Gotchas on SWiK

[from fuzzyfrog] Java gotchas - OWASP

Fri, 29 Aug 2008 09:59:49 -0700

Two for the price of one

Tue, 19 Aug 2008 11:35:00 -0700

Haven’t done any sneaky puzzles in a while. How would you accomplish this?

mysql> CREATE TABLE t1 (id int);
Query OK, 0 rows affected (0.08 sec)

mysql> INSERT INTO t1 VALUES (1);
Query OK, 1 row affected (0.02 sec)

mysql> SELECT COUNT(*) FROM t1;
+----------+
| COUNT(*) |
+----------+
|        2 |
+----------+
1 row in set (0.00 sec)

Git Error: trailing whitespace, indent SP followed by a TAB, unresolved merge conflict | Its all about RubyOnRails(ROR)

Mon, 18 Aug 2008 10:05:49 -0700

Was gettng the whitespace trailing error. Removed the pre-commit file from the .git folder of the project and then could run git commit -m "message" correctly. This happens on my machine only

Kiwi Grails: Grails with Jboss and log4j

Sun, 20 Jul 2008 10:46:13 -0700

James Lorenzen's Blog: Grails: Lessons Learned

Sun, 20 Jul 2008 10:46:07 -0700

Grails and Eclipse: Not So Groovy " Brain Flush

Mon, 23 Jun 2008 07:04:45 -0700

James Lorenzen's Blog: How to create a release using the maven2 release plugin

Mon, 16 Jun 2008 03:20:59 -0700

Can't get courier daemon to login mysql? - Ubuntu Forums

Wed, 28 May 2008 07:09:43 -0700

Got it to work, whitespace at the end of the config lines....ergh

GFWiki: TroubleshootingGuide

Tue, 18 Mar 2008 11:43:07 -0700

J2EE and JEE News, Solutions and Tips

Thu, 24 Jan 2008 09:01:00 -0800

SHOW VARIABLES Shows Variables MySQL Does Not Know About

Tue, 08 Jan 2008 13:28:56 -0800

The listing of Dynamic System Variables on the MySQL Reference Manual’s page is supposed to show those variables you can change on-the-fly. innodb_data_home_dir is listed there as a dynamic variable, but it is not one, and trying to change it on-the-fly doesn’t work: mysql> set global innodb_data_home_dir="/data/mysql/data"; ERROR 1193 (HY000): Unknown system variable 'innodb_data_home_dir' mysql> set session innodb_data_home_dir="/data/mysql/data"; ERROR [...]

Taking UFS new places safely with ZFS zvols - Multiple Threads : Phil Harman's Weblog

Thu, 04 Oct 2007 04:02:31 -0700

things to know before running UFS on a ZVOL

Multiple Threads : Phil Harman's Weblog

Mon, 01 Oct 2007 17:21:02 -0700

things to know before running UFS on a ZVOL

HOWTO Avoid Being Called a Bozo When Producing XML

Sun, 02 Sep 2007 15:31:11 -0700

Views and Social Engineering

Wed, 11 Jul 2007 15:28:47 -0700

CREATE TABLE secretData (
	secretValue int COMMENT 'If this goes over 5, WWIII will start'
);

CREATE SQL SECURITY DEFINER VIEW censoredData AS
SELECT * FROM secretData WHERE secretValue 
<telephone> ring ring
<sysadmin> “Hello?”
<evilFiend> “I’d like to create an insertable view on some tables I already have rights to. I don’t know just yet what I’ll use for my select statement.”
<sysadmin> “Ok. I’ll set it up so you can do what you’d like.”
CREATE SQL SECURITY INVOKER VIEW evilFiendsView AS SELECT 1;
GRANT SELECT, INSERT, ALTER ON test.evilFiendsView TO 'evilFiend'@'%';


evilFiend connects to the server, while twiddling the end of his handlebar mustache.
ALTER VIEW evilFiendsView AS
SELECT * FROM censoredData WITH LOCAL CHECK OPTION;

