Hourly Clock

Announcing the availability of Hourly Clock a Google Gadget developed by me. It uses the nice Google gadget API to show a simple clock and give hourly reminders of the time. So don't let the time just pass by, use this gadget....

Non WS-I document literal web service

A document literal web service with more than one parts specified for the same message is not WS-I compliant.

e.g.

<wsdl:message name="HelloDudeSoapIn">
      <wsdl:part name="name" element="tns:name"/>
      <wsdl:part name="age" element="tns:age"/>
 </wsdl:message> 

The SOAP message would look like:

<soap-env:envelope>
     <soap-env:body>
              <m:name>Baby</m:name>
              <m:age>1</m:age>
     </soap-env:body>
</soap-env:envelope>  

Why the restriction, think about validation of the message. I would have to extract the name and age elements seperately and then validate them against an XSD. If the elements were within a single tag...

<soap-env:envelope>
     <soap-env:body>
             <m:person>
                    <m:name>Baby</m:name>
                    <m:age>1</m:age>
             </m:person>
     </soap-env:body>
 </soap-env:envelope>  

The person element can be completely validated after the person element is extracted.

XPath injection

What is XPath?

XPath (XML Path Language) is an expression language for addressing portions of an XML document, or for computing values (strings, numbers, or boolean values) based on the content of an XML document.
For more information see XPath tutorial.

Understanding the attack

XPath injection is an attack where data is taken from the user without validation (or incomplete validation) and which modifies the behavior of the XPath expression by masquerading XPath as data.

Assume that we have user id and password stored in xml files and we use XPath for validating them. The xml containing the user id and password looks like:

<security-check>
<user>
<id>sash</id>
<password>sash123</password>
</user>
<user>
<id>abhinav</id>
<password>abhinav123</password>
</user>
</security-check>

To validate the user id and password against the xml we use the XPath expression
//user[id/text()='+ {input user id} +' and password/text()='+ {input password} +']
we execute the XPath and check if it returns any nodes, if it returns any nodes then the password is valid. If the entered used id is sash and the password is sash123 the XPath would become
//user[id/text()='sash' and password/text()='sash123']
and would return the user node and the password would be validated. If a wrong password is used no node would be returned and the validation would fail.

Now while injecting XPath in the password field ' or 'a' = 'a is entered. The XPath would become
//user[id/text()='sash' and password/text()='' or 'a' = 'a']
which would return multiple rows and the validation would pass.

Simulating the attack

Sample C# code

XmlDocument XmlDoc = new XmlDocument();
XmlDoc.Load("XPATH_INJECT.xml"); // use the same xml as above
XPathNavigator nav = XmlDoc.CreateNavigator();
XPathExpression expr = nav.Compile("//user[id/text()='"
+ textBox1.Text + "' and password/text()='" + textBox2.Text + "']");

XPathNodeIterator iterator = nav.Select(expr);
if (iterator.MoveNext())
{
result.Text = "passed";
}
else
{
result.Text = "failed";
}

Sample Java code

XPathFactory factory = XPathFactory.newInstance();
XPath xPath = factory.newXPath();
File xmlDocument = new File("XPATH_INJECT.xml");
InputSource inputSource = new InputSource(
new FileInputStream(xmlDocument));

String user = jTextField1.getText().trim();
String pwd = jTextField2.getText().trim();
XPathExpression expr = xPath.compile(
"//user[id/text()='" + user +
"' and password/text()='" + pwd +
"' ]");
Object result = expr.evaluate(inputSource, XPathConstants.NODESET);

NodeList nodes = (NodeList) result;

if(nodes.getLength()>0)
{
jLabel3.setText("Valid"); }
else
{
jLabel3.setText("Failed"); }
}

How to protect against the attack:

There are many ways of preventing this attack

1. Validate the input
2. Escape the ' or '' characters
3. This attack is similar to SQL injection, the most common solution to SQL injection attack is using a prepared statement, but something similar is not available in XPath. This though can be achieved using XQuery but XQuery is not directly supporeted without the use of external libraries in .Net or Java.

The best solution would be escaping the ['] characters, in our example if we replace a ['] with [']['] in the input, we would avoid the attack.
In the previous case our password text entered was ' or 'a' = 'a but this would be modified to '' or ''a'' = ''a
//user[id/text()='sash' and password/text()=''' or ''a'' = ''a']
and would not produce any results (and it is a valid XPath).

This XPath passes in Altova XML spy but not in Java 6 or .Net 2.0

So we still need to find an elegant solution to the problem!!!!

In all the proposed solutions solution (3) is the most elegant but the support is still very limited.

Whats left

Some of the databases now support XPath, in case your database supports XPath be very careful about the inputs (don't forget the validation).

References

http://www.ibm.com/developerworks/xml/library/x-xpathinjection.html
http://www.packetstormsecurity.org/papers/bypass/Blind_XPath_Injection_20040518.pdf

Practical SOA patterns

The SOA patterns I have discussed do not talk about the organization IT policies but the practical SOA patterns:-
1.1 Avoid point to point Web Services:
Problem: Web Service point to point is STILL point to point; doing a bad practice in XML doesn't make it better.

Effect: An organization believes that they are creating next generation loosely coupled architecture just because they are using Web Services. Web Service calls are invoked directly, using a URI which is hard-coded into the WSDL. Having a highly disorganized and interdependent systems model leads to increased cost of change and a high degree of fragility of the enterprise. When one service is changed a number of other services either fail or behave in unpredictable ways. There is a lack of clarity as to how one service depends on another and what the impact of change is across these services. Consumers then start demanding multiple versions of services, and these add further to the spaghetti in the enterprise.

While designing a BPEL process the endpoints of the web service may not be known, there is no simple way to determine the web service endpoint dynamically.

Resolution: The first step is to indirect all of the calls and this can be done in a number of ways; the least invasive is to "proxy" all web-service requests via some form of mediation. So while the host application is still calling webservice.mycompany.com, this is proxied so mediation and routing can be applied if required. The next stage is to understand the different dependencies and identify those which are valid and those which should have been done in a more managed way. A clear governance plan then needs to be created to identify and manage dependencies and versions and to help manage the Web Service infrastructure.

Once this level of management has been created it is time to start considering what the enterprise Service model should be, that requires the creation of the business service architecture and then overtime evolving the current infrastructure to better represent the business that pays for it.
1.2 Use Business Rules to make your process flexible:

Problem: Orchestration Languages provide constructs that break the linear flow of control. These constructs alter the flow of service orchestration based on run time information. These constructs change often.

Effect: In mortgage decisioning a conditional control structure implements the pre-screening step that determines whether the process performs decisioning or generates a rejection letter instead. The conditional verifies eligibility, determining how the orchestration unfolds based on whether the applicant's credit score is above a threshold. In effect, the condition associated with a control structure in the orchestration definition captures a business rule. In case the threshold changes, there is a change in the business process and the process needs to be changed and deployed again.

Resolution: Business rules complement processes. While business processes provide recipes for achieving results, business rules describe the operations, definitions and constraints that apply to an organization in achieving these results. For example a business rule might state that no credit check is required for existing Orchestra Bank customers. A business rules engine integrated with the BPEL manager can be used to solve the problem.

1.3 Use Composite Services to combine multiple services:

Problem: We need to combine the functionality of multiple services and make it available to consumers interested in is as a whole rather than the individual services implementing it.

Effect: Combining existing services could provide significant value over any individual service. In fact the recursive composition is key to the ability of adding value through combining functionality of the existing services. As the number of SOA adopters increases so does the number of choices.

Service consumers require functionality which can be implemented by suitably combining multiple existing services. They do not want to make multiple calls to the individual services and control the invocation flow.

Combining the functionality of existing business services (especially when they are provided by different organizations) requires a certain amount of know how and typically has sensitivities (e.g., the underlying services may change or different providers for these services can be selected). Exposing this knowledge to the service consumer introduces coupling.

Following mergers and acquisitions or through agreements with multiple partners several business services with similar functionality can be available to the enterprise (similarly to the credit check service from the context). These services can be distinguished by their interfaces and SLAs. The availability of multiple choices places the onus of selecting one service to the consumers, thus introducing coupling.

Solution: Expose the services involved in satisfying required functionality and their coordination as a separate service.
I was already using quite a few of these patterns but found them documented in Antipatterns and Orchestration patterns.

Java Annotations

I was preparing a talk on annotations in java and ended up learning a few cool stuff.

I believe the utility of annotations would be the freedom from implementing interfaces like the JUnit test case and the EJB 3.0.

New and innovative uses for annotations are also likely to come up.

Annotations is cool if used intelligently. Now if a developer wants to use a annotations to save configuration values I ask can you blame annotations.

The problem lies sometimes in the fuzziness of what is configuration values. Say in hibernate in by bean I hard code my table name, is my table name configuration. I believe not, but in some cases it could be true. I haven't seen table names being different in production environment and development but using annotations makes it less flexible.

Sun could have made the creation of annotations more 'Java like' @interface to define an annotation and the definition of the default values....

The annotation processing tool is also very interesting. The tool ties us with the Sun jdk and probably would evolve as a part of standard SDK distribution.

Presentation is available at : http://sashwat.gupta.googlepages.com/Annotations.pdf
Example code is available at : http://sashwat.gupta.googlepages.com/annotation.zip