The Java Web 2.0 Application Stack

Win 7 Security 2012 Virus Infection

2011-12-06T18:00:00.001-08:00

Recently a customer of mine had a virus on his computer called Win 7 Security 2012. This Win 7 Security 2012 is a rogue anti-spyware application, which is often downloaded and installed by a Trojan, through browser security holes or via other unconventional unethical mechanisms. Once installed, Win 7 Security 2012 will display notifications of imaginary security and privacy risks in its attempts to get the user to purchase the full version and may generate system slowdown and instability. This program is extremely difficult to manually remove. I noticed that this customer also had McAfee Security Center running and updated. I ran the scan and McAfee did not pick up this malware. Two thumbs down. I was able to find a free anti-virus to remove this virus available online. If you are struggling with fixing this virus, let me know of your problems by commenting below and I'll be sure to get back to you.

Changing the Session Identifier (JSESSIONID) on Authentication. Protecting against Session Fixation attacks in Java Web Environments

2011-12-05T14:20:00.000-08:00

It is a standard security practice to change the session identifier (JSESSIONID) after a successful login or authentication.

The attack scenario with this vulnerability is that a user can open a browser on a shared terminal and record the session identifier set by the application. Later when any other user of the system logs into the application without closing instances of that browser the same cookie will be used to track the victim's session.

Alternatively, if the application is susceptible to cross-site scripting on a publicly accessible page (most damagingly the home page), an attacker can use this vulnerability to learn the value of the session identifier, because the cookie does not change since it was first set. The attacker now knows the value of the session token can hijack the victim's session. This is a limited session fixation attack where the attacker does not have control over the value of the session identifier, but is able to know its value through various means before and after a user authenticates.

Most times, invalidating the session and creating a new one may suffice. However, if you are storing variables or objects, you may need to carry these variables or objects from the old session into the new session.

Below is a javax.servlet.Filter. This filter protects against the Session Fixation attacks described above. The filter looks for a specific session attribute, the (NEW_SESSION_INDICATOR) attribute. If one is found, the filter copies out relevant session data to a map, invalidates the session, creates a new session and loads the new session with the old session data.

The filter is simply mapped in your web.xml. Any place you successfully authenticate, an attribute is added to the session (NEW_SESSION_INDICATOR).

The code below follows:

import java.io.IOException;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Map;
import java.util.logging.Logger;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

public class NewSessionFilter implements Filter {
  
  private static Logger logger = Logger.getLogger(NewSessionFilter.class.getName());
 
  public static final String NEW_SESSION_INDICATOR = "filter.NewSessionFilter";
  
  public void destroy() {}
  
  @SuppressWarnings("unchecked")
  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {
    if (request instanceof HttpServletRequest){
      HttpServletRequest httpRequest = (HttpServletRequest) request;
      if (httpRequest.getSession(false) != null && 
          httpRequest.getSession(false).getAttribute(NEW_SESSION_INDICATOR) != null
      ){
        //copy session attributes from new session to a map. 
        HttpSession session = httpRequest.getSession();
        HashMap old = new HashMap();
        Enumeration keys = (Enumeration) session.getAttributeNames();
        while (keys.hasMoreElements()) {
          String key = keys.nextElement();
          if (!NEW_SESSION_INDICATOR.equals(key)) {
            old.put(key, session.getAttribute(key));
            session.removeAttribute(key);
          }
        }
        logger.info("session invalidated on " + httpRequest.getRequestURI());
  
        //invalidation session and create new session.
        session.invalidate();
        session = httpRequest.getSession(true);
 
        //copy key value pairs from map to new session.
        for (Map.Entry entry : old.entrySet()) {
          session.setAttribute(entry.getKey(), entry.getValue());
        }
 
        logger.info((new StringBuffer()).append("new Session for URI '")
             .append(httpRequest.getRequestURI()).append("':")
             .append( session.getId()).toString());
      }
    }
    chain.doFilter(request, response);
  }
  
  public void init(FilterConfig filterconfig) {}
}

Any questions about this posting or filter, comment below and I'll be sure to answer.

Steps to a CAPTCHA Implementation using JAVA/JSP

2011-11-30T10:54:00.000-08:00

CAPTCHA can quickly and easily protect your web application against brute force and bot attacks or abuse. There are just a few simple steps to a CAPTCHA implementation in Java/JSP. The solution is simple and the documentation is quite clear, so I only provide the steps and quick links to those resources.

Step 1: Signup for a CAPTCHA account and generate keys for your website domains.
Navigate to http://www.google.com/recaptcha and signup for an account. After obtaining a login, generate keys for your domain.

Step 2: Find the developers guide for CAPTCHA
Navigate to http://code.google.com/apis/recaptcha/intro.html. From here, you'll find all the information you need. Notice in the left hand menu, there's a Java/JSP Plugin link available. Click into that.

Step 3: Download the Java/JSP Plugin and Implement
Navigate to http://code.google.com/apis/recaptcha/docs/java.html where you will find a link to download the plugin, which is a set of Java classes. Extract the source files into your web applications java source tree. The directions on the page are extremely straight forward.

The form page looks like:

 
<%@ page import="net.tanesha.recaptcha.ReCaptcha" %>
<%@ page import="net.tanesha.recaptcha.ReCaptchaFactory" %>

<html>
<body>
<form action="" method="post">
   <%
      ReCaptcha c = ReCaptchaFactory.newReCaptcha("your_public_key", "your_private_key", false);
      out.print(c.createRecaptchaHtml(null, null));
   %>
   <input type="submit" value="submit" />
</form>
</body>
</html>

You also may be using reCaptcha over https. In that case, follow the instructions from this page: http://code.google.com/apis/recaptcha/docs/tips.html


<script type="text/javascript"
   src="https://www.google.com/recaptcha/api/challenge?k=your_public_key">
</script>

<noscript>
   <iframe src="https://www.google.com/recaptcha/api/noscript?k=your_public_key"
       height="300" width="500" frameborder="0"></iframe><br>
   <textarea name="recaptcha_challenge_field" rows="3" cols="40">
   </textarea>
   <input type="hidden" name="recaptcha_response_field"
       value="manual_challenge">
</noscript>

When the form is submitted, the reCaptcha entries can be verified easily.


<%@ page import="net.tanesha.recaptcha.ReCaptchaImpl" %>
<%@ page import="net.tanesha.recaptcha.ReCaptchaResponse" %>

    <html>
       <body>
       <%
        String remoteAddr = request.getRemoteAddr();
        ReCaptchaImpl reCaptcha = new ReCaptchaImpl();
        reCaptcha.setPrivateKey("your_private_key");

        String challenge = request.getParameter("recaptcha_challenge_field");
        String uresponse = request.getParameter("recaptcha_response_field");
        ReCaptchaResponse reCaptchaResponse = reCaptcha.checkAnswer(remoteAddr, challenge, uresponse);

        if (reCaptchaResponse.isValid()) {
          out.print("Answer was entered correctly!");
        } else {
          out.print("Answer is wrong");
        }
      %>
      </body>
    </html>

Step 4: Give the JVM a time interval to refresh its DNS cache
By default the Java Virtual Machine (JVM) caches all DNS lookups forever instead of using the time-to-live (TTL) value which is specified in the DNS record of each host. To fix this issue for good, you can pass -Dsun.net.inetaddr.ttl=30 to your app-server (this tells Java to only cache DNS for 30 seconds).

There is a great article on the JVM and DNS caching. A must read at http://www.sdn.sap.com/irj/scn/weblogs?blog=/pub/wlg/1887

The steps above are quick and easy to implement, post back and let me know if you have any issues with the implementation and I will try and assist.

Disabling certain HTTP Methods in Tomcat

2011-11-17T11:51:00.000-08:00

HTTP protocol defines eight methods that can be performed on a resource on the HTTP server. GET, POST and HEAD are the most common methods that are used to access information provided by a web server. The other methods such as OPTIONS, PUT, DELETE, CONNECT and TRACE are not normally used in the general operation of a web server can potentially pose a security risk for any web application. So it is good practice to restrict the response to specific HTTP Methods.

First, determine which HTTP Methods your installation is responding too. I use browser plug-ins that enable me to submit HTTP requests, specifying the URL and HTTP method. There are various plugins available for Chrome and Firefox and I do not make any recommendations here.

Second, according to your test results, configure your Tomcat installtion to not respond for certain HTTP Methods. This can be configured at the instance level by inserting a <security-constraint> element directly under the <web-app> element, in the installations web.xml file located at.
[tomcatinstallation]/conf/web.xml

Below is the added configuration.


<security-constraint>
<web-resource-collection>
<web-resource-name>restricted methods</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>TRACE</http-method>
<http-method>PUT</http-method>
<http-method>OPTIONS</http-method>
<http-method>DELETE</http-method>
</web-resource-collection>
<auth-constraint />
</security-constraint>

The configuration above will disable the HTTP Methods TRACE, PUT, OPTIONS or DELETE.

Any questions, comment and I'll be sure to answer them.

javax.net.ssl.SSLException: Received fatal alert: unexpected_message

2011-11-03T07:50:00.000-07:00

If you are attempting to establish an SSL Connection as a client to a server and getting this error at the very end of the SSL Handshake, then check the server settings for client authentication.

Client Authentication is the ability of a webserver to verify the client, whether it be a browser or other application.

Setting client authentication does reduce the level of security enabled, so this decision should be made based on your needs and threat model.

If you do require client authentication, there are two great articles below:

If you have any JSSE/OpenSSL questions, feel free to comment and I'll try and get back to you.

SSL Connections over a proxy using JSSE

2011-11-03T07:31:00.000-07:00

The Java Secure Socket Extension (JSSE) enables secure Internet communications. It provides a framework and an implementation for a Java version of the SSL and TLS protocols and includes functionality for data encryption, server authentication, message integrity, and optional client authentication. Using JSSE, developers can provide for the secure passage of data between a client and a server running any application protocol, such as Hypertext Transfer Protocol (HTTP), Telnet, or FTP, over TCP/IP.