INSERT INTO evilFiendsView VALUES (42);

Muhahaha!

snoyes: Messing with LAST_INSERT_ID()

Sun, 08 Jul 2007 20:20:13 -0700

Time for another MySQL Community Quiz:

Everybody knows that LAST_INSERT_ID() returns the value most recently created in an auto_increment column. Fewer of us know that you can pass a value to LAST_INSERT_ID(), and that value will be returned for the next call to LAST_INSERT_ID(). For example,

INSERT INTO table (someNonAutoIncrementField) VALUES (LAST_INSERT_ID(42));
SELECT LAST_INSERT_ID();

The INSERT inserts ‘42′ into the table, and the SELECT returns 42.

So, here’s the question: What if we pass an expression to LAST_INSERT_ID and also use an auto_increment field in the same statement?

CREATE TABLE test (id int auto_increment primary key, field int);
INSERT INTO test (id, field) VALUES (NULL, LAST_INSERT_ID(42));
SELECT LAST_INSERT_ID();

Show Answer ▼

You get the auto_increment field, at least in this case:

mysql> INSERT INTO test (id, field) VALUES (NULL, LAST_INSERT_ID(42));
Query OK, 1 row affected (0.08 sec)

mysql> SELECT LAST_INSERT_ID();
+------------------+
| LAST_INSERT_ID() |
+------------------+
|                1 |
+------------------+
1 row in set (0.00 sec)

And for a follow up, does it matter if you swap the insertion around?

INSERT INTO test (field, id) VALUES (LAST_INSERT_ID(42), NULL);
SELECT LAST_INSERT_ID();

Show Answer ▼

Nope.

mysql> INSERT INTO test (field, id) VALUES (LAST_INSERT_ID(42), NULL);
Query OK, 1 row affected (0.08 sec)

mysql> SELECT LAST_INSERT_ID();
+------------------+
| LAST_INSERT_ID() |
+------------------+
|                2 |
+------------------+
1 row in set (0.00 sec)

The manual warns about mixing LAST_INSERT_ID() and LAST_INSERT_ID(expr). This may fall under that same caveat.

snoyes: Views and Social Engineering

Sun, 08 Jul 2007 20:20:06 -0700

CREATE TABLE secretData (
	secretValue int COMMENT 'If this goes over 5, WWIII will start'
);

CREATE SQL SECURITY DEFINER VIEW censoredData AS
SELECT * FROM secretData WHERE secretValue 
<telephone> ring ring
<sysadmin> “Hello?”
<evilFiend> “I’d like to create an insertable view on some tables I already have rights to. I don’t know just yet what I’ll use for my select statement.”
<sysadmin> “Ok. I’ll set it up so you can do what you’d like.”
CREATE SQL SECURITY INVOKER VIEW evilFiendsView AS SELECT 1;
GRANT SELECT, INSERT, ALTER ON test.evilFiendsView TO 'evilFiend'@'%';


evilFiend connects to the server, while twiddling the end of his handlebar mustache.
ALTER VIEW evilFiendsView AS
SELECT * FROM censoredData WITH LOCAL CHECK OPTION;

INSERT INTO evilFiendsView VALUES (42);

Muhahaha!

TracOnDreamhost

Mon, 28 May 2007 07:40:12 -0700

This posting helped me fixed issues i was having after i followed natmaster's guide to installing trac on Dreamhost. http://natmaster.com/articles/installing_trac_0.10.php

lessrain blog » Blog Archive » Flash: Nasty XML load bug in Internet Explorer

Tue, 08 May 2007 12:54:11 -0700

Access Control Quiz

Mon, 16 Apr 2007 15:37:21 -0700

First, the setup:

CREATE TABLE `user` (
  `user` varchar(255) DEFAULT NULL,
  `host` varchar(255) DEFAULT NULL,
  `sort` int(11) DEFAULT NULL
);

INSERT INTO `user`
	(`user`, `host`, `sort`)
VALUES
	('','%',8),
	('testUser','%',7),
	('','%localhost',9),
	('testUser','%localhost',5),
	('','%localhost%',10),
	('testUser','%localhost%',6),
	('','localhost',2),
	('testUser','localhost',1),
	('','localhost%',4),
	('testUser','localhost%',3);

Now, the quiz:

SELECT * FROM user ORDER BY ___

Fill in the blank to get the following output. Difficulty: the `sort` field may not appear anywhere in the query.

