Content Security Policy is intended to mitigate a large class of Web Application Vulnerabilities: Cross Site Scripting. Cross Site Request Forgery has also become a large scale problem in Web Application Security, though it is not a primary focus of Content Security Policy.

In an ideal world, this would be great, but getting all the browsers on board and implemented may take a while. I was thinking about this the other day and I don’t see why the browsers/w3c can’t standardise on some sort of tag or conditional comments that says don’t execute any script in here. This would be simple to use and surely simple to implement. Browsers already know what to do with <noscript>

For Example:

<dontexecutescript>
    <?php echo $this->escape($userProvidedContent);?>
</dontexecutescript>

Or:

<!--[dontexecutescript] -->
    <?php echo $this->escape($userProvidedContent);?>
<!--[dontexecutescript]-->

I’m no expert on XSS, but I’m pretty sure this would solve most of the issues encountered.

Update:

Okay, so one obvious problem might be that the $userProvidedContent contains a closing </dontexecutescript> tag, but that’s just semantics. Unique identifiers for each block, ignoring tags that don’t match up, these browser developers are clever, they could come up with something.

To solve this, I started out to implement a simple queuing system, whereby the distribution requests are added to a queue, before being sent out by a scheduled task.

Rather than refactor a lot of code and do this some fancy way, I quickly put in a solution that proved the concept and seems to work pretty well for now, with minimal effort. As an example (our code’s slightly more complex, I don’t get paid for nothing), here’s what I started with:

< ?php
class EmailSender {
    /**
     * Takes an array of addresses and sends an email to each one.
     *
     * @param array $address
     */
    public static function sendEmails($address) {
        /**
         * Code in here
         */
    }
}

The idea was fairly simple and I'm sure it's been done many times before. First step was to rename the existing method and make it private. I then wrote a new method, that checked to see if there was a queue available, if so adds the request to the queue, otherwise calls the old method. Then all I had to do was write a method that checks the queue, running any requests it finds through the original method. We've recently adopted the Zend Framework, so checking out Zend_Queue from the incubator, reading some documentation with my docbook goggles on (couldn't be bothered to build it) and it was pretty much in place.

< ?php
/**
 * Zend_Queue offline processing hack example
 *
 * @author      Dave Marshall
 * @version     $Rev: $
 * @since       $Date: $
 * @link        $URL: $
 */
class EmailSender {

    private static $queue = null;

    /**
     * Set Queue
     *
     * @param Zend_Queue $queue
     */
    public static function setQueue($queue)
    {
        self::$queue = $queue;
    }

    /**
     * Takes an array of addresses and sends an email to each one.
     *
     * @see reallySendEmail
     * @see sendQueuedEmails
     * @param array $address
     */
    public static function sendEmail($address)
    {
        if (self::$queue === null) {
            return self::reallySendEmail($address);
        }

        self::$queue->send(serialize(func_get_args()));
    }

    /**
     * Takes an array of addresses and sends an email to each one.
     *
     * @see sendEmail
     * @param array $address
     */
    private static function reallySendEmail($address)
    {
        /**
         * Code in here
         */
        echo 'Sending email to ' . implode(', ', $address) . PHP_EOL;
    }

    /**
     * Reads emails from the queue and sends them
     *
     * @param int $count - The number of queued items to process
     */
    public static function sendQueuedEmails($count)
    {
        /**
         * Should really check the queue is good here
         */

        $messages = self::$queue->receive(intval($count));
        foreach($messages as $msg) {
            $args = unserialize($msg->body);
            call_user_func_array(array(__CLASS__, 'reallySendEmail'), $args);
            self::$queue->deleteMessage($msg);
        }
    }
}

set_include_path(
    dirname(__FILE__) . '/src/Zend_Framework/library' . PATH_SEPARATOR
    . dirname(__FILE__) . '/src/ZendI/library' . PATH_SEPARATOR
    . get_include_path()
);

require_once "Zend/Loader.php";
Zend_Loader::registerAutoload();

define('DB_SERVER', 'localhost');
define('DB_PORT', 3306);
define('DB_USER', 'root');
define('DB_PASS', 'password');
define('DB_NAME', 'queue_example');

/**
 * Transmittal Queue
 *
 */
$config = array(
    'name' => 'transmittal',
    'driverOptions' => array(
        'host'     => DB_SERVER,
        'port'     => DB_PORT,
        'username' => DB_USER,
        'password' => DB_PASS,
        'dbname'   => DB_NAME,
        'type'     => 'pdo_mysql'
    )
);

// Create a database queue
$queue = new Zend_Queue('Db', $config);
$queue->createQueue('myqueue'); // called for good measure

EmailSender::setQueue($queue);

/**
 * Usage for adding to the queue
 */
EmailSender::sendEmail(array('davemastergeneral@gmail.com'));

/**
 * Usage for scheduled task
 */
EmailSender::sendQueuedEmails(5);

This may not be the best practice in the world, but it got the job done. Check it out at ZFSnippets.com.