The https protocol is similar to http, but https first establishes a secure channel via SSL/TLS sockets and then verifies the identity of the peer before requesting/receiving data. javax.net.ssl.HttpsURLConnection extends the java.net.HttpsURLConnection class, and adds support for https-specific features. Upon obtaining a HttpsURLConnection, you can configure a number of http/https parameters before actually initiating the network connection via the method URLConnection.connect.

In some situations, it is desirable to specify the SSLSocketFactory that an HttpsURLConnection instance uses. For example, you may wish to tunnel through a proxy type which is NOT supported by the default implementation. The new SSLSocketFactory could return sockets that have already performed all necessary tunneling, thus allowing HttpsURLConnection to use additional proxies.

Post your issue below, and I'll try and answer your JSSE questions.

References:

Photo Card

2011-08-27T18:24:00.001-07:00

Jungle Favor Birthday

Shop birthday cards and invitations at Shutterfly.com.

View the entire collection of cards.

Upgrading your Eclipse workspace to a new version

2010-11-20T08:49:00.000-08:00

Upgrading my eclipse workspace to a new version. This article did the trick.

Download the Girl Talk - All Day album

2010-11-20T07:48:00.000-08:00

Obviously a lot of work went into this sampling mixing mish mosh. What makes it cooler is a free download. Click here

JAX-RS @Path Precedence Rules

2010-11-06T16:49:00.000-07:00

The other day I needed to figure out how the JAX-RS provider resolves ambiguous path expressions passed in the @javax.ws.rs.Path annotation. I learned about the provider's precedence rules and wanted to document them here with a short example.

For example, say we have the following @javax.ws.rs.Path expressions in the following class:

@Path("/users") 
public class UserResource {

  @GET
  @Path("{id : .+}")
  public String getUser(@PathParam("id") String id){
    ....
  }


  @GET
  @Path("{id : .+}/address")
  public String getAddress(@PathParam("id") String id){
    ....
  }
}

Note that .+ will match any stream of characters after "/users".
Now, suppose the following GET request was submitted.

GET /users/32/address

The request actually matches both expressions, but the request would be routed to the getAddress(@PathParam("id") String id) method. The JAX-RS provider determines which method to call based on a set of precedence rules. On deployment, the JAX-RS provider gathers and sorts all URI expressions contained within all known @Path annotations based on the following logic:

The number of literal characters contained within the expression, sorted in descending order. In the example above, the getAddress(@PathParam("id") String id) method gets precedence over the getUser(@PathParam("id") String id) method. The getUser(@PathParam("id") String id) method contains 7 literal characters (/users/). The getAddress @PathParam("id") String id) method contains 14 literal characters (/users/ + address).
The number of template expressions within the expression, sorted in descending order. For example, an expression containing {id}/{name} would get precedence over {id}.
Finally, the number of regular expressions contained within the expression. For example, {id : .+} would get precedence over {id}.

In closing, the following URI expressions are sorted by the order of precedence above.

/users/{id}/{name}/address
/users/{id : .+}/address
/users/{id}/address
/users/{id : .+}

Any questions, leave a comment and I'll be sure to answer.

Spring JDBC Tutorial with Transaction Management

2010-01-11T18:14:00.000-08:00

I recently wrote a post on Spring JDBC with some good and positive feedback from the user community.

In this posting, I will present a more in-depth tutorial and a data access strategy that I use for projects accessing a single data source or database. This tutorial makes use of Spring 2.5.6

In this tutorial, I use MySQL as the data source.
Follow the installation instructions and make note of your username and password.

REQUIRED LIBRARIES
Next, download all the necessary libraries needed to execute this tutorial:

JDBC driver for MySQL, MySQL Connector/J.
Spring Framework 2.5.6
Commons Project
- commons-beanutils-1.8.2
- commons-collections-3.2.1
- commons-configuration-1.6
- commons-dbcp-1.2.2
- commons-digester-2.0
- commons-lang-2.4
- commons-logging-1.1.1
- commons-pool-1.5.4

PACKAGE STRUCTURE
Next, we'll define our package structure for the data project and we provide a description for each package.

com.edwardwebnerd.persistence
- adapter - single SQL operations and implementations.
- dbcp - database connection pool and configurations.
- domain - domain models
- exception - exception classes
- transmanager - business level services

These are very rudimentary package definitions but they do provide us with some structure and conventions in our development.

CREATE THE DATABASE TABLE
First, we'll create a user table in our database. The table is very simple and only meant for illustrative purposes.

CREATE TABLE user (
 id INT NOT NULL AUTO_INCREMENT, PRIMARY KEY(id),
 username VARCHAR(30),
 email VARCHAR(30),
 password VARCHAR(50)
)

We'll provide Spring JDBC access the user table on a single access level, within the adapter package. After that, we'll introduce Spring JDBC transaction management facilities within the transmanager package to provide data services which may be comprised of one or more calls to the adapter package.

CREATE YOUR DOMAIN MODEL
Next, generate the domain model of the user table you just created.

package com.edwardwebnerd.persistence.domain;

/** User Domain Model */
public class User {

 private Integer id;
 public Integer getId() { return id; }
 public void setId(Integer id) { this.id = id; }
 
 private String username;
 public String getUsername() { return username; }
 public void setUsername(String username) { this.username = username; }
 
 private String password;
 public String getPassword() { return password; }
 public void setPassword(String password) { this.password = password; }
 
 private String email;
 public String getEmail() { return email; }
 public void setEmail(String email) { this.email = email; }
}

CREATE YOUR DAO INTERFACE
Next, we create our DAO interface, providing definitions of our single access calls and services to the user table.

package com.edwardwebnerd.persistence.adapter;

import java.util.List;

import com.edwardwebnerd.persistence.domain.User;

public interface UserServiceAdapter {

 public User getByUsername(String username);
 
 public User getByEmail(String username);
 
 public User getById(Integer id);
 
 public void createUser(User user);
 
 public void updateUser(User user);
 
 public void deleteUser(String username);
 
 public List<User> getUsers(Integer pageNumber, Integer pageLength, String sortCriterion, String sortOrder);
 
 public Integer getNumberOfUsers();
}

IMPLEMENT YOUR DAO
Next, we implement our DAO interface using Spring JDBC in a subpackage called springjdbc off of the adapter package.

package com.edwardwebnerd.persistence.adapter.springjdbc;

import java.util.List;

import org.springframework.dao.EmptyResultDataAccessException;
import org.springframework.jdbc.core.support.JdbcDaoSupport;

import com.edwardwebnerd.persistence.adapter.UserServiceAdapter;
import com.edwardwebnerd.persistence.adapter.springjdbc.mapper.UserMapper;
import com.edwardwebnerd.persistence.domain.User;

public class UserServiceAdapterImpl extends JdbcDaoSupport implements UserServiceAdapter {

 @Override
 public User getByUsername(String username) {
  try{
   return (User) getJdbcTemplate().queryForObject(
     "SELECT * FROM user WHERE username = ?", 
     new Object [] {username}, 
     new UserMapper());
  }catch(EmptyResultDataAccessException erdae){
   return null;
  }
 }
 
 
 @Override
 public User getByEmail(String email) {
  try{
   return (User) getJdbcTemplate().queryForObject(
     "SELECT * FROM user WHERE email = ?", 
     new Object [] {email}, 
     new UserMapper());
  }catch(EmptyResultDataAccessException erdae){
   return null;
  }
 }
 
 
 @Override
 public User getById(Integer id) {
  try{
   return (User) getJdbcTemplate().queryForObject(
     "SELECT * FROM user WHERE id = ?", 
     new Object [] {id}, 
     new UserMapper());
  }catch(EmptyResultDataAccessException erdae){
   return null;
  }
 }
 
 
 @Override
 public void createUser(User user) {
  getJdbcTemplate().update(
    "INSERT INTO user (username, email, password) VALUES (?, ?, ?)",
    new Object[] {user.getUsername(), user.getEmail(), user.getPassword()});
 }

 
 @Override
 public void deleteUser(String username) {
  getJdbcTemplate().update(
    "DELETE FROM user WHERE username = ?",
    new Object[] {username});
 }
 

 @Override
 public void updateUser(User user) {
  getJdbcTemplate().update(
    "UPDATE user SET username = ?, email = ?, password = ? WHERE id = ?",
    new Object[] {user.getUsername(), user.getEmail(), user.getPassword(), user.getId()});
 }


 @SuppressWarnings("unchecked")
 @Override
 public List<User> getUsers(Integer pageNumber, Integer pageLength, String sortCriterion, String sortOrder) {
  StringBuffer query = new StringBuffer("SELECT * FROM user");
  if(sortCriterion != null && sortOrder != null)
   query.append(" ORDER BY ").append(sortCriterion).append(" ").append(sortOrder);
  
  query.append(" LIMIT ").append(pageLength).append(" OFFSET ").append((pageNumber-1) * pageLength);
  return getJdbcTemplate().query(query.toString(), new UserMapper());
 }


 @Override
 public Integer getNumberOfUsers() {
  return getJdbcTemplate().queryForInt("SELECT COUNT(*) FROM user");
 }
}

There are a few things to note about the Spring JDBC implementation:

The class extends org.springframework.jdbc.core.support.JdbcDaoSupport - a convenient superclass for JDBC data access objects, which requires a DataSource to be set, which we will set in our config files.
Most of the methods in this implementation use a RowMapper implementation, to help transfer data from the ResultSet to the Domain Model. We will provide the RowMapper implementation below.