+----------+-------------+------+
| user     | host        | sort |
+----------+-------------+------+
| testUser | localhost   |    1 |
|          | localhost   |    2 |
| testUser | localhost%  |    3 |
|          | localhost%  |    4 |
| testUser | %localhost  |    5 |
| testUser | %localhost% |    6 |
| testUser | %           |    7 |
|          | %           |    8 |
|          | %localhost  |    9 |
|          | %localhost% |   10 |
+----------+-------------+------+

Capital. Just capital.

Wed, 21 Mar 2007 08:33:47 -0700

Culled from the Certification Study Guide:

mysql> SELECT * FROM test;
+----------------+
| data           |
+----------------+
| This is a test |
+----------------+
1 row in set (0.00 sec)

mysql> SELECT UPPER(data) FROM test;
+----------------+
| UPPER(data)    |
+----------------+
| This is a test |
+----------------+
1 row in set (0.03 sec)

How’s that work?

Show Answer ▼

 CREATE TABLE `test` (
   `data` varbinary(255) default NULL
 );

Binary strings are just a list of bytes. They aren’t characters anymore, so there is no upper or lower case. Remember that when choosing between char/varchar/text and binary/varbinary/blob.

Firefox and Flash SWF selection and focus problems

Sat, 18 Nov 2006 04:25:31 -0800

Here Be Dragons

Mon, 09 Oct 2006 15:24:51 -0700

I have a table of maps:

CREATE TABLE map (
	mapName varchar(255),
	mapType ENUM('continent', 'region', 'country'),
	continent varchar(255) NULL,
	region varchar(255) NULL,
	country varchar(255) NULL
);
INSERT INTO map VALUES
	('Europe', 'continent', 'Europe', NULL, NULL),
	('North America', 'continent', 'North America', NULL, NULL),
	('Northern Hemisphere', 'region', NULL, 'Northern Hemisphere', NULL),
	('Sweden', 'country', NULL, NULL, 'Sweden'),
	('Mexico', 'country', NULL, NULL, 'Mexico');

And a table of locations:

CREATE TABLE locations (
	locationId int auto_increment primary key,
	continent varchar(255),
	region varchar(255),
	country varchar(255)
);

INSERT INTO locations VALUES
	(NULL, 'Europe', 'Northern Hemisphere', 'Sweden'),
	(NULL, 'North America',  'Northern Hemisphere', 'Canada'),
	(NULL, 'North America',  'Pacific Northwest', 'USA');

Obviously, this example is denormalized - in the real world, I’d use a surrogate key and store continentId, regionId, and countryId. Even then, it’s not the ideal layout for this application. But that’s just part of the challenge.

Here’s the goal: find the most specific map for each location. By most specific, I mean use a country map if available. If not, use a region map. Use a continent map as a last resort.

So, the result set should be:

+------------+---------------------+
| locationId | mapName             |
+------------+---------------------+
|          1 | Sweden              |
|          2 | Northern Hemisphere |
|          3 | North America       |
+------------+---------------------+

Bonus points if it works pre-4.1

Hint ▼

Show Answer ▼

SELECT
	locationId,
	m.mapName
FROM
	locations l
	JOIN map m ON (
		l.continent = m.continent
		OR l.region = m.region
		OR l.country = m.country
	)
	LEFT JOIN map m2 ON (
		(l.continent = m2.continent
		OR l.region = m2.region
		OR l.country = m2.country)
		AND CAST(m.mapType AS unsigned)

