette synchro s'est activée

Suppression de l'application, suppression de la liste importée, mais le mal est fait.

Alors vous me direz sûrement que je ne suis qu'un idiot qui l'a activé sans se rendre compte.
Je vous répondrai que non, je ne l'ai pas fait, pas intentionnellement en tout cas.


Par contre, j'ai bien "autorisé l'application à accéder aux contacts" lors de l'installation, ça je ne le nie pas.......

Read More

Apache Camel - Unit Testing Spring route

Apache Camel is an awesome framework, also providing a unit testing framework.

I found it quite tough to dive into that testing framework as testing a route is not the same than testing a regular Java class.
Here are some pattern when testing your Spring route :

Base code

The spring route

Assuming this route in camel.xml :

Test class skeleton

And this JUnit test class, referencing

1. The XML route file
2. The @DirtiesContext allowing us to manipulate the Camel Context on tests without effects outside of each test

   
@ContextConfiguration("classpath:camel.xml")
@DirtiesContext
public class MyTest extends AbstractJUnit4SpringContextTests{

    @Autowired
    private ModelCamelContext context;

    @Test
    public void testRouteId() throws Exception {
       // introspect route
       // create expectations
       // execute route
       // asserts
    }
}

Patterns to test the route

Test a component

Here we are mocking the parameters provided to the WebService :

1. Create a MockEndpoint
2. Insert endpoint in the route
3. Add expectations for the endpoint :
1. The number of messages
2. The type of the message
3. The content of the message
4. At the end of the test method, trigger the assertion

    @EndpointInject(uri = "mock:assertWsParams")
    protected MockEndpoint assertWsParams;
...

//introspection
context.getRouteDefinition("route-id").adviceWith(context, new AdviceWithRouteBuilder() {
 @Override
 public void configure() throws Exception {
  weaveById("cxfWs").before().to(assertWsParams);
 }
});

//expectations
assertWsParams.expectedMessageCount(1);
assertWsParams.expectedBodyReceived().body().isInstanceOf(RequestType.class);
assertWsParams.expectedMessagesMatches(new Predicate() {
 @Override
 public boolean matches(Exchange exchange) {
  return ((RequestType) exchange.getIn().getBody()).getId().equals(EXPECTED_ID);
 }
});

//execution
...

//assertion
assertWsParams.assertIsSatisfied();

Mock a component

Here we are mocking the cxf WebService with a static response :

1. Find the "node" with the weaveById
2. replace() it
3. with a process()

context.getRouteDefinition("route-id").adviceWith(context, new AdviceWithRouteBuilder() {
 @Override
 public void configure() throws Exception {
  weaveById("cxfWs").replace().process(new Processor() {
   @Override
   public void process(Exchange exchange) throws Exception {
    ReponseType res = new ResponseType();
    res.setCode("200");
    res.setMessage("OK");
    exchange.getOut().setBody(res);
   }
  }).id("cxfWsMock");
 }
});

Run the test

Here we are running the test, injecting some data in the route to test it and the assertions :

1. Create a producer on a uri
2. Send some data

@Produce(uri = "direct:hello")
protected ProducerTemplate producer;
...

producer.sendBody("Hello");

Conclusion

My tests are mainly based on these 3 patterns, be sure to understand the logic.

More information on Camel test documentation

Read More

Security - Tips to develop a secured Java web application

I recently had to build a web application aiming to handle critical and confidential user data.

Security was the main challenge of this application.

Of course, security is a wide topic, so I 'll present here the security measures I had to take in the code to ensure data privacy and pass the security audit (black box and gray box)

OWASP

The bible of Web Security is the OWASP web site

The measures I had to take to counter the top 10 risk :

Web tiers

• Detect and reject some patterns on form submission ("<script" for example) (A3)
• Include a one time token inside every form, and challenge it server side on form submission (A8)
• Include a one time token inside every link that perform an write operation in database, and challenge it server side on action (A8)
• Configure and test the HTML escaping of variables of the framework rendering engine. (A3)
• Develop a full set of features to keep ids from being transfered client side. My strategy was to store ids in a "session context" and rely on it, transfering indexes instead - in the case of tables, for example (A4)
• Beware, sometimes the magic of your framework car introduce this vulnerability without even noticing!
• Restrict every entry point for the role allowed - based on a standard RBAC.
• Initiate redirects server side, redirecting to a static declared URL (no computation based on user input) (A10)
• Set the pragma:no-cache header