Below, we provide an implementation of the RowMapper interface for our User table and domain model.

package com.edwardwebnerd.persistence.adapter.springjdbc.mapper;

import java.sql.ResultSet;
import java.sql.SQLException;

import org.springframework.jdbc.core.RowMapper;

import com.edwardwebnerd.persistence.domain.User;

public class UserMapper implements RowMapper{

 @Override
 public Object mapRow(ResultSet resultSet, int rowNum) throws SQLException {
  User user = new User();
  user.setEmail(resultSet.getString("email"));
  user.setUsername(resultSet.getString("username"));
  user.setPassword(resultSet.getString("password"));
  user.setId(resultSet.getInt("id"));
  return user;
 } 
}

DEFINE THE USER MANAGER INTERFACE
We use the term 'Manager' to dictate which portion of the package applications should access.
Next, define the User Manager Interface.

package com.edwardwebnerd.persistence.transmanager;

import java.util.List;

import org.springframework.transaction.annotation.Transactional;

import com.edwardwebnerd.persistence.domain.User;
import com.edwardwebnerd.persistence.exception.UserEmailAlreadyExistsException;
import com.edwardwebnerd.persistence.exception.UsernameAlreadyExistsException;

@Transactional
public interface UserManager {
 
 public User getUserByUsername(String username);
 
 public User getUserByEmail(String email);
 
 public User getUserById(Integer id);
 
 public void createUser(User user) 
  throws UsernameAlreadyExistsException, UserEmailAlreadyExistsException;
 
 public void updateUser(User user);
 
 public List<User> getUsers(Integer pageNumber, Integer pageLength, String sortCriterion, String sortOrder);
 
 public Integer getNumberOfUsers();
}

There are a few things to note about interface:

We use the @Transactional annotation to denote that all methods and implementation should be demarcated at the method level. This annotation also needs to be coupled with a spring configuration which will be provided below.
We defined a couple of exception classes that our implementations should throw up to the application tier on certain cases. We'll provide the implementations below.

Below we provide the implementation of both exception classes utilized in our UserManager interface.

package com.edwardwebnerd.persistence.exception;

public class UserEmailAlreadyExistsException extends DataAccessException{

 private static final long serialVersionUID = 1L;

 public UserEmailAlreadyExistsException(String email){
  super("A user with the email " + email + " already exists");
 }
}

package com.edwardwebnerd.persistence.exception;

public class UsernameAlreadyExistsException extends DataAccessException{

 private static final long serialVersionUID = 1L;

 public UsernameAlreadyExistsException(String username){
  super("A user with the username " + username + " already exists");
 }
}

Both of these exceptions extend our base DataAccessException class.

package com.edwardwebnerd.persistence.exception;

import java.io.PrintStream;
import java.io.PrintWriter;

public class DataAccessException extends Exception {

 private static final long serialVersionUID = 1L;
 
 
 /** A wrapped Throwable */
 protected Throwable cause;

 public DataAccessException() { super("A data exception occurred"); }

 public DataAccessException(String message) { super(message); }

 public DataAccessException(String message, Throwable cause) {
  super(message);
  this.cause = cause;
 }
 

 public Throwable getCause()  { return cause; }
 
 public Throwable initCause(Throwable cause) {
  this.cause = cause;
  return cause;
 }

 
 /** Builds the message off of its own message + all nested exception messages */
 public String getMessage() {
  // Get the message for this exception
  String msg = super.getMessage();

  
  // Get the message for each nested exception
  Throwable parent = this;
  Throwable child;
  while((child = parent.getCause()) != null) {
   String msg2 = child.getMessage();

   if (msg2 != null) {
    if (msg != null) { msg += ": " + msg2; } 
    else { msg = msg2; }
   }

   if (child instanceof DataAccessException) { break; }
   
   parent = child;
  }
  return msg;
 }

 
 /** Prints the stack trace + all nested stack traces */
 public void printStackTrace() {
  // Print the stack trace for this exception.
  super.printStackTrace();
  
  // Print the stack trace for each nested exception.
  Throwable parent = this;
  Throwable child;
  while((child = parent.getCause()) != null) {
   if (child != null) {
    System.err.print("Caused by: ");
    child.printStackTrace();

    if (child instanceof DataAccessException) { break; }
                   
    parent = child;
   }
  }
 }

 
 /** Prints the stack trace + all nested stack traces */
 public void printStackTrace(PrintStream s) {
  // Print the stack trace for this exception.
  super.printStackTrace(s);
  
  Throwable parent = this;
  Throwable child;

  // Print the stack trace for each nested exception.
  while((child = parent.getCause()) != null) {
   if (child != null) {
    s.print("Caused by: ");
    child.printStackTrace(s);

    if (child instanceof DataAccessException) { break; }
    
    parent = child;
   }
  }
 }


 /** Prints the stack trace + all nested stack traces */
 public void printStackTrace(PrintWriter w) {
  // Print the stack trace for this exception.
  super.printStackTrace(w);

  Throwable parent = this;
  Throwable child;

  // Print the stack trace for each nested exception.
  while((child = parent.getCause()) != null) {
   if (child != null) {
    w.print("Caused by: ");
    child.printStackTrace(w);

    if (child instanceof DataAccessException) {
     break;
    }
    parent = child;
   }
  }
 }
}

IMPLEMENT YOUR MANAGER
Next, we implement the User Manager interface using Spring JDBC, in a subpackage called springjdbc off of the transmanager package.

package com.edwardwebnerd.persistence.transmanager.springjdbc;

import java.util.List;

import com.edwardwebnerd.persistence.adapter.UserServiceAdapter;
import com.edwardwebnerd.persistence.domain.User;
import com.edwardwebnerd.persistence.exception.UserEmailAlreadyExistsException;
import com.edwardwebnerd.persistence.exception.UsernameAlreadyExistsException;
import com.edwardwebnerd.persistence.transmanager.UserManager;

public class UserManagerImpl implements UserManager {

 private UserServiceAdapter userServiceAdapter = null;
 public void setUserServiceAdapter(UserServiceAdapter userServiceAdapter){
  this.userServiceAdapter = userServiceAdapter;
 }
 
 @Override
 public void createUser(User user) 
  throws UsernameAlreadyExistsException, UserEmailAlreadyExistsException
 {
  User usernameTest = userServiceAdapter.getByUsername(user.getUsername());
  if(usernameTest != null){
   throw new UsernameAlreadyExistsException(user.getUsername());
  }
  
  User userEmailTest = userServiceAdapter.getByEmail(user.getEmail());
  if(userEmailTest != null){
   throw new UserEmailAlreadyExistsException(user.getEmail());
  }
  
  userServiceAdapter.createUser(user);
  userServiceAdapter.createUser(null);
 }
 
 @Override
 public List getUsers(Integer pageNumber, Integer pageLength, String sortCriterion, String sortOrder) {
  return userServiceAdapter.getUsers(pageNumber, pageLength, sortCriterion, sortOrder);
 }

 @Override
 public User getUserByUsername(String username) {
  return userServiceAdapter.getByUsername(username);
 }
 
 @Override
 public User getUserByEmail(String email) {
  return userServiceAdapter.getByEmail(email);
 }
 
 @Override
 public User getUserById(Integer id) {
  return userServiceAdapter.getById(id);
 }

 @Override
 public void updateUser(User user) {
  userServiceAdapter.updateUser(user);
 }

 @Override
 public Integer getNumberOfUsers() {
  return userServiceAdapter.getNumberOfUsers();
 }
}

Most of the methods in the manager are just single access operations. As a result many of the implementations are straight mappings to UserServiceAdapter.

Note the last two line in the implementation of the createUser implementation.

userServiceAdapter.createUser(user);
userServiceAdapter.createUser(null);

The very last call will throw a NullPointerException. Any call to this method will always rollback the user created in the second to last call. We'll leave it up to you to test and verify this.

SPRING CONFIGURATIONS
We are now ready to wire our services together using spring.

In almost every environment, there is always a need to support test and production modes. We handle this using a property we set at runtime. Based on the environment property variable 'env' we will load a set of properties file, which will point us to our test or production resources, based on the value set. The property is easily passed during execution through the -D argument. For the property env we accept qa and production as valid values.

Below we provide our spring configuration file, which is stored in our com.edwardwebnerd.persistence.dbcp package.

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xmlns:tx="http://www.springframework.org/schema/tx"
 xsi:schemaLocation="http://www.springframework.org/schema/beans 
  http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
  http://www.springframework.org/schema/tx
  http://www.springframework.org/schema/tx/spring-tx.xsd
">

 <!--
  You must use a -D JVM level option.
  There are two configurations supported.
    -Denv=qa
    -Denv=production
  based on the configuration loaded the appropriate data source will be loaded. 
 -->
 <bean id="DataAccessProperties" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
  <property name="location" value="classpath:com/edwardwebnerd/persistence/dbcp/${env}.properties"/>
     </bean>
     
 <bean id="dataSource" destroy-method="close" class="org.apache.commons.dbcp.BasicDataSource">
  <!-- <property name="driverClassName" value="com.ibm.as400.access.AS400JDBCDriver"/> -->
  <property name="driverClassName" value="${jdbc.driver}"/>
  <property name="url" value="${jdbc.url}"/>
  <property name="username" value="${jdbc.username}"/>
  <property name="password" value="${jdbc.password}"/>
  <property name="maxActive" value="30"/>
  <property name="maxIdle" value="2"/>
  <property name="maxWait" value="5000"/>
 </bean>
 
 <bean id="transactionManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
  <property name="dataSource" ref="dataSource"/>
 </bean>
 
 <tx:annotation-driven transaction-manager="transactionManager" proxy-target-class="false"/>
 
 <bean id="userManager" class="com.edwardwebnerd.persistence.transmanager.springjdbc.UserManagerImpl">
  <property name="userServiceAdapter" ref="userServiceAdapter"/>
 </bean>
 
 <bean id="userServiceAdapter" class="com.edwardwebnerd.persistence.adapter.springjdbc.UserServiceAdapterImpl">
  <property name="dataSource" ref="dataSource"/>
 </bean>
</beans>

Here we see that we wire together our data sources with our service adapter and manager. There are also some configurations that are required to support the @Transactional annotation used in the UserManager interface. Below, we'll provide an example of one of our properties file located in the com.edwardwebnerd.persistence.dbcp pacakage.

jdbc.driver=com.mysql.jdbc.Driver
jdbc.url=jdbc:mysql://localhost:3306/test?autoReconnect=true
jdbc.username=root
jdbc.password=admin

We'll leave it up to you, to test the project above. In our next tutorial, we will expose these services on our web tier, strictly for illustrative purposes.