Empty Set Equality

Wed, 27 Sep 2006 10:14:49 -0700

SELECT 1 LIMIT 0;
Empty set (0.00 sec)

SELECT 2 LIMIT 0;
Empty set (0.00 sec)

SELECT NULL LIMIT 0;
Empty set (0.00 sec)

Exactly what I’d expect. So here’s the question:

SELECT '1 = 1' AS equality, (SELECT 1 LIMIT 0) = (SELECT 1 LIMIT 0) AS result
UNION SELECT '1 = 2', (SELECT 1 LIMIT 0) = (SELECT 2 LIMIT 0)
UNION SELECT '1 = NULL', (SELECT 1 LIMIT 0) = (SELECT NULL LIMIT 0);

What do you think? Are all empty sets created identical?
Show Answer ▼

MySQL says no.

+----------+--------+
| equality | result |
+----------+--------+
| 1 = 1    |      1 |
| 1 = 2    |      0 |
| 1 = NULL |   NULL |
+----------+--------+

[#SEC-239] Concerns regarding Acegi ACL support - Spring Framework

Wed, 13 Sep 2006 08:12:34 -0700

Experienced user listing some of the shortcomings of the current (1.0) Acegi ACL implementation. A redesign is expected for 1.0.1.

Order By Puzzle

Wed, 23 Aug 2006 08:45:34 -0700

From a question on Freenode.

SELECT * FROM theTable;

+----+----------+
| id | data     |
+----+----------+
|  1 | middle   |
|  2 | first    |
|  3 | showLast |
+----+----------+

Fair enough. Let’s order it by `data`.

SELECT * FROM theTable ORDER BY data;

+----+----------+
| id | data     |
+----+----------+
|  3 | showLast |
|  1 | middle   |
|  2 | first    |
+----+----------+

What??? Maybe the server didn’t quite understand.

SELECT * FROM theTable ORDER BY data ASC;

+----+----------+
| id | data     |
+----+----------+
|  3 | showLast |
|  1 | middle   |
|  2 | first    |
+----+----------+

How did that happen? I assure you I have not switched to some ‘reverse order’ collation.

Show Answer ▼

SHOW CREATE TABLE theTable;

CREATE TABLE `thetable` (
  `id` int(11),
  `data` enum('showLast','middle','first')
)

Ah. `data` is an enum. ORDER BY on an enum orders by the enum index, not the string. You can order by CONCAT(data) or by CAST(data AS char). Are there better ways?

LAST_INSERT_ID and multi-row inserts

Tue, 22 Aug 2006 14:46:01 -0700

A bit of a quiz to see if you’re paying attention:

First, we’ll set up a couple tables with some auto increment fields:

CREATE TABLE t1 (id INT AUTO_INCREMENT, INDEX(id));
CREATE TABLE t2 (id INT AUTO_INCREMENT, refT1 INT, INDEX(id));

Next, we’ll insert a row to one table:

INSERT INTO t1 VALUES (NULL);

Then, we’ll see what happens when we insert two rows using LAST_INSERT_ID():

INSERT INTO t2 VALUES (LAST_INSERT_ID(), 1), (LAST_INSERT_ID(), 2);

What happens here? Did the insert go ok, or did we get an error? What happens if we now issue

SELECT * FROM t2;

Show Answer ▼

No errors, because we defined the auto_increment field for t2 not as a primary or unique key, but just with index. Remember that LAST_INSERT_ID() only picks up the last value you inserted using NULL, and not explicitly defined values. So we get two copies of the value ‘1′ in our id field.

