Excel : Pesky hyperlinks

I hate the fact that Excel automatically changes a URL to a hyperlink when you click on it or want to cut and paste.

To get round this abysmal behaviour (I have Excel 2003):

Tools / AutoCorrect Options / "AutoFormat as you type" / Uncheck "Internet and network paths with hyperlinks".

Another way is to simply type an apostrophe in front of the URL.

If you already have the damn things, you can right click and "Remove Hyperlink".

For multiple ones (as per the Help file):

Type the number 1 in a blank cell, and right-click the cell.
Click Copy on the shortcut menu.
While pressing CTRL, select each hyperlink you want to deactivate.

No more damn hyperlinks!

Enjoy!

Visual Studio: Fiddler and Team Test web test

Noticed that the amazing Fiddler has the capacity to generate Team Test web tests for you.

See here.

Aside: Note the comment further down the page:

"Please see http://blogs.msdn.com/slumley/pages/how-to-debug-a-web-test.aspx for information on how to troubleshoot problems with WebTests".

Very useful link!

Enjoy!

Visual Studio

I've been playing around with Team Test 2008 running on Windows 7.

When I try and capture a web test, the browser would lock up with the comment:

"The web test recorder must be launched from within Visual Studio".

WTF, I am within Visual Studio!

Mr. Google to the rescue and the solution is that you have to run VS with administrator rights.

Right-click on the shortcut / Properties / Compatibility / Check "Run this program as an administrator".

Problem solved.

Enjoy!

XP : Profile keeps filling up with Sun cache

Had a problem with my profile always being fill with Sun cache files i.e. files under:

\Documents and Settings\\Application Data\Sun\Java\Deployment\cache

The easy way to clear these out is to click on the Java Control Panel in Control Panel.

Under the General tab / "Temporary Internet Files" / Settings / "Delete Files"

You can also vary the amount of space these files use by adjusting the slider on that page.

Yup - tons more profile space.

Enjoy!

Misc : Let me Google that for you

"This is for all those people that find it more convenient to bother you with their question rather than google it for themselves."

Go to the site

Type your question and click the "Google Search" button.

Then you can share the link that's generated on the page.

e.g. searching for "Java for loop" generates:

http://lmgtfy.com/?q=Java+for+loop

Go to the link and watch what happens! :-) Now you send that link to the person who bothered you with the question in the first place.

If you hover your mouse over the link on the lmgtfy page, you see a button for "tinyurl" and "go". The first generates a tinyurl as you would expect and the second shows you what happens when the user clicks on the generated link.

Clicking the "Live Stream" at the bottom shows you what other people are searching for and if you click the dropdown at the bottom you can generate the page in a number of languages.

Now bug off and do your own searches!

Enjoy!

Java : FizzBuzz

I regularly read Jeff Atwood's blog and renewed my acquaintance for an old post: Why Can't Programmers.. Program?.

It talks about the Fizz-Buzz question i.e.

"Write a program that prints the numbers from 1 to 100. But for multiples of three print "Fizz" instead of the number and for the multiples of five print "Buzz". For numbers which are multiples of both three and five print "FizzBuzz". "

So I took up the challenge and knocked this out in Java using Netbeans in about 4 minutes.

for (int i = 1; i < 101; i++)
        {
            int j = i % 3;
            int k = i % 5;
            System.out.print("Number is " + i);
            if (j == 0 && k == 0)
            {
                System.out.print(" FizzBuzz ");
            }
            else
            {
                if (j == 0)
                    System.out.print(" Fizz ");
                if (k == 0)
                    System.out.print(" Buzz ");
            }

             System.out.println();
        }

So there!

Enjoy!

Mercurial : A tutorial

Have been using Subversion for some time but am looking to move to something that handles merges with a little less pain.

I refactored a whole lot of code, moved tons of stuff around and merging this was a pain!

Came across this tutorial by Joel Spolsky. He writes really well as regular readers of his blog will know. Nothing wrong with a bit of humour and it's not often that I LOL reading tutorials :-)

There's also a "Red Bean" book here.

Enjoy!

Misc : Tools I use

These are the ones I use almost every day. These all run on Windows XP.

Free unless otherwise stated.

Not quite as large as Scott Hanselman's Ultimate Developer And Power Users Tool List For Windows though !

Notepad ++ - really useful text editor with language syntax - multiple tabs and multi-file search.

Winmerge - text compare and merge utility - I use it every day!

Beyond Compare - file compare which also works across FTP sites - really useful for testing if deployments etc. are up to date. Not free.

Paint.Net - graphics manipulation program. use it all the time for inserting screen shots into specs. etc.

Feeddemon - Windows RSS aggregator. Synchronises with Google Reader.

Wireshark - protocol analyser and LAN sniffer.

7-zip - handles zip files, jar files and just about everything else.

Passwordsafe - keeps my millions of passwords safe and sound.

Printscreen - allows you to print / copy / save screens or portions of them.

Google toolbar - especially the Spell check.

Sysinternals - excellent range of utilities - I user "Process Explorer", "Process Monitor", "ZoomIt" and "TcpView" a lot but have a look.

Putty - Telnet / SSH client.

Enjoy!

XP : Clearing out and freeing up disk space

The old XP warhorse was seriously low on disk space so a bit of TLC was required.