Please feel free to leave any comments or suggestions on how the code above can be improved. I'll be sure to answer them.

Sub Queries vs. Outer Joins : (SELECT of a SELECT) vs. (LEFT OUTER JOINS)

2010-01-01T18:00:00.000-08:00

One performance bottleneck that as Java developers we may encounter may be our poor use of SQL.

I often see a Nested SELECT like:


SELECT name FROM bbc
WHERE population >
(SELECT population FROM bbc
WHERE name='Russia')

Implemented as a LEFT OUTER JOIN
SELECT name FROM BBC LEFT OUTER JOIN ON BBC

Dependant on the query, the Nested SELECT technique may force the subquery to be evaluated for every row in the left-hand table.
A LEFT OUTER join, by contrast, can often use a much more efficient query plan.

This is not always the case as they are mathematically equivalent and a good query optimizer may generate the same query plan, but this is not always the case.

Why you should look into ORM, if you haven't already?

2009-12-09T19:30:00.000-08:00

In my last posting, I got clobbered by the blogosphere concerning my posting "Data Access: Plain JDBC vs. ORM".

I feel that the title was misleading, however, I do think that I do make some valid points about the shortcomings of authoring a data tier without the assistance of some type of ORM.

It is my opinion that, yes, there are many applications out there that still use raw JDBC as the primary method of accessing a data source in their data tier.

With that being said, I was targeting this article to those programmers that still write data tiers using raw JDBC, and was thinking of following up with some simple posts and tutorials on ORM's like Spring JDBC and Hibernate.

Without further ado, I am going to repost my thoughts and concerns.

Why you should look into ORM, if you haven't already?

A developer's goal when writing data access code is to properly contain the responsibilities of all data access operations. Leaking data access operations into the application is referred to as leakage of data-access details and has some adverse affects when the application has to adapt to changes on the data side.

Let's take a look at a method that uses raw JDBC:

public class UserRegistrationJDBC {

   private javax.sql.DataSource dataSource;

   public int getUserRegistrationCount() throws MyDataAccessException {

      java.sql.Connection connection = null;
      java.sql.Statement statement = null;
      java.sql.ResultSet resultSet = null;
      try{
         connection = dataSource.getConnection();
         statement = connection.createStatement();
         resultSet = statement.executeQuery(
            "SELECT COUNT(*) FROM USER_REGISTRATION");

         rs.next();
         return rs.getInt(1);
      }catch(java.sql.SQLException sqle){
         throw new MyDataAccessException(e);
      }finally{
         if(resultSet != null){ 
            try{ resultSet.close() }
            catch (java.sql.SQLException sqle){ sqle.printStackTrace(); }
         }
         if(statement != null){ 
            try{ statement.close() }
            catch (java.sql.SQLException sqle){ sqle.printStackTrace(); }
         }
         if(connection != null){ 
            try{ connection.close() }
            catch (java.sql.SQLException sqle){ sqle.printStackTrace(); }
         }
      }
   }
}

Let's look at some technical details contained within the code above:

The call to getConnection() on the javax.sql.DataSource object can be problematic because it obtains its own database connection. For example, suppose we wrote all our data access methods like the one above, even for inserts and updates. Imagine attempting to persist multiple records, perhaps on the completion of an order, something with an invoice, shipping details and billing details. If one of those transactions fail for some unexpected reason, how would you rollback the transactions? Obtaining a connection from the pool will only rollback the last transaction, leaving you to hand implement the rollback. It becomes even worse if the set of transactions spans multiple data sources.
The call to createStatement() is problematic as well. All sql should be rendered using a java.sql.PreparedStatement() for improved performance via caching. While this is more of a practice and learned through experience, using raw JDBC leaves the programmer open to these types of mistakes.
Catching a java.sql.SQLException is required by the JDBC API as it is it's only exception type and typically reveals little about the root cause of your error. Wrapping it with the unchecked exception MyDataAccessException, adds little value, only that your calling code does not have to catch it. Your application code now is restricted in how it can deal with specific data access errors.
The finally block contains the closing of all resources used in the method, which makes it impossible for other methods to reuse it.

Poor handling of the concerns above can lead to:

Resource exhaustion - loss of connection availability and loss of memory from improperly closed result sets and statements.
Poor performance - due to Statement vs. PreparedStatement as mentioned above.
Inappropriate connection life cycles - any operation where more than one SQL statement is executed can reuse connections and other resources for more appropriate life cycles. Even with connection pools, we should be careful not to spend CPU cycles and memory on obtaining and releasing connections.

To elaborate even further the inappropriate connection life cycles point, consider where a user registration is added with a payment for the registration. We would want to ensure that all the data access operations occurred or none at all. In a more appropriate world, we want to demarcate these operations at a transaction level, enabling the reuse of all related resources.

The goal of many ORM's are to effectively handle the leakage of data access details into the view tier. In addition, they support:

Transaction Demarcation - a mechanism to declare when transactions start and end, and support rollback.
Transaction Management API - an API to keep contracts clear and concise on transactions

It should be obvious, that writing a Transaction Management API is out of scope for most developers and only an adequately defined API can guarantee that applications remain flexible and adaptive.

The benefits of ORM's are too many for you not to have looked heavily into their proposed benefits.

In my next article, I'll present ways on how Spring provides a constructive and flexible programming model which addresses the concerns above and much more.

Data Access: Plain JDBC vs. ORM

2009-12-05T12:30:00.000-08:00

I start this discussion, to try and organize some thoughts and comparisons on data access code, written in plain old JDBC (or Java Database Connectivity) vs. utilizing an ORM Framework (or Object Relational Management Framework), such as Hibernate or iBatis.

A developer's goal when writing data access code is to properly contain the responsibilities of all data access operations. Leaking data access operations into the application is referred to as leakage of data-access details and has some adverse affects when the application has to adapt to changes on the data side.

Let's take a look at a method that uses raw JDBC:

public class UserRegistrationJDBC {

   private javax.sql.DataSource dataSource;

   public int getUserRegistrationCount() throws MyDataAccessException {

      java.sql.Connection connection = null;
      java.sql.Statement statement = null;
      java.sql.ResultSet resultSet = null;
      try{
         connection = dataSource.getConnection();
         statement = connection.createStatement();
         resultSet = statement.executeQuery(
            "SELECT COUNT(*) FROM USER_REGISTRATION");

         rs.next();
         return rs.getInt(1);
      }catch(java.sql.SQLException sqle){
         throw new MyDataAccessException(e);
      }finally{
         if(resultSet != null){ 
            try{ resultSet.close() }
            catch (java.sql.SQLException sqle){ sqle.printStackTrace(); }
         }
         if(statement != null){ 
            try{ statement.close() }
            catch (java.sql.SQLException sqle){ sqle.printStackTrace(); }
         }
         if(connection != null){ 
            try{ connection.close() }
            catch (java.sql.SQLException sqle){ sqle.printStackTrace(); }
         }
      }
   }
}

Let's look at some technical details of this data access code:

The call to getConnection() on the javax.sql.DataSource object can be problematic because it obtains its own database connection. There may be an instance when this call depends entirely on the underlying DataSource object. Not too bad, but it does restrict the application on how it can organize database transactions.
The call to createStatement() is problematic as well. All sql should be rendered using a java.sql.PreparedStatement() for improved performance via caching. While this is more of a practice and learned through experience, using raw JDBC leaves the programmer open to these types of mistakes.
Catching a java.sql.SQLException is required by the JDBC API as it is it's only exception type and typically reveals little about the root cause of your error. Wrapping it with the unchecked exception MyDataAccessException, adds little value, only that your calling code does not have to catch it. Your application code now is restricted in how it can deal with specific data access errors.
The finally block contains the closing of all resources used in the method, which makes it impossible for other methods to reuse it.

Some of the concerns also exist when using ORM tools, however, are often less visible.

Poor handling of the concerns above can lead to:

Resource exhaustion - loss of connection availability and loss of memory from improperly closed result sets and statements
Poor performance - due to Statement vs. PreparedStatement as mentioned above.
Inappropriate connection life cycles - any operation where more than one SQL statement is executed can reuse connections and other resources for more appropriate life cycles. Even with connection pools, we should be careful not to spend CPU cycles and memory on obtaining and releasing connections.

Transaction Demarcation - a mechanism to declare when transactions start and end.
Transaction Management API - an API to keep contracts clear and concise on transactions

It should be obvious, that writing a Transaction Management API is out of scope for most developers and only an adequately defined API can guarantee that applications remain flexible and adaptive.

In my next article, I'll present ways on how Spring provides a constructive and flexible programming model which addresses the concerns above and much more.

Traversing through HTML and in Javascript

2009-11-02T17:19:00.000-08:00

I've posted some HTML + Javascript code to traverse through <optgroups> and <options> in Javascript.

Supposed we had a State/Province drop down box with the following entries:

That was created with the following HTML:

<select name="theCountryState" id="theCountryState">
   <optGroup label="United States" id="US">
      <option value="NY">New York</option>
      <option value="MO">Missouri</option>
   </optGroup>
   <optGroup label="Canada" id="CA">
      <option value="TO">Toronto</option>
      <option value="ON">Ontario</option>
   </optGroup>
   <optGroup label="Mexico" id="MX">
      <option value="MO">Morales</option>
      <option value="PV">Puerto Vallerta</option>
   </optGroup>
</select>

The appropriate option can be selected easily by traversing through the OPTGROUPS and OPTIONS.

function selectCorrectOption(var countrySelected, var stateSelected) {
    
   //Traverse through Option Groups and options and mark correct option.
   countryStateOptGroups = document.getElementById("theCountryState").childNodes;
   for(i = 0; i < countryStateOptGroups.length; i++)
   {
      if(countryStateOptGroups[i].id == countrySelected){
         stateOptions = countryStateOptGroups[i].childNodes;
         for(j = 0; j < stateOptions.length; j++){
            if(stateOptions[j].value == stateSelected){
               stateOptions[j].selected = true;
            }
         }
      }
   }
}

Any questions, please feel free to comment.