Database tiers

• 100% names queries. No concatenation. Never. (A1)
• Escaping of data rendered in PDF report. (A1)

App tiers

• Check the application server session cookie value algorithm (java.secure.Random) (A2)
• Set session timeout to an accurate duration (A2)
• Set the cookie-config to secure in web.xml - https only app (A2)
• Hide every HTTP response header that could give information to attacker

Other

• Configure iptables as "deny by default" with rules rejecting connection on unallowed port (A5)
• Enforce authorization between software components, according to the vendor specification(restrict by IP for example) (A5)
• Include operations in security configuration (A5) 
• Detect and protect sensitive data - including project owner in the process (A6)
• Stay updated on your technologies - mostly version updates and known vulnerabilities (A9)

Conclusion

This is obviously not exhaustive, common sense is important as well as training developers.

Anyway, we passed 3 security audit (code, web security, server vulnerability), not so bad !

Read More

Ionic : differences between desktop browser and android web view

Ionic is a powerful framework to develop hybrid mobile applications on top of angularjs.

Here is what i learned from my first android tests - based on Ionic 1.0.0.rc5 - simply running ionic run android command

Error : device is not defined

The main issue i met. Everything was correctly defined, including cordova.js, the javascript import order etc

The cause of the issue was actually that I perform a synchronization on application launch, triggered by the first controller - to be accurate.

Controllers are not evaluated once ionicPlatform is ready :(.

So to skip that error, the synchronization has to be wrapped "on platform ready"

$ionicPlatform.ready(function(){
   syncService.sync();
});

Full width/height Background invisible

My application displays a beautiful background, unfortunately android displayed nothing.
This is because android doesn't seem to enjoy a full CSS declaration...

Just change the declaration and everything becomes alright.

/* fail */
.scroll-content{
    background: url("../img/background.png") no-repeat scroll center center / 100% 100% transparent
}
/* success */
.scroll-content{
    background-image: url("../img/background.png");
    background-repeat: no-repeat;
    background-size: 100% 100%;
}

Dates gap

The dates displayed by the application are transmitted by the server as ISO 8601, easily converted through moment.js.

Except the timezone in my device was not the same one than my desktop browser.
Be sure to set this correctly.

Ionic application reboot after a camera call

A though error once again : on corodova camera callback, the application reboot and becomes "ko".

This is a configuration of the device. In your device settings, just uncheck the "do not keep activities" configuration. Just do it now.

Clarification on grid system

I had some issues by not clearly declaring the "col" CSS class on "columns".

Instead of :

...
  

Declare :

...
  

Tabs are top instead of bottom

Something weird : tabs, that are displayed bottom on desktop, moved to top in android!

Add this to your angularjs .config function  :

$ionicConfigProvider.tabs.position("bottom");//force bottom
$ionicConfigProvider.tabs.style("standard"); //force same look and feel

Header view title not centered !

Similar issue.
Add this to your angularjs .config function  :

$ionicConfigProvider.navBar.alignTitle('center');

Read More

Spring Boot your Java batch

What I hate with batch development is the packaging phase.
Where Java EE normalizes everything, batches have been totally forgotten.

As often, Spring comes with a solution and makes our life easier with Spring Boot.

A revolution.

It's "magic".

1. Your batch

Develop your batch, as usual. Using Spring Batch framework is 'not' a requirement. It simply eases the integration and the configuration after packaging.
I personnally rely on maven. Just add the following lines in you pom.xml

 org.springframework.boot
 spring-boot-starter-batch
 1.2.3.RELEASE
 
  
   org.springframework.boot
   spring-boot-starter-logging
  
 



 
  
   org.springframework.boot
   spring-boot-maven-plugin
   1.2.3.RELEASE
   
    
     
      repackage
     
    
   
  
 

Running mvn package now create 2 jar :
- .jar.original -> the jar before Spring Boot complete it
- .jar -> the runnable fat jar built by Spring Boot

You can run it using the command :

java -jar myfatjar.jar

2. If your batch is developed with Spring

Name your configuration file application.properties.
No need to load it by Spring configuration. This file name is a "keyword".
More details about this "trick" in pitfall section.

3. Write you "main" class

Just write it the following way.
Notice the Spring loading. You can provide a Configuration Bean or a XML file. Depends on your habits.