+----+-------+
| id | refT1 |
+----+-------+
|  1 |     1 |
|  1 |     2 |
+----+-------+

I've got my space back : /devices/pseudo/bitbucket@0:bitbucket

Tue, 11 Jul 2006 18:05:29 -0700

Using hibernate.hbm2ddl.auto=update and HSQL in Equinox

Tue, 23 May 2006 16:46:30 -0700

I ran into a few issues when upgrading Equinox to use Spring 1.2 RC1 and Hibernate 3. The main problem is that hibernate.hbm2ddl.auto=update does not work with an in-memory HSQL version that allows more than one connection. Since Equinox represents all th

Rocky Shoals of Ajax Development

Sun, 30 Apr 2006 23:01:55 -0700

A year ago, I started a list of Ajax Mistakes that grew and eventually moved to a collaborative page, where other people could post or edit what they saw as issues in Ajax development.

That list focuses on basic application design mistakes when working with Ajax, such as breaking the back button and using GET and POST requests improperly.

But the specifics of Ajax development are equally perilous to basic application design. The siren’s call of the XMLHTTPRequest object can lead many brave scripters to a demise on the rocky shoals of browser limitations and bugs.

So in the interests of charting out these limitations and bugs, I’ve started another list devoted to these limitations, quirks, and bugs. It’s separated into 3 parts: Basic Browsers, IE, and Firefox.

Again, this post will live on in a collaborative wiki page for future updates.

Basic Browser quirks and limitations

XMLHttpRequest can’t access remote servers. For some odd reason, although there are ways in javascript to send and receive data to remote servers, such as through script or iframe elements, XMLHTTPRequest cannot have a remote server as a target. This is a basic cross browser security rule that may not be immediately obvious to the newcomer to Ajax development.
Multiple Ajax Requests are not fired in order. IE, breaking from a long tradition of ignoring independent standards, chooses to follow the HTTP 1.1 RFC 2616 to the letter, which means that IE may only have two XMLHTTPRequests open at a time; after which IE will retain an internal queue of requests which will be serviced in no particular order. Even if the requests are fired in order, the nature of the internet dictates that they will not be received in order, so never write code that assumes xmlhttprequests will be sent in a particular order.
- Firefox also has a similar albeit more liberal limitation in the number of simultaneous xmlhttprequests that may be open; however In Firefox 1.5, the developer may modify the priority of the internal request queue.
Asynchronous XMLHTTPRequests responses will arrive in no particular order. As implied by the word Asynchronous, XMLHTTPRequest responses may arrive at any time in an unpredictable order that is ignorant of developer intent, happily executing callbacks in the random order in which they eventually wind up on the client.
XMLHTTPRequest does not requires the use of XML. While Ajax is aptly named when it comes to asynchronous execution, it is poorly named when it comes to XML. The XMLHTTPRequest object has a useful method called responseText that delivers the straight text of the response, be it XML, JSON or just simple unadorned text. Using JSON or simple text can be much faster, easier, and more concise than XML.
Ajax uses UTF-8. Normal forms are sent using the encoding of the parent page. Thus a SJIS encoded page will default to sending form content encoded in SJIS. Ajax submitted forms on the other hand will be sent as UTF-8. If for some strange reason, UTF-8 is not the character set of choice for the server, this will require a solution such as the server recognizing and translating UTF-8 responses to a desired character encoding.
Ajax requests are url encoded. A bug relating to this can currently be seen on Digg.com. Submit a comment to digg, and then edit the comment to include a unicode character. The updated comment, sent via Ajax will be added to the database as the url encoded string: resulting in an odd looking url encoded comment.
XMLHTTPRequest cannot transmit files. In a javascript heavy application, a developer might need to include the ability to send files without completely refreshing the page. XMLHTTPRequest however does not include this ability. Instead, a hidden iframe can be used to send the file, and Javascript can simply inspect the iframe. Ajax techniques can further complement this, for example the open source project Uber-Uploader can show a progress bar while uploading a file.

Firefox quirks or bugs

Synchronous XMLHTTPRequests lock up Firefox. The XMLHTTPRequest method provides a third argument, which defines whether the Ajax requests are submitted synchronously or asynchronously. (xmlhttprequest.open(‘GET’, ‘http://www.mozilla.org/’, false);) On Firefox, setting this value to false will submit the xmlhttprequest synchronously and lock up the entire browser.