Tomcat DBCP DataSource falls idle overnight

2009-10-18T07:54:00.000-07:00

If you have a low activity web server using Tomcat DBCP to retrieve connections to your database, the database server might time out connections in the pool.

Adding the following to your <Resource> configuration can address the problem.

testOnBorrow="true"
validationQuery="SELECT 1 /* ping */"

Forcing a JSP to recompile

2009-10-18T07:43:00.000-07:00

You can force Tomcat to recompile a jsp from any web brower by making a request to:

http://hostname/path/yourPage.jsp?jsp_precompile=true

The jsp_recompile parameter in the request will force the request to compile the page and load it into the ClassLoader. This is only true if you are jsps are outside of the WEB-INF folder.

How to make your webapp the Tomcat default application

2009-10-07T20:49:00.000-07:00

It's always asked so, here's a link to the answer.

http://wiki.apache.org/tomcat/HowTo#How_do_I_make_my_web_application_be_the_Tomcat_default_application_.3F

How to Post a SaveAs Dialog

2009-09-24T12:38:00.000-07:00

To prompt a 'Save As' dialog box when downloading a file, set the Content-Disposition to 'attachment' in the HTTP header.

Read RFC 2183

You can also pre-set the saved filename by setting the filename parameter as well.

Be sure to set the appropriate MIME type or content type as well.

Below is a code example of how this would be achieved in a java servlet before committing the response.


response.setContentType( "application/pdf" ); 
response.setHeader("Content-disposition","attachment; filename=" + "Example.pdf" );

Hope this helps, if it does, help me out by clicking on one of my sponsors.

Accessing HTTP Header with OGNL

2009-09-08T17:51:00.000-07:00

OGNL stands for Object-Graph Navigation Language; it is an expression language for getting and setting properties of Java objects. You use the same expression for both getting and setting the value of a property.

Struts2 adds on top of OGNL by providing support for a 'Value Stack'. While OGNL operates under the assumption there is only one "root", XWork's ValueStack concept requires there be many "roots". Have a quick read on OGNL basics.

When referring to non-root objects are accessed with a (#) sign.

Accessing an HTTP Header can be achieved by the following code.

<s:property value="#header.myHeaderPropKey"/> or
<s:property value="#header['myHeaderPropKey']"/> or

Branching in CVS with Eclipse

2009-07-15T07:40:00.000-07:00

Sometimes you find such a well written article on a specific topic that you feel that it just needs to be shared.

I have gone to this article on branching and merging in CVS with Eclipse numerous times for more confidence, particularly before a merge.

http://www.eclipse.org/articles/article.php?file=Article-BranchingWithEclipseAndCVS/article1.html

Preparable CRUD actions with multiple prepare methods

2009-07-06T18:43:00.000-07:00

Many of the Struts2 Tutorials guide you towards stuffing multiple CRUD operations for a single entity within a single action. Sounds nice, but what happens when you need to prepare these actions differently?

Your first instinct might tell you to implement multiple actions for that one entity (one per CRUD operation, or maybe even stuff two inside one action).

However, you can add multiple prepare{METHOD}() like prepareDoDelete(),
prepareDoUpdate(). If you follow this convention, the appropriate prepare method will be called before your action method.

The following is a snippet from the Struts 2 Documentation at:
http://struts.apache.org/2.0.11/docs/prepare-interceptor.html

In PrepareInterceptor

Applies only when action implements Preparable

1. if the action class have prepare{MethodName}(), it will be invoked
2. else if the action class have prepareDo(MethodName()}(), it will be invoked
3. no matter if 1] or 2] is performed, if alwaysinvokePrepare property of the interceptor is "true" (which is by default "true"), prepare() will be invoked.

junit.framework.AssertionFailedError: No tests found in

2009-06-23T13:40:00.000-07:00

If you ever get the above error and you think your test class is set up and implemented correctly, you may have one more thing to check.

Your test method names need to start with 'test'.

For example:

public class name extent TestCase{
public void method1() {}
public void method1() {}
}

Will result in an error. Change the method names to...

public class name extent TestCase{
public void testMethod1() {}
public void testMethod1() {}
}

You should be good to go!

Setting up JUnit in your Eclipse Project

2009-06-22T07:05:00.000-07:00

The following is the first steps to adding JUnit test cases to your Eclipse project. It's the first step in working your processes towards Test Driven Development, which is the bread and butter of Agile and XP Programming methodologies and techniques.

Step 1: Download JUnit

The first step is to download the most recent version of JUnit (look for the 'Releases' link off the homepage). At the time of this article, the latest version was 4.6.

Step 2: Add JUnit to your Eclipse project's build path.

Right click on your project and select 'Properties'.
Click 'Java Build Path'.
Click the 'Libraries' tab.
Click 'Add JARs' (if you've added the JAR into your workspace)
or
Click 'Add External JARs' (if you are linking the JAR from outside your workspace)
In the GUI, select the JUnit jar (junit-4.6.jar).

Step 3: Organize your source folders

One recommended practice is to organize your source folders into the following structure:

[project]
-- src    
-- main   (module code)
-- test   (test code only)

Create the above directory structure under your project in Eclipse.
Right click on your project and select 'Properties'.
Click 'Java Build Path'.
Click the 'Source' tab.
Add the 'main' and 'test' folders as source folders in your project and deselect 'src' as a source folder.

Ready to go

You now have effectively integrated JUnit into your project, provided a clean way to separate your code base with your testing code.

Any questions, feel free to comment and I'll get back to you as soon as I can.

Using Static Helper Classes - Java Memory and the Initialization on Demand Holder Idiom

2009-06-15T11:38:00.000-07:00

A recent discussion about design patterns and data delegator classes was brought up recently in the tomcat-users mailing list. It is common to find that many web applications use several delegate classes providing access to some data source. Delegate classes are often implemented using the singleton-design pattern, which proposes that at any time there can only be one instance of a singleton (object) created by the JVM.

Theoretically, questions come into mind concerning the governance surrounding instantiation and synchronization of these singleton classes, especially in a multi-threaded environment.

In this post, we'll go over some approaches posted in the thread and provide a best option.

Static Initizialization
Double Checked Locking (later only on post 1.5 jvm)
Initialize-On-Demand Holder Class Idiom (MOST PREFERRED)

Static Initialization

class BeanBag {
private static final SomeBean someBean = new SomeBean();
private static final AnotherBean anotherBean = new AnotherBean();

public static SomeBean getSomeBean() { return someBean; }
public static AnotherBean getAnotherBean() { return anotherBean; }
}

The initialization happens at the loading time of the class but there is no guarantee to be synchronized. The static class property someBean will be available at first call to getSomeBean(). This works 99% of the time, I have never had a problem with it.

Double Lock Checking

class BeanBag {
private static volatile SomeBean someBean = null;

public static SomeBean getSomeBean() {
if (someBean==null){
synchronized(BeanBag.class){
if (someBean==null){
someBean = new SomeBean();
}
}
}
return someBean;
}
}

The difference here, is the singleton instance is not actually instantiated until the getSomeBean() method is called. This provides a more lazy instantiation paradigm if needed. Here we can synchronize the block when SomeBean is instantiated.

Initialize-On-Demand Holder Class Idiom

class BeanBag {
//Inner Class
private static class BeanBagHolder {
public static SomeBean someBean = new SomeBean();
}

public static Something getInstance() {
return BeanBagHolder.someBean;
}
}

This idiom derives its thread safety from the fact that operations that are part of class initialization, which is guaranteed by the JVM. It derives its lazy initialization from the fact that the inner class is not loaded until some thread references one of its fields or methods. This provides the best of both options and guaranteed to be thread-safe by the JVM.

The last option is the most preferred and this article goes into greater detail about Java Memory Model.

Struts2: Accessing Session Variables in JSP's

2009-06-14T12:37:00.000-07:00

Struts 2 places named objects including the session onto the OGNL stack. Named objects can easily be retrieves using the s:property tag. For example:

<s:property value="%{#session.User.firstName}"/>

Struts 2 supports other named objects that can be accessed the same way. Suppose the attribute name attrName for all examples below.

Request parameter : #parameters['attrName ']
Request attribute : #request.attrName
Session attribute : #session.attrName
Application Attribute : #application.attrName

For more on OGNL basics, click here.

ALTER TABLE SQL - ADD COLUMN and Foreign Key Constraint

2009-04-28T19:45:00.000-07:00

In this short tutorial, we will alter a table in a MySQL database by adding a column to the table along with a new foreign key constraint.

First we will alter the table user and add a column called zipcodeId, which is an integer.

ALTER TABLE user ADD COLUMN zipcodeId INT

The zipcodeId field references a field in another table called zipcode. Next, we'll define the foreign key constraint.