@SpringBootApplication
public class HelloApp {
    public static void main(String[] args) {
        SpringApplication.run(new Object[]{HelloApp.class, "spring-boot.xml"}, args);
    }
}

4. Run it with external configuration

Externalizing the configuration is not an option for production, it's a requirement.

Run your batch with the following arguments allow you overwrite any configuration present in your application.properties.

... --spring.config.location=file:conf/file1.properties,file:conf/file2.conf ...

5. And external logging

To externalize the logging (log4j.xml file in this example), this requires a bit of additionnal configuration.
As you may have noticed, spring-boot-starter-logging has been excluded from the pom.xml.
The reason is simple : the default transitive dependency run with slf4j, whereas I work with log4j.

Add this dependency instead :

...

 org.springframework.boot
 spring-boot-starter-log4j
 1.2.3.RELEASE

...

Reference the log4j file as an argument on batch startup command line.

... --logging.config=file:conf/log4j.xml 

6. Final packaging and runtime configuration

Finally, we end up with the following run command line (Windows style) :

cd %~dp0
java -jar myfatjar.jar --spring.config.location=file:conf/file1.properties,file:conf/file2.conf --logging.config=file:conf/log4j.xml

And the following production file structure :

7. Pitfall

I had some issues with overriding property file loaded in my Spring configuration.
The internal jar configuration took precedence over configuration provided as arguments during launch.
I don't think this loading order is logical, I may have missed something... I fell back naming my configuration file application.properties

Read More

Migrating Phaser to CocoonJS

This post to detail my journey on making a Phaser 2.0.7 game work with CocoonJS 2.0.2 (versions ARE importants here).

 

Patch Phaser

Follow this wiki page : https://github.com/photonstorm/phaser/wiki/Phaser-General-Documentation-:-CocoonJS

 

JQuery

So, first of all, JQuery doesn't load  on CocoonJS navigator.
Move on to underscorejs.

 

XML

That may be sound crazy but CocoonJS doesn't provide any XML API. I draw some texts as Phaser bitmapText requiring an XML descriptor parsing.
This code saved my life : https://github.com/videlais/xml-for-cocoonjs

 

Scaling

I never had any issue with scaling during my previous tests (desktop, cordova build on mobile...) but there problems arise : my stage where truncated with black gaps on sides.
In phaser, my game is created using safe height, with the safe width computed based on safewidth/safeheight ratio, then scaling apply

 
this.game = 
    new Phaser.Game(widthRatio, safeHeightheight, 
    Phaser.CANVAS, 'hh_canvas', null, false, false);

hh.game.scale.setScreenSize(true); 
 

With CocoonJs the code is fairly different : full window w&h have to be applied on Game creation, and disabled setScreenSize().

this.game = 
    new Phaser.Game(window.innerWidth*window.devicePixelRatio, window.innerHeight*window.devicePixelRatio, 
    Phaser.CANVAS, 'hh_canvas', null, false, false);   

 

Black background

A fun one that took me a lot of time to figure out the problem.
I render my background using a gradient filled bitmapData : black in CocoonJS
Do NOT set transparent background on new Phaser.Game creation. Works everywhere but in CocoonJS.

 

Last sprite/image not rendered

For an unknown reason, the last element I add to game in "create" function is never renderered.
I just added a dummy.png 1x1 empty image on all my State create() function...

 

Animated texts truncated

One more a time a crazy problem : the last character of my texts, when animated, is not rendered.
Had to add a suffix "_" in case of CocoonJS navigator.

if(navigator.isCocoonJS){
    _text = _text+"_"//add a dummy last character
} 

Hope I saved you some hours I wasted.

I ll try to keep this post updated.

Read More

Grails Offline mode with Maven dependency resolution

Developing with Grails 2.3.5, the maven dependency resolution is almost perfectly integrated.
It depends on the aether core engine to resolve dependencies.

A problem arises when working on offline mode, without any way to check for artifacts repositories.
The application in development runs and gets stuck on "|Configuring classpath" step... for minutes until the application finally starts!
Unfortunately, the configuration grails.offline.mode=true doesn't work with maven resolution, only with the legacy "ivy" dependency resolution.

So here is the trick, after trying loads of configurations failing (-Dsun.net.client.defaultReadTimeout, -Dsun.net.client.defaultConnectTimeout), I ended up adding the following parameters to the JVM :

-Daether.connector.connectTimeout=500 -Daether.connector.requestTimeout=500

Configuring faster timeouts, I can't even notice a latency during application boot :)

Productivity is back !

Read More