Warning: This worked for me - you're on your own! Backup important stuff first!

Run CCleaner.

Just get it dude!

Then run PC Decrapifier. This didn't do much in my case but then I'm quite strict on what I install in the first place.

Then, using Explorer Search, I searched for *.log, *.tmp and *.bak and deleted all the junk.

Then I searched for all files greater than 10 Mb and deleted all the junk.

Advice: If in doubt , don't delete.

Then I deleted the old "Windows Update" files. These are the ones in the /Windows folder in folders like "$NtUninstallKB842773$". Again, Google this if you're not sure.

Then I deleted the files in the /Windows/Prefetch folder. Again, Google this if you're not sure.

If you have SQL server installed, you can clear out most of the files on the C:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\LOG folder. Again, Google this if you're not sure.

And then run Windirstat. This gives a graphical representation of who is using what. Poke around a bit.

Man, I had a ton of crap on my PC and now it's gone!

Enjoy!

StackOverflow : There goes my rep!

Before the big recalculation:




(That's 4595 !)
and after:




(That's 3636 !)
Enjoy!

Misc : Can't login to Stack Overflow with Blogger OpenID

Suddenly couldn't login to Stack Overflow or it's "family" (Meta, ServerFault, SuperUser etc.) using my Blogger OpenID. (Cue: Major panic).

Mr. Google to the rescue - the answer is here in this article How to upgrade your Blogger OpenID to a decent one.

Note: I did not get the length error reported in some posts but the above sorted out my problem.

Tip: To ensure this doesn't happen again, get an alternate OpenID - I used Google. Just click on your user name at the top of the StackOverflow screen and then click "Change OpenID" (next to the "Edit" hyperlink). You then get an "openid" and a "alt openid" and you can swap the two around using the "swap" hyperlink.

Enjoy!

Preventing Cross-Site scripting in Java

You can read about XSS here: Cross-site scripting

Been trying to figure out how to disable it using html encoding and what Java libraries are available.

OWASP's site has an article on this: http://www.owasp.org/index.php/How_to_perform_HTML_entity_encoding_in_Java

To quote:

"Injection attacks rely on the fact that interpreters take data and execute it as commands. If an attacker can modify the data that's sent to an interpreter, they may be able to make it misbehave. One way to help prevent this from happening is to encode the attacker's data in such a way that the interpreter will not get confused. HTML entity encoding is just such an encoding mechanism for many interpreters."

There are two ways to encode the data viz. entity reference and numeric reference:

From Wikipedia:
http://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_references

An entity reference uses the "&" symbol:

& quot; (double) quotation mark
& amp; ampersand
& apos; apostrophe (= apostrophe-quote)
& lt; less-than sign
& gt; greater-than sign

A numeric character reference refers to a character by its Universal Character Set/Unicode code point, and uses the format

&#nnnn;
or

&#xhhhh;
where nnnn is the code point in decimal form, and hhhh is the code point in hexadecimal form

Although the OWASP article mentioned above talks about entity references, the code sample enclosed actually uses numeric entity encoding i.e.

<script></script>

encodes as:

&hash60;script&hash62;&hash60;&hash47;script&hash62;

where "hash" = the "#" character

Some further research around this issue leads to:
AntiXSS for Java which is a port to Java of the Microsoft Anti-Cross Site Scripting (AntiXSS) library for .NET applications

and to:
Open Web Application Security Project (OWASP)

which has a:
Enterprise Security API (ESAPI)

Click on the "Java EE" tab. There are two ways to invoke the functionality. One uses the classes directly:

import org.owasp.esapi.codecs.HTMLEntityCodec;

public static StringBuilder esapiCodecHtml (String s)
    {
        HTMLEntityCodec hec = new HTMLEntityCodec();
        StringBuilder b = new StringBuilder(s.length());
        char[] immune = { ',', '.', '-', '_', ' ' };
        String returnStr = "";

        String clean = ESAPI.encoder().canonicalize(s);
        System.out.println ("Cleaned result is " + clean);

        for (int i = 0; i < s.length(); i++)
        {
            char ch = s.charAt(i);
            returnStr = hec.encodeCharacter(immune, ch);
            b.append(returnStr);
        }

        return b;
    }

Note: ESAPI canonicalizes input before validation to prevent bypassing filters with encoded attacks. Failure to canonicalize input is a very common mistake when implementing validation schemes. Canonicalization is automatic when using the ESAPI Validator.

and the other uses the wrapper:

import org.owasp.esapi.ESAPI;

public static String esapiEncodeForHTML (String s)
{
String returnStr = "";

String clean = ESAPI.encoder().canonicalize(s);
System.out.println ("Cleaned result is " + clean);
returnStr = ESAPI.encoder().encodeForHTML(s);

return returnStr;
}

They both convert <script></script> to andlt;scriptandgt;andlt;&hashx2f;scriptandgt;

where "and" is the "&" character.

Interestingly, this is a combination of both reference types.

Just to note: The example at the top converted the "/" to &hash47; whereas ESAPI converts it to &hashx2f; This is because one is decimal and one is hex!

Asides:

Refer to:

XSS (Cross Site Scripting) Prevention Cheat Sheet

Refer to my SO question:

Java - XSS - HTML encoding - Character entity reference vs. Numeric entity reference

Enjoy!