ALTER TABLE User ADD CONSTRAINT FK_User_1 FOREIGN KEY (zipcodeId) REFERENCES Zipcode (id)

That was quick and easy. Note, all of this information is readily available in the MySQL online documentation at: http://dev.mysql.com/doc/refman/5.1/en/alter-table.html

Check if a file contains a string

2009-04-14T18:33:00.000-07:00

I recently wrote some java code to check if a file contains a string.


public class FileUtilities {

 
   /**
    * Returns true if the file exists and contains aString, false otherwise.
    * @param file
    * @param aString
    * @return
    * @throws FileNotFoundException
    */
   public static boolean fileContainsString(File file, String aString) throws FileNotFoundException{
  
      FileInputStream fis = null;
      BufferedReader in = null;
  
      try{
         fis = new FileInputStream(file);
         in = new BufferedReader(new InputStreamReader(fis));
   
         String currentLine = "";
         while ((currentLine = in.readLine()) != null) {
            if(currentLine.indexOf(aString) > 0)  return true;
         }
   
      }catch(IOException ioe){
         ioe.printStackTrace();
      }finally{
         try{
            if(in != null) in.close();
            if(fis != null) fis.close();
         }catch(IOException ioe){ }
      }
      return false;
   } 
}

Converting Camelcase to SEO friendly strings

2009-04-14T05:54:00.000-07:00

Recently, I've been working on a simple code generator that generates code, facilitating CRUD operations on a simple database table. I quickly needed to find a way to turn a CamelCase string into an SEO friendly string, converting a string like, "camelCase" to "camel-case".

Below is a code snippet that does just that. It isn't the most efficient code, but it does get the job done. I've been using this code to generate Struts2, Spring JDBC CRUD code, following conventions dictated by the Struts2 Convention Plugin.

There is a dependency on the commons-lang package, which you will need in your build path to compile:

The code snippet follows:

package com.edwardwebnerd.tools.generator;

import org.apache.commons.lang.StringUtils;
import org.apache.commons.lang.WordUtils;
import org.apache.log4j.Logger;

public class StringConverter{

private static final char [] capitalLetters = new char[] {'A','B','C','D','E','F',
'G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z'};

public static String toSearchEngineOptimized(String aString){
ArrayList stringPieces = new ArrayList();
int firstCapital = StringUtils.indexOfAny(aString, capitalLetters);
int tempIndex = 0;

while(firstCapital > 0){
String snippet = aString.substring(tempIndex, firstCapitalIndex);
tempIndex = firstCapital;
stringPieces.add(StringUtils.uncapitalize(snippet));
firstCapital = 
StringUtils.indexOfAny(aString.substring(firstCapital), capitalLetters);

}
stringPieces.add(StringUtils.uncapitalize(aString.substring(tempIndex)));

String foldername = "";
for(int i = 0; i < stringPieces.size(); i++){
if(i == 0)
foldername = stringPieces.get(i);
else
foldername = foldername + "-" + stringPieces.get(i);
}

return foldername;
}

If you have any questions, please just comment and I'll get back to you.

Escape Sequence and Raw String Literal for ${} in FreeMarker

2009-04-09T06:08:00.000-07:00

I use freemarker to generate JSP's to quickly generate simple CRUD actions. During the development of this code generator I needed a way to escape ${} and print out that string literal.

To indicate that a string literal is a raw string literal, you have to put an r directly before the opening quotation mark or apostrophe-quote.

Example:
${r"${example}"}

will print:
${example}
C:\foo\bar

Anymore questions about FreeMarker? Just ask me by providing a comment and I'll mull over it. Thanks!

Geithner Outlines 'Resolution Authority'

2009-03-25T11:07:00.000-07:00

Business week posted an article on Geithner's legislation proposal and outlined what 'Resolution Authority' is actually being requested. The article is referenced below.

'The goal of the proposal is to give the government better tools to handle the failure of giant and deeply intertwined financial firms like insurance behemoth American International Group (AIG) and banking titan Citigroup (C)—companies'

The key phrase being 'like AIG and Citigroup' . Will this fate soon fall upon AIG and Citigroup themselves?

'The proposal would also effectively shift some authority now held by the judiciary to the executive branch in an effort to speed up what could otherwise be slow-moving bankruptcy proceedings.'

When 'Resolution Authority' is applied, what effect will this have on effected financial institutions?

The last section in the article called 'Preventing Firestorms', talks about stemming systemic risk.

Ultimately, if this legislation is passed, I feel that the US government will have the ability to ultimately say, 'We have the necessary tools in place to prevent big institutions, who are too big to fail, from failing'. Systemic risk is exactly the failure of any of these type of institutions. The legislation proposes a US government mandated controlled bankruptcy, where all creditors and debtors expeditiously renegotiate terms of existing debt.

Will this even pass? How will the contracts be renegotiated? Will effected financial institutions sue the US government for full values of their contracts?

This 'Resolution Authority' is unconstitutional, and too vague. If the government did have this power for AIG and Lehman, what would AIG and Lehman look like now?

FAZ is now the play.

Please share your thoughts and predictions below.

http://www.businessweek.com/bwdaily/dnflash/content/mar2009/db20090325_426418.htm?chan=top+news_top+news+index+-+temp_top+story

Investing in FAZ and FAS (continued)

2009-03-24T10:30:00.000-07:00

After watching the market rally on Geithner's plan, I looked for some details on the plan and some possibilities that the bears might begin to show their teeth again.

I ended up reading a post on SeekingAlpha (referenced below). That had some logical reasonings and views that will chime with investors on the short side of the financials. But even so with all this logical reasoning in place, we have to inject US Treasury and Federal Reserve policy into our models when investing in FAZ and FAS.

Let me be the first to say, that I have so far lost money investing in FAZ and FAS (10%) and am posting what I have learned playing FAZ and FAS over the last few months, hopefully to the benefit of others.

First, technical analysis is out the window as the performance of these funds have huge swing days on reactions to the news reporting US Treasury and Federal Reserve Policy on the economy. As for all I know, there is no such technical analysis model that takes the news into account. The valuations of financials in the future is all speculative and much more volatile than any other index right now.

Second, do not bet on market corrections. After large market swings on a trading day, buying the inverse fund is NOT a sure bet. Supplement, your reasoning for buying the inverse fund with something other than a market correction. You may get caught on the wrong side of the train.

Third, know the tools that the US Treasury and Federal Reserve have left at their disposal and bet on public perception, not necessarily your own belief. I maintain the position that these funds are leveraged and are for taking advantage of huge swing periods, not to hold long on your personal beliefs.

Over the last year, the US Treasury and Federal Reserve have timed their agendas and dissemination of information on policy and tools to effectively manipulate public perception on the market. The more you understand these tools, which tools are left at their disposal, and what effect on public perception these tools may have, the position becomes an issue of timing.

Last, I would like to begin the comment section on:

What tools and policies the US Treasury and Federal Reserve have at their disposal
When such tools would be deployed

The intended effect on public perception to valuations of the financials the tool or policy will have.

Hopefully, your comments will provide some insight on smart investing strategies in FAZ and FAS.

Referenced Article:
http://seekingalpha.com/article/127558-the-high-dividend-stock-investor-s-collapsing-dollar-survival-guide-part-6a?source=yahoo

MySQL Import and Export

2009-03-16T20:16:00.000-07:00

Two useful commands below to help you import and export data to and from MySQL databases.

Export
To export data from a MySQL database, use the mysqldump utility.

mysqldump -u(your_username) -p(password) (database_name) > (BACKUPFILE.sql)

Import
The file produced can be used to pipe back into a different MySQL database.

mysql -u(username) -p(password) (database_name) < (BACKUPFILE.sql)

Remove the parenthesis and replace the values in both commands above.

Sorting java.util.List with a java.util.Comparator using java.util.Collections

2009-03-04T17:45:00.000-08:00

Sorting objects in a List is a piece of code that every java programmer will write more than once in their lifetime. Any object that implements the java.util.List interface can utilize the sort method contained within the java.util.Collections class to sort the list, using a java.util.Comparator.

Below is a short tutorial and code sample.

First, let's define our object model.

package com.company.model;

public class MilkDelivery {

private int daysTilExpiration;

public MilkDelivery(int daysTilExpiration){ 
this.daysTilExpiration = daysTilExpiration; 
}

public int getDaysTilExpiration() { 
return daysTilExpiration; 
}

public void setDaysTilExpiration(int daysTilExpiration) { 
this.daysTilExpiration = daysTilExpiration; }
}

Second, let's write a Comparator and implement the compare method.

package com.company.model.comparator;

import java.util.Comparator;

import com.company.model.MilkDelivery;

public class MilkDeliveryComparator implements Comparator {

/** Supports sorting from days til expiration ascending */
public int compare(MilkDelivery o1, MilkDelivery o2) {

//Cast down
MilkDelivery delivery1 = (MilkDelivery) o1;
MilkDelivery delivery2 = (MilkDelivery) o2;

if(delivery1.getDaysTilExpiration() > delivery2.getDaysTilExpiration()){
return 1;    
}else if(delivery1.getDaysTilExpiration() == delivery2.getDaysTilExpiration()){
return 0;
}else if(delivery1.getDaysTilExpiration() < delivery2.getDaysTilExpiration()){
return -1;

//or a much more graceful solution....
//return (delivery1.getDaysTilExpiration() - delivery2.getDaysTilExpiration());
}
}

Last but not least, lets write a test class.

package com.company.test;

import java.util.ArrayList;
import java.util.Collections;

import com.company.model.MilkDelivery;
import com.company.model.comparator.MilkDeliveryComparator;

public class MilkTest {

public static void main(String [] args) throws Exception{

ArrayList deliveries = new ArrayList();

deliveries.add(new MilkDelivery(2));
deliveries.add(new MilkDelivery(3));
deliveries.add(new MilkDelivery(1));
deliveries.add(new MilkDelivery(4));

//Sort
Collections.sort(deliveries, new MilkDeliveryComparator());

for(int i = 0; i < deliveries.size(); i++){
MilkDelivery milkDelivery = deliveries.get(i);
System.out.println("Delivery(" + i + ")  Days til Expiration:" + 
milkDelivery.getDaysTilExpiration());
}
}
}

The output should read:
Delivery(0) Days til Expiration:1
Delivery(1) Days til Expiration:2
Delivery(2) Days til Expiration:3
Delivery(3) Days til Expiration:4

Customizing an HTML Struts2 Tag

2009-02-17T14:57:00.001-08:00

The Struts2 Tags come with the notion of packaged themes or templates. These packaged themes are not meant for changing the display of presentation, but enables a developer to align the package or theme selection, with the HTML presentation implementation (CSS, AJAX, XHTML, or even old school, simple HTML).