IE quirks or bugs

XMLHTTPRequest Objects are not reused in IE. Unless the abort method is used, XMLHTTPRequest objects in IE won’t function after the first use, unlike in other browsers such as Firefox. A solution to this is to create a new XMLHTTPRequest object for each connection, although some fear this causes memory leaks, there seems to be no conclusive proof of this, as long as the known closures memory leak issue is avoided, as detailed in the next gotcha.
IE doesn’t use cached images when Javascript inserts HTML with images. This is a general Javascript behavior, but with Ajax heavy applications that insert a lot of HTML snippets, this can lead to a lot of unnecessary image redownloading. The way to solve this is to send all images with proper Cache-Control, ETag, and Last-Modified headers. IE will request images with a ‘If-Modified-Since’ header and the server should send back a 304 header which will tell IE not to redownload the image, and use its cached image.
Closures with circular references in IE cause memory leaks. It’s common in Ajax to use closures, however in IE if a closure has a circular reference, it will cause IE to start leaking memory. In Javascript it’s easy to create closures with circular references, so care should be taken to avoid memory leaks.
Avoiding aggressive caching in IE – even with proper ‘no-cache’ headers, IE caches get requests – this can be solved by changing the get request query string with every request.
IE corrupts gzipped javascript files. Although this is a more general issue with IE’s handling of gzipped content, in Ajax applications where there is a lot of Javascript, developers may be tempted to gzip their javascript to allow for faster page loading and lowered bandwidth consumption. However IE has a known bug where it cuts off downloads in mid-file, corrupting the javascript file.
IE doesn’t cache gzipped Javascript files. Adding to IE’s poor handling of gzipped content is IE’s lack of support for simultaneous gzip and ETag cache headers. Again, this is wider scope than simply Javascript, but it means that even if IE didn’t corrupt the gzipped javascript, it wouldn’t cache it anyways.

I sometimes make mistakes, or overlook things. If you know of something that I’ve overlooked or have found something that I’m wrong about in this post, please contribute your knowledge directly to the wiki page for this list.

Gotchas on SWiK

[from fuzzyfrog] Java gotchas - OWASP

Two for the price of one

Git Error: trailing whitespace, indent SP followed by a TAB, unresolved merge conflict | Its all about RubyOnRails(ROR)

Kiwi Grails: Grails with Jboss and log4j

James Lorenzen's Blog: Grails: Lessons Learned

Grails and Eclipse: Not So Groovy " Brain Flush

James Lorenzen's Blog: How to create a release using the maven2 release plugin

Can't get courier daemon to login mysql? - Ubuntu Forums

GFWiki: TroubleshootingGuide

J2EE and JEE News, Solutions and Tips

SHOW VARIABLES Shows Variables MySQL Does Not Know About

Taking UFS new places safely with ZFS zvols - Multiple Threads : Phil Harman's Weblog

Multiple Threads : Phil Harman's Weblog

HOWTO Avoid Being Called a Bozo When Producing XML

Views and Social Engineering

snoyes: Messing with LAST_INSERT_ID()

snoyes: Views and Social Engineering

TracOnDreamhost

lessrain blog » Blog Archive » Flash: Nasty XML load bug in Internet Explorer

Access Control Quiz

Capital. Just capital.

Firefox and Flash SWF selection and focus problems

Here Be Dragons

Empty Set Equality

[#SEC-239] Concerns regarding Acegi ACL support - Spring Framework

Order By Puzzle

LAST_INSERT_ID and multi-row inserts

I've got my space back : /devices/pseudo/bitbucket@0:bitbucket

Using hibernate.hbm2ddl.auto=update and HSQL in Equinox

Rocky Shoals of Ajax Development

Basic Browser quirks and limitations

Firefox quirks or bugs

IE quirks or bugs

Further reading