Thursday Night

Adobe Pool Party.

Pretty fun! One takeaway was meeting the Adobe Usergroup manager - Aaron Houston. He suggested we join OCCFUG and also said he'd be able to hook us up with CF Builder and possibly a CF9 license.

Clean Code

Nothing epic in this one - except the bit about commenting!

http://www.briankotek.com/blog/

Variables:

Intention

No Cryptic Names

No Internal Abbreviations

Be Serious

Question- does a word length affect processing time?

Don't use i

Don't use temp

Don't use Arr

For loops - use "thisSomething" - makes things clearer inside big loops

If/Else and Switch/Case

Minimize use

Simple conditions - try to avoid (if and ( OR) And NoT )

Break it up.

Avoid nesting

Don't assume something will run. Try to add a else catchall

Loops - avoid nesting.

Put nested loops in their own functions:

Naming.

Method/Function Names:

Use Verb orientated names

updateFeed()

Methods;

Smaller==better

More cohesive

Easier to test

Easier to override

Functions/Methods - return the result and act on it, don't do stuff inside and return a true/false

Error Codes (I do this badly)

Use Exceptions.

Classes/CFCs

Noun Oriented Names

DON'T COMMENT CODE!

A comment is a failure :-)

Make the code the comment.

If you absolutely have to, explain WHAT now HOW

DON'T COMMENT OUT CODE.

Comments are not version control!

All it offers is confusion.

Comments are obliged to be updated, so you'll always need to update them.

Railo

Supports scripting.

Caching (honestly, the theme of this entire conference seems to be caching)

Different types of caching (easily built into cache tags to allow EH,MEM,Railo,etc)

The admin control of the cache is insane. Caches are replicated across server farms.

CF Powered iPhone Apps

Looks like they're talking about pointabout style webkit apps.

The Coldbox stuff seemed like massive overkill to serve up REST data, but the process seemed interesting and very flexible and expandable. (We don't need coldbox as a framework)

The best part of the talk was a live iphone app build. He wrote one almost from scratch.

Full talk here soon.

http://joshhighland.com/

CFML Security

Pete Freitag

http://www.petefreitag.com/

http://foundeo.com/security/ --- might think about getting this - will stop the SQLInjection attempts

Use CFQUERYPARAM - more secure, more performance.

~~~~~~~~~~~~

Path Traversal -

avoid/protect referencing pages

site.com/go.cfm?page=hello.cfm

Can becomre

site.com/go.cfm?page=../../some/file.txt

~~~~~~~~~~

CRLF Inection

CRLF=\r\n %0d%0A

You can insert a header into a page by adjusting things pushed into a content type.

NOTE: This can drop into CFMAIL by adding a content-type in a form -- WE SHOULD CHECK FOR THIS.

Solution is like this:

cfset form.subject=ReReplace(form.subject,"[\r\n]","","ALL")

~~~~~

Insecure File Upload

You can upload files that are actually CFM. Not just check content type, check filename and upload outside the webroot.

--- GREAT COMMAND: ab

Apache Benchmark - useful for doing quick/dirty load test and performance.

~~~

Use whitelists over blacklists

ALLOW jpg,pdf,png

instead of

BLOCK cfm cfc jsp

~~~~~

SQL INJECTION

Allows sql commands into the URL ?id=1234;SOME SQL HERE

Demos of how they work.

uSe CFQUERYPARAM

(yeah we know, but the demos were pretty cool!)

One place to check is SELECT TOP n

Change to:

SELECT TOP #int(Val(n))#

Val() returns 0 when it can't recognize a number (this could be useful in the degree symbol problem)

~~~~~

XSS Hacking

You can put a script snippet in a URL

page.cfm?name=bob <script>replace a div</script>

Make sure you escape characters (use XMLFormat ) or OWASP (ESAPI)

http://www.owasp.org/index.php/Main_Page

This provides a Valid/Safe HTML validator: AntiSamy

http://blog.pengoworks.com/index.cfm/2008/1/3/Using-AntiSamy-to-protect-your-CFM-pages-from-XSS-hacks

Which we could use for the forecasters.

~~~~~~~

SESSION HACKING

use addtoken=false in cflocation

use UUID fro CFToekn

Use HTTPOnly session cookies

Use Secure cookies for SSL

Use SSL

Cookie path attribute.

CROSS SITE REQUEST FORGERY

Hard to explain.

Solution, use POST for submits.

CHeck that referers of forms are your own site.

Compare hidden form variable with session variable

SUMMARY:

Validate Everything

Become a regexpert

Check ALL inputs

Be paranoid

Keep Learning

Extending Java With ColdFusion

http://www.rupeshk.org/blog/

Coldfusion IS java

JEE APP SERVER - JAVAAPP

CF APP

JAVA APP2

CF APP2 etc

ALl the objects in CF are in Java and vv (eg strings, querys, arrays, numbers)

WHY?

CF use Java? - take advantage of libraries. Features not available in CF, eg EHCACHE, Hibernate. iText, Webchart

WHY

Java use CF? (*** THIS COULD BE A WAY TO MIGRATE BW TO CF SLOWLY)

Easy, Rapid development, readymade services

CF use Java

Java CFX Tags. (write in java, serve in CF)

JSP/Servlets/tag libraries.

We are Talking about Direct invocation:

createObject("java",className) CFCFOBJECT type="java" class="classname" name="variable">

invoke using:

obj.foo(arg1,artg2)

eg

cfobject type="java class="java.lang.StringBuffer" name="bigg"

cfset buf.init("CfUnited")

cfset buff.append(" 2010")

(I cant type fast enough - hope its available after)

Basically he's going through demos of how to call java from CF and vice-versa

Lunch Thursday

Lunch with Ben Nadel, and Yaron (from shoesforcrews.com) and a guy from an Insurance Company (don't remember his name)

We spoke at length about the problems we face with slowdowns, bottlenecks and so on. the universal response is "get Fusion Reactor" - you're not hunting blind.

The other refrain was "index your tables' which we know about, but it's probably worth running the query analyzer for a long time, during a quiet period on the site, and seeing what it comes up with. Running the QA during firefighting is not giving us enough insight.

Other things we discussed:

Adding a "block" feature to our cache code (Shea can expand on this) but basically having a double level of caching that only ever lets ONE person make new cache content.

Something else really cool that I don't remember... (it'll come to me)