In addition the Struts2 Tag library comes with the ability to override the default package implementations provided. Some of the default packaged themes may perform as desired, but in some instances, you may have to customize the tags display output.

Below, I've provided two great starting points in helping you overload your templates and customizing the behaviour of your Struts2 tags.

http://struts.apache.org/2.0.14/docs/themes-and-templates.html
http://struts.apache.org/2.0.14/docs/template-loading.html

java.util.List to Object array (Object []) of a specified type

2009-01-27T17:11:00.000-08:00

The tip below can help you in the data access tier or the application tier.

The java.lang.reflect.Array class provides static methods to dynamically create and access Java arrays. Any java collection or list can easily be converted into an Object array. There are two method calls, that I preferably squish into one line to get the job done. The first method call is:

Array.newInstance(Class componentType, int length) throws NegativeArraySizeException

The method creates a new array with the specified component type and length. You can also cast down to have returned an array of your specified component type.

The second method call is defined in the java.util.List interface.

public Object[] toArray(Object[] a)

The method returns an array containing all of the elements in the List in the correct order where the runtime type of the returned array is that of the specified array.

Coupling the two calls above can allow you to quickly transform your ArrayList of objects into an object array of the specified object's component type.

Have a look at the sample code below for an ArrayList of strings to be converted into a String [].

ArrayList theStrings = new ArrayList();
theStrings.add("Hello");
theStrings.add("Aloha");
theStrings.add("Bonjour");

//Return String [].
String [] theStringArray = 
(String[])theStrings.toArray(
(String[])Array.newInstance(java.lang.String.class, theStrings.size())
);

With one line, you'll be able to turn your list of Java objects into an array of objects of the object's component type.

Questions, just comment and I'll be sure to get back to you.

javax.imageio.ImageIO and degrading JPEG

2008-12-29T20:52:00.000-08:00

JPEG is a lossy compression encoding algorithm. Each time you encode a JPEG image, you lose image quality because of the cosine coefficients dropped in order to perform the compression.

Using the read and write methods from javax.imageio.ImageIO.read and javax.imageio.ImageIO.write method will amplify this quality loss, because of varying detail levels during the read and write. You may be reading a jpeg and 90% detail and writing it with 50% detail.

Avoid jpeg interpretation of image files unless image processing is required.

Spring JDBC Tutorial

2008-12-26T21:53:00.000-08:00

Below is a quick tutorial on how to get things up and running with Spring and JDBC. The code in the tutorial is intended to utilize a MySQL database as its data source.

Let's start the tutorial off with getting MySQL database installed. If you do not have it installed, follow this link to the MySQL download site. Follow the installation instructions and remember your database username and password.

REQUIRED LIBRARIES
Next, download all the necessary libraries needed to execute this tutorial:

JDBC driver for MySQL, MySQL Connector/J.
The latest spring framework. 3.0.0.M1.
ANTLR 3.0.1
Commons Logging.

Because you won't need the whole spring framework, below is a list of all the required Spriong libraries to build and execute the code in this tutorial:

spring beans
spring context
spring core
spring expression
spring jdbc
spring transaction
mysql connector/j
commons logging
antlr

Make sure you add these dependencies to your build path.

CREATE THE DATABASE
Next, we'll need to create a database along with a table to act as the data source for this tutorial.

For this example, we'll create a table called siteAdmin:


CREATE TABLE siteAdmin (
id MEDIUMINT NOT NULL AUTO_INCREMENT,
username VARCHAR (20) NOT NULL,
password VARCHAR (20) NOT NULL,
firstName VARCHAR (20) NOT NULL,
lastName VARCHAR (20) NOT NULL,
email VARCHAR (40) NOT NULL,
created TIMESTAMP NOT NULL,
lastModified TIMESTAMP NOT NULL,
status INT NOT NULL,
PRIMARY KEY (id)
);

CREATE YOUR DOMAIN MODEL
Next, generate your domain model of the siteAdmin table you just created.

package com.edwardwebnerd.persistence.model;

import java.sql.Date;

public class SiteAdmin{

private int id;
private String username;
private String password;
private String firstname;
private String lastname;
private String email;
private Date created;
private Date lastModified;
private int status;

/** @return the id */
public int getId() {
return id;
}
/** @param id the id to set */
public void setId(int id) {
this.id = id;
}
/** @return the username */
public String getUsername() {
return username;
}
/** @param username the username to set */
public void setUsername(String username) {
this.username = username;
}
/** @return the password */
public String getPassword() {
return password;
}
/** @param password the password to set */
public void setPassword(String password) {
this.password = password;
}
/** @return the firstname */
public String getFirstname() {
return firstname;
}
/** @param firstname the firstname to set */
public void setFirstname(String firstname) {
this.firstname = firstname;
}
/** @return the lastname */
public String getLastname() {
return lastname;
}
/** @param lastname the lastname to set */
public void setLastname(String lastname) {
this.lastname = lastname;
}
/** @return the email */
public String getEmail() {
return email;
}
/** @param email the email to set */
public void setEmail(String email) {
this.email = email;
}
/** @return the created */
public Date getCreated() {
return created;
}
/** @param created the created to set */
public void setCreated(Date created) {
this.created = created;
}
/** @return the lastModified */
public Date getLastModified() {
return lastModified;
}
/** @param lastModified the lastModified to set */
public void setLastModified(Date lastModified) {
this.lastModified = lastModified;
}
/** @return the status */
public int getStatus() {
return status;
}
/** @param status the status to set */
public void setStatus(int status) {
this.status = status;
}
}

CREATE YOUR DAO INTERFACE
Next, generate your DAO interface.

package com.edwardwebnerd.persistence.jdbc.dao;

import java.util.List;
import javax.sql.DataSource;
import com.edwardwebnerd.persistence.model.SiteAdmin;


public interface SiteAdminDAO {

void setDataSource(DataSource ds);

List selectAll();

void create(String username, String password, String firstName, String lastName,
String email, int status);

List select(String username, String password);

List select(int id);

List selectAll();

void delete(int id);
}

IMPLEMENT YOUR DAO

The implementing DAO class.

package com.edwardwebnerd.persistence.jdbc.dao.impl;

import java.util.List;

import javax.sql.DataSource;

import org.springframework.jdbc.core.JdbcTemplate;

import com.edwardwebnerd.persistence.model.SiteAdmin;
import com.edwardwebnerd.persistence.jdbc.dao.SiteAdminDAO;
import com.edwardwebnerd.persistence.model.SiteAdmin;
import com.edwardwebnerd.persistence.jdbc.dao.impl.mapper.SiteAdminMapper;


public class SiteAdminDAOImpl implements SiteAdminDAO {

private DataSource dataSource;

@Override
public void setDataSource(DataSource ds) { dataSource = ds; }


@Override
public void create(String username, String password, String firstName, 
String lastName, String email, int status)
{
JdbcTemplate insert = new JdbcTemplate(dataSource);
insert.update("INSERT INTO siteAdmin " +
"(username, password, firstName, lastName, email, status)" +
" VALUES(?,?,?,?,?)",
new Object[] { username, password, firstName, lastName, email,
status});
}


@Override
public void delete(int id) 
{
JdbcTemplate delete = new JdbcTemplate(dataSource);
delete.update("DELETE from siteAdmin where id= ?",
new Object[] { id });
}


@Override
public List select(String username, String password) 
{
JdbcTemplate select = new JdbcTemplate(dataSource);
return select.query(
"select * from siteAdmin where username = ? AND password = ?",
new Object[] { username, password },
new SiteAdminMapper());
}


@Override
public List select(int id) 
{
JdbcTemplate select = new JdbcTemplate(dataSource);
return select.query(
"select * from siteAdmin where id = ?",
new Object[] { id },
new SiteAdminMapper());
}


@Override
public List selectAll() 
{
JdbcTemplate select = new JdbcTemplate(dataSource);
return select.query("select * from siteAdmin",
new SiteAdminMapper());
}
}

The implementation also uses a RowMapper class to help shorten the implementation and provide a single point of managing the mapping between the siteAdmin's table column names and the domain model's class members.

package com.edwardwebnerd.persistence.jdbc.dao.impl.mapper;

import java.sql.ResultSet;
import java.sql.SQLException;

import org.springframework.jdbc.core.RowMapper;

import com.edwardwebnerd.persistence.model.SiteAdmin;

public class SiteAdminMapper implements RowMapper {

public SiteAdminMapper(){}


@Override
public Object mapRow(ResultSet resultSet, int arg1) throws SQLException {
SiteAdmin siteAdmin = new SiteAdmin();
siteAdmin.setId(resultSet.getInt("id"));
siteAdmin.setUsername(resultSet.getString("username"));
siteAdmin.setPassword(resultSet.getString("password"));
siteAdmin.setFirstname(resultSet.getString("firstname"));
siteAdmin.setLastname(resultSet.getString("lastname"));
siteAdmin.setEmail(resultSet.getString("email"));
siteAdmin.setCreated(resultSet.getDate("created"));
siteAdmin.setLastModified(resultSet.getDate("lastModified"));
siteAdmin.setStatus(resultSet.getInt("status"));
return siteAdmin;
}
}

CREATE A SERVICE LAYER INTERFACE OVER YOUR DAO IMPLEMENTATION
Next, generate your Service interface.

package com.edwardwebnerd.persistence;

import java.util.List;

import com.edwardwebnerd.persistence.jdbc.dao.SiteAdminDAO;
import com.edwardwebnerd.persistence.model.SiteAdmin;


public interface LittleLeagueServices {

void setSiteAdminDAO(SiteAdminDAO siteAdminDAO);

List siteAdminSelectAll();
}

CREATE A SERVICE LAYER INTERFACE OVER YOUR DAO IMPLEMENTATION
Next, generate your implementing Service class.

package com.edwardwebnerd.persistence.jdbc;

import java.util.List;

import com.edwardwebnerd.persistence.LittleLeagueServices;
import com.edwardwebnerd.persistence.jdbc.dao.SiteAdminDAO;
import com.edwardwebnerd.persistence.model.SiteAdmin;


public class LittleLeagueServicesImpl implements LittleLeagueServices {

private SiteAdminDAO siteAdminDAO;

@Override
public void setSiteAdminDAO(SiteAdminDAO siteAdminDao) 
{    
siteAdminDAO = siteAdminDao;    
}

@Override
public List siteAdminSelectAll(){
return siteAdminDAO.selectAll();
}   
}

CONFIGURE SPRING
Next, we'll define an XML config file to have Spring inject the DAO Implementation into our services and inject a MySQL data source into the DAO Implmentation. Remember to replace the connection information appropriately.

