I'm using WSDLReader.readWSDL() to create a Wsdl Definition.
I want to know if there is a flag available in javax.wsdl.WSDLReader to check for XXE attack in the WSDL ?
In Java you need to explicitly turn it off. Please try the featured in below link to turn it off
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#XMLReader
Adding the code related to the flags to be turned off from the link provided above:
XMLReader spf = XMLReaderFactory.createXMLReader();
spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd",false);
Related
With a local client side application, with
import 'dart:io';
I see no way to load up the consumers current default browser and then load a web page. (Locally stored HTML or a website)
I've searched the API documentation at http://api.dartlang.org yet have found no easy way.
Is there any way of doing this yet?
Preferably similar to the Desktop class in java ?
I don't think there's a function for that. You can fill a new feature request.
If you need a workaround, you can deal with the Process and Platform classes.
on Windows you should be able to launch the default browser with start ${url}.
on linux, you can do that with xdg-open ${url} if xdg-open is present.
in other cases, there should be a solution...
Here is a sample :
import 'dart:io';
main() {
final url = "http://dartlang.org";
if (Platform.operatingSystem == 'windows') {
Process.run("start", [url]);
} else if (Platform.operatingSystem == 'linux') {
Process.run("xdg-open", [url]);
}
}
On Windows I find the runInShell flag needs to be set:
Process.run("start", [url], runInShell: true);
(at least on Windows 7).
I'm surprised that someone has not created a package to reliably invoke the default browser on all platforms.
I have a basic FF addon that polls for something in the DOM of the page in window.document. When it sees it, it is supposed to save the page. That's the hard part. I don't want to replicate the functionality of "save complete" I just want to call the pre-existing functionality from the plugin/addon at the right moment.
Is this an XPCom thing? Or is it pure JavaScript via the relevant APIs ?
iMacros for Firefox can invoke Save-as (without popping the associated dialog), but I can't see how.
Can anyone advise as to how to call deeper Firefox functions like this?
Thanks, - Paul
PS - I really love Mozilla Archive Format, with MHT and Faithful Save but I think it is replicating functionality again. My alternative is to invoke it's function, but that's as opaque to me as the firefox native one.
You can use nsIWebBrowserPersist.saveDocument() for this:
var persist = Cc["#mozilla.org/embedding/browser/nsWebBrowserPersist;1"].
createInstance(Ci.nsIWebBrowserPersist);
var localPath = Cc["#mozilla.org/file/local;1"].
createInstance(Ci.nsILocalFile);
localPath.initWithPath(pathToLocalDirectory);
var localFile = localPath.clone();
localFile.append("mylocalfile.html");
persist.saveDocument(document, localFile, localPath, null, 0, 0);
The key is the third parameter which specifies where the linked URIs should be stored. See http://mxr.mozilla.org/mozilla2.0/source/embedding/components/webbrowserpersist/public/nsIWebBrowserPersist.idl#256 for complete documentation.
For a document which has a DOCTPYE declaration like
<!DOCTYPE RootElement SYSTEM "file.dtd">
Delphi 2009, using MSXML, reports that the systemId is empty (""):
Assert(Doc.DOMDocument.doctype.systemId <> ''); // fails!
while
Assert(Doc.DOMDocument.doctype.name = 'RootElement'); // ok
correctly verifies that the DOCTYPE name id "RootElement".
Is this a bug in Delphi (or my code) or am I using a version of MSXML which does not support this property?
MSXML's DocumentType implementation is completely missing the DocumentType properties publicId, systemId and internalSubset. MSDN api ref; the missing properties are specifically called out in MS-DOM2CX.
If you need this information you might have to try a different DOM implementation. Here's one. If you can use .NET classes, System.Xml supports it too.
In case ProhibitDTD property is True try setting it to False.
Here's an article with more details.
I've got error if I don't run my program "As Administrator"
Access violation ... in module ... etc...
Got error when trying to work with my ini file.
How to avoid error or make a request Administrator rights.
(using C++Builder6 , but Delphi code is readable for me too)
working with ini by default
TIniFile *FormCllient;
FormCllient = new TIniFile(ExtractFilePath(Application->ExeName)+"Inf\\MyIniFile.ini");
...
Added :
I think I need add rules for folder after install application
I make install pack with Inno Setup ... Hope that's real.
*****Added : *****
How to put my file into app data ?
Don't put the ini file along the application /unless you really have to/. The common user, even the administrator /when app not explicitly elevated/ has no right to write into the Program Files folder.
Use environment var %ProgramData% if you want to write the ini accessible for all users, and use env var %USERPROFILE%\AppData\Roaming if you want to write user specific data accessible only by the current user.
You can use also "SHGetFolderPath" in order to obtain these folder via API.
Here's a function I wrote to get the Application Data folder in C++Builder.
If you're using older versions of C++Builder, you might find you have to change this to use AnsiStrings instead of Unicode (replace the "UnicodeString"s with "AnsiString"s, and change the call to "SHGetSpecialFolderPathW" to read "SHGetSpecialFolderPath").
GetAppDataFolder.h:
#ifndef GetAppDataFolderH
#define GetAppDataFolderH
UnicodeString GetAppDataFolder(bool roaming = true);
#endif
GetAppDataFolder.cpp:
// Helper function to get the location of the current user's Application Data folder (used for
// storing per-user application settings).
#include <vcl.h>
#pragma hdrstop
/* roaming: True for application data that can be accessed by the same user on different
machines. If you have per-user settings that are only relevant to a particular
computer, e.g., screen resolution, set 'roaming' to false.
*/
UnicodeString GetAppDataFolder(bool roaming /* = true */)
{
UnicodeString retVal;
int csidl = roaming ? CSIDL_APPDATA : CSIDL_LOCAL_APPDATA;
wchar_t thePath[MAX_PATH];
if (SHGetSpecialFolderPathW(NULL, thePath, csidl, 0) == TRUE) {
retVal = thePath;
}
return retVal;
}
Try hard coding it, the access violation is probably coming from asking the system for information about a file that the user may or may not have permissions to know about. if you need a more dynamic solution try using an environment variable that refers to the location of the file or the users "home" folder
Any reasons for/against storing your app configuration in the registry? I'm not suggesting you redo the code that brought up the question, just curious for my own future projects.
How do I (in my controller) send a pdf that opens in the browser. I have tried this but it only downloads the file (both ie and firefox) without asking.
public ActionResult GetIt()
{
var filename = #"C:\path\to\pdf\test.pdf";
// Edit start
ControllerContext.HttpContext.Response.AddHeader("Content-Disposition", String.Format("inline;filename=\"{0}\"", "test.pdf"));
// Edit stop
return File(filename, "application/pdf", Server.HtmlEncode(filename));
}
After adding the edit above it works as it should, thanks.
You need to set the Content disposition HTTP header to inline to indicate to the browser that it should try to use a PDF plugin if it is available.
Something like: Content-Disposition: inline; filename=test.pdf
Note that you cannot force the use of the plugin, it is a decision made by the browser.
This (in addition to the other headers) does the trick for me in a plain .net web app:
Response.AddHeader("Content-Disposition", String.Format("inline;filename=""{0}""", FileName))
I'm not familiar with MVC, but hopefully this helps.
I think this relies on how the client handles PDF files. If it has setup to let Adobe Reader open the files in the browser plugin it will do that, but maybe you have set it up to download the file rather than opening it.
In any case, there is no way of controlling how PDF files will be opened on the user's machine.