We recently started using Redmine as our issue tracking software and we’re very pleased with it. I trialled several alternatives, both open source and commercial, including Jira, FogBugz, Mantis and Trac, but decided on Redmine. Jira and FogBugz look like excellent products, but I don’t feel we would use the extra functionality that warrants the price tag. Mantis looks a bit dated and although it’s been a while, last time I tried to install and configure Trac, it was a bit of a nightmare.

First thing first, here are some of our requirements for an issue tracker:

• Multiple Projects
• Time tracking
• Notifications (email, rss, im etc.)
• Wiki
• SCM integration

Redmine does all of this and a little more, but we haven’t used the other features that much. It does what we want really well, so that’s good enough for us.

What I like

Editing issues in bulk is fantastic. We deploy our application fairly casually, and when we do we set all the issues that have been deployed as closed and assign them a version number. Highlight the issues, right click and set the version number.

The SCM integration does all we need it to. If we add Fixes #500 or Implements #500 to a commit message, issue 500 will be set to resolved and 100% complete and the revision number and commit message appears on the issue’s page. Alternatively, just putting Refs #500 will show the revision number and commit message in the page, without changing the status.

Issues themselves can have custom fields, but we don’t use them all that much. We do make lots of use of the descriptions and notes as they both take wiki markup, meaning we can enter rich text including source code highlighting and images, linking to changesets, wiki pages, target versions, source code and other issues. I like the ability to embed screenshots and call graphs in issues.

What I don’t like

Here’s a couple of things that bother me, if I shift my arse I might look into creating patches for the simple ones.

No API! It would be really nice to have an API and there’s one in the works, but it’s sounds like it’s a bit of a ballache changing fat controllers into fat models.

I often wish a few more items where ‘clickable’. For instance when viewing the issue list, I’d like to be able to click the Category name in one of the rows and see a list of issues for that category.

You can save filters on the issue list, which is ace, but it would be nice if you can ’save as new’. I often create lots of very similar queries and have to build up each one from scratch.

I also contributed a basic bit of code to Rob Allen’s Shorter Links plugin for wordpress, allowing users to specifying a base url, davedevelopment.co.uk isn’t all that good for short URLs. Just need to upgrade the plugin and decide on a short domain for my blog now.

Update: registerd daved.in, works a treat

Since then, following suggestions on the feedback forum I’ve implemented a few new features. What I’ve noticed is the ease at which these features where added, thanks to the quality of the Zend Framework.

Favourites

Along with adding icons for up votes, there’s now a little star icon to add snippets to your favourites, easily accessible from your user page. A little sprinkling of dojo and these are added via AJAX.

Revision History

Snippets can now be edited by the creator and a revision history is kept.

Using a simple implementation of the Longest common subsequence problem, you can also view diffs of the revisions.

Search

Lastly there’s the search engine, built on top of Zend_Search_Lucene. This took a little more work, but the results were worth it. I hadn’t realised how powerful the Lucene query language was until now and I’m very impressed with the implementation.

As you would expect, traffic has slowed down considerably since the initial burst, but there’s still a bit of steady traffic there and I hope people keep coming back to visit now and then. As for going forward, I think I’ll add a field to allow contributors to specify which zend framework version their snippet was tested or is compatible with, then look a little more at the scoring system.

Seriously though, this book is great.

Not so long ago I was working on a little project using the django framework and was looking for a simple nested set implementation, I found one that was good enough for my needs on djangosnippets.org. I thought this was pretty cool, and realised we didn’t have a one stop shop for Zend Framework code snippets. Symfony and CakePHP also have dedicated sites for this. I’m aware of generic snippets sites and pastebin sites, but I thought it’d be another good learning opportunity to build my own with the Zend Framework, for the Zend Framework.

I’ve ended up implementing a pretty simple site, ZFSnippets. The current basic implementation makes use of:

• Zend_Auth
• Zend_Config
• Zend_Controller
• Zend_Db
• Zend_Feed
• Zend_Form
• Zend_Layout

• Zend_Mail
• Zend_OpenId
• Zend_Paginator
• Zend_Registry
• Zend_Session
• Zend_View

There are plenty of things I’d like to implement (and fix;)), but will have to see if I find anytime:

• A site search engine using Zend_Search_Lucene
• More flexible posting, probably using wiki style markup
• Version history for all snippets
• Moving to a stackoverflow.com style, trust model, allowing regular users to collaborate, edit and update snippets.
• Forgot my password link
• Contextual error handling and descriptions
• Accurate scoring/ranking, based on complex calculations.

I did actually spend quite a bit of time looking at markup libraries, coupled with HTMLPurifier, but it seemed like too much effort to start with, so I opted for a method of splitting the source code using hashes like pastie.

I like the idea of having a go with Zend_Search_Lucene, probably adding particular snippets to a queue for indexing whenever somebody posts one or comments on one.

Having built the site, I’m actually struggling to think of what might go on there. Helpers seem like an obvious one, but without building large, complex Zend Framework application, I don’t have much need for custom code, the framework does the leg work for me. Nevermind, if you think it might be any use to you, head on over there and have a browse around, although it’s a little low on content at the minute, or maybe subscribe to the feed and keep your eye out for anything interesting.

Advertisement: PHPPositions UK - Genuine PHP jobs, at Genuine companies

<?php
class BankAccount
{
    protected $balance;

    public function __construct($balance)
    {
        $this->balance = $balance;
    }

    public function __toString()
    {
        return 'Balance: ' . $this->balance;
    }

    public function debit($debit)
    {
        $this->balance -= $credit;
    }

    public function credit($credit)
    {
        $this->balance += $credit;
    }
}

class SavingsAccount extends BankAccount
{
    public function __construct(BankAccount $parent)
    {
        $this->balance = $parent->balance;
    }
}

$first = new BankAccount(1.00);
$second = new SavingsAccount($first);

echo $second, PHP_EOL; // Balance: 1

It turns out that PHP’s visibility restrictions are on a class level, rather than an instance level, and the fatal error was actually due to a bug in 5.1.x.

The visibility of a property or method can be defined by prefixing the declaration with the keywords: public, protected or private. Public declared items can be accessed everywhere. Protected limits access to inherited and parent classes (and to the class that defines the item). Private limits visibility only to the class that defines the item.

This bemused me, as it would appear to me there is no point having a protected operator at all. Suppose I am a lowly programmer given the BankAccount Class above as an API I can use but not change. I have a data access object that returns BankAccount objects too, which I also can’t touch. For reasons unknown to me, but probably to try and create some encapsulation so they can log transactions via the credit and debit methods, the original developer decided that I shouldn’t be able to directly access the balance attribute, but I want to.

<?php

//$myAccount = $dao->getAccount(123);
$myAccount = new BankAccount(1.00);
echo $myAccount, PHP_EOL; // Balance: 1

class WorkAround extends BankAccount
{
    public static function setBalance(BankAccount $acc, $balance)
    {
        $acc->balance = $balance;
    }
}

WorkAround::setBalance($myAccount, 1000000.00);
echo $myAccount, PHP_EOL; // Balance: 1000000

This just doesn’t seem right to me. Don’t get me wrong, I appreciate there needs to be some level of responsibility taken by developers to not do this kind of thing. My colleague writes a lot of Java, in which this is also the expected behaviour with the protected visibility, hence why he set out on this path, so it seemed right to him. Because of this I embarked on a little research to determine how other languages implement visibility.

A very quick and non-extensive bit of research led me to believe that Python doesn’t have visibility as I know it, and C# has protected and internal, but neither work the way I’d like. Ruby has the closest to what I desire in the form of instance variables, but I’m sure there’s plenty I’ve missed.

class BankAccount
    def initialize(bal)
        @balance = bal
    end

    def debit(debit)
        @balance -= debit
    end

    def credit(credit)
        @balance += credit
    end

    def to_s
        "Balance: %d" % @balance
    end
end

class SavingsAccount < BankAccount
    def setBalance(acc, bal)
        # This wont work - we cant access acc.balance
        # acc.balance = balance;
    end

    def bonusCredit(credit)
        # just to prove a sub class can access
        # the instance variable
        @balance += credit + 1
    end
end

first = BankAccount.new(42);
second = SavingsAccount.new(1);

second.setBalance(first, 5000000);
second.bonusCredit(10);

print first  # Balance: 42
print second # Balance: 12 

It worries me sometimes when I come across things like this that I blatantly should know and understand properly. Cheers JC.

Advertisement: DaveProxy - Free CGIProxy, bypass company and school browsing restrictions

I’ll pick two email addresses at random this time next week and get the books posted out.