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans 
http://www.springframework.org/schema/beans/spring-beans-2.5.xsd">

<bean id="littleLeagueServices"
class="com.edwardwebnerd.persistence.jdbc.LittleLeagueServicesImpl">
<property name="siteAdminDAO" ref="siteAdminDAO"/>
</bean>

<bean id="siteAdminDAO" 
class="com.edwardwebnerd.persistence.jdbc.dao.impl.SiteAdminDAOImpl">
<property name="dataSource" ref="dataSource"/>
</bean>

<bean id="dataSource" destroy-method="close" 
class="com.mysql.jdbc.jdbc2.optional.MysqlConnectionPoolDataSource">
<property name="url" 
value="jdbc:mysql://localhost:3306/?autoReconnect=true"/>
<property name="user" value=""/>
<property name="password" value=""/>
</bean>
</beans>

TRY A TEST RUN
Next, test your services with a test run class.

package com;

import java.util.List;

import org.springframework.beans.factory.BeanFactory;
import org.springframework.context.support.ClassPathXmlApplicationContext;
import org.springframework.context.ApplicationContext;

import com.edwardwebnerd.persistence.LittleLeagueServices;
import com.edwardwebnerd.persistence.model.SiteAdmin;

import org.apache.log4j.BasicConfigurator;
import org.apache.log4j.Logger;

public class SpringTest {

static Logger logger = Logger.getLogger(SpringTest.class );

public static void main(String [] args){
BasicConfigurator.configure();

ApplicationContext applicationContext = 
new ClassPathXmlApplicationContext("config.xml");
BeanFactory factory = applicationContext;

logger.info("LittleLeagueServices Initializing");
LittleLeagueServices littleLeagueServices = 
(LittleLeagueServices) factory.getBean("littleLeagueServices");
logger.info("LittleLeagueServices Initialized");

logger.info("LittleLeagueServices: Retrieving SiteAdmins");
List siteAdmins = littleLeagueServices.siteAdminSelectAll();
for(int i = 0; i < siteAdmins.size(); i++){
SiteAdmin siteAdmin = siteAdmins.get(i);
logger.info(siteAdmin.toString());
}
}
}

If you have any questions on this tutorial, just comment on the blog and I'll be sure to get back to you.

Investing in FAZ (Financial Bear 3x) and FAS (Financial Bull 3x)

2008-12-12T16:58:00.000-08:00

As I became more interested in investing in FAZ and FAS, I first looked at all the posts in the forums and tried to filter out all the "trolling" and it seems to me that many don't understand what they are investing in.

This blog takes attempts to take out all the noise and attempts to look at the numbers objectively, to try and develop an investment strategy in FAZ or FAS. I'm doing this research myself, so thought I'd share it and post it in other forums to help people figure out the maze.

First the introduction, FAZ and FAS are 3X leveraged ETF's that track the Russell 1000 Financial Services (RGS) Index.

LEVERAGE
The first thing to note about these ETF's is the leverage. The leverage for these funds is at 3x. There are other ETF's tracking indexes leveraged 2x and other's that are not leveraged at all. The key here is to understand what "leverage" exactly means? Does it mean that for every 1% change in the index, leads to a 3% change in the price of funds? I wasn't too sure and plenty of the forums in these funds elude to buyer beware messages. So let's crunch the numbers and see exactly what it means. (Click the graph)

The first thing to note is that the ETF's inception date was November 7 and if we had bought both funds and held onto it til the present date, we would of lost a great deal on both sides of the coin. As of December 12:

RIFIN.X (-14.5%)
FAZ (-39.7%)
FAS (-53.81%)

By looking at the names of Finanacial Bull 3x and Financial Bear 3x alone, you might expect the following performance of funds in the funds with the RIFIN.x losing 14.5% since inception:

RIFIN.X (-14.5%)
FAZ (33.5%)
FAS (-33.5%)

However, that is not the math that these funds are following and it is actually contained within their prospectus. If you have not viewed the prospectus, I highly recommend that you do.

So let's look at the following hypothetical scenario to try and explain what it means to be 3x leveraged and try to explain the above scenario.

So as we see, ultimately, that over time, this fund will lose you money. It gets increasingly more difficult for these funds to get back even, even more so as the RIFIN.X fluctuates up and down. People holding this fund for over 3 days need to keep reading.

STRATEGY FOR PLAYING FAZ OR FAS
Holders beware, do not hold this for over a day in your portfolio for the reasons stated above. This ETF is for day traders only, who can take advantage of a volatile swing in the index in less than 24 hours. There is no reason to hold FAZ or FAS, because ultimately you are betting on multiple day bear or bull rallies. It's a slippery slope, but most of it is downhill if you hold.

On the google forums, fjordl...@gmail.com posted a spreadsheet with FAS and FAZ prices along side the RIFIN.X prices, to illustrate how FAZ and FAS are priced.

http://spreadsheets.google.com/ccc?key=peyWe3CKKO3vpdyZuto56bQ

If you have any questions about this, just fill out a comment below and I'll get back to you.

Check for null in FreeMarker 2.4

2008-12-11T18:37:00.000-08:00

With the preview of FreeMarker version 2.4 available, a few enhancements to the template language have really improved FreeMarker's appeal.

Providing a check for "null" is one of the largest enhancements that make it easier for developers to transition to FreeMarker from other view technologies. View the (preview announcement).

Previously in 2.3 and below, a "null" value was essentially treated as a missing variable. The missing value operator was the suggested way of testing for null, as the word "null" is not a reserved word in the template language. Here's a look at the 2.3 documentation on treating undefined variables and null values.

FreeMarker 2.3 and Pre - Missing Value Operator
Assume aVariable is null or not defined.

<#if aVariable??>

If you wanted to check if a string was empty or null in FreeMarker, you might have used has_content, one of the "Seldom used and expert built-ins"

Assume aVariable is null or not defined.

<#if aVariable?has_content>

<#if aVariable!?size > 0 or aVariable!?length > 0>

FreeMarker 2.4 Enhancement
2.4 is now null-aware with other template language enhancements, making null a reserved word in 2.4.

JSTL Expression Language (EL) not being resolved.

2008-12-07T19:55:00.000-08:00

When the container is unable to resolve EL syntax ${}, in JSTL tags. There are a couple of things that you can do to get EL syntax resolving in your JSP's. I assume that you are running an application server supporting the JSP 1.2 and Servlet 2.3 specifications.

In order to evaluate EL expressions, your web.xml file must be up to date.
If your web.xml states that it is version 2.3 or less, EL evaluation is disabled by default for backwards compatibility.

If your web.xml reads:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>

Replace it with:

<?xml version="1.0" encoding="ISO-8859-1"?>
<web-app xmlns=""http://java.sun.com/xml/ns/j2ee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
version="2.4">

If you are unable to update your web.xml to a post 2.3 descriptor, then you can add the following to your jsp page to have EL evaluated:
<%@ page isElIgnored="false" %>
overriding the default configuration for a pre 2.4 descriptor.

Filtering IP traffic using a Java Filter - RemoteAddrFilter

2008-12-04T20:21:00.000-08:00

I recently wrote a Java Filter, which is a replica of the org.apache.catalina.valves.RemoteAddrValve implementation. It performs filtering based on comparing the requestors remote IP address against a set of regular expressions, configured in the Filter's initialization parameters. If an IP addresses is to be rejected it is rejected with a Forbidden HTTP response.

This provided useful because Valves are attached to the servlet container while a Filter can be mapped to any url pattern at the application level rather than at the container level.

GET THE CODE
Here is a link to the filter code. (RemoteAddrFilter.java)

This filter is configured by setting the allow and/or deny properties to a comma-delimited list of regular expressions to which the requestors remote address will be compared. Evaluation proceeds as follows:

The filter initializes reading the allow and/or deny properties and converting them to a comma-delimited list of regular expressions to which the requester's remote address will be compared.
If there are any deny expressions configured, the property will be compared to each such expression. If a match is found, this request will be rejected with a "Forbidden" HTTP response.
If there are any allow expressions configured, the property will be compared to each such expression. If a match is found, this request will be allowed to pass through to the next Filter in the current pipeline.
If one or more deny expressions was specified but no allow expressions, allow this request to pass through (because none of the deny expressions matched it).
The request will be rejected with a "Forbidden" HTTP response.

The filter is configured the same way all Java Filter's. This filter takes two initial parameters. The value of those properties should be set to a comma-delimited list of regular expressions to which the requestors remote address will be compared.

CONFIGURE
The filter is added to your context via the web.xml. Below is an example configuration.


<filter>

   <filter-name>RemoteAddrFilter</filter-name>

   <filter-class>RemoteAddrFilter<filter-class>

   <init-param>

      <param-name>allow</param-name>

      <param-value>192.168.1.*</param-value>

   </init-param>

   <init-param>

      <param-name>deny</param-name>

      <param-value>163.122.111.*</param-value>

</init-param>

</filter>

DEPENDENCIES
There is a dependency with Jakarta Regexp.

FINANCIAL BEAR 3X (Public, NYSE:FAZ)

2008-12-02T20:55:00.000-08:00

Don't think the economy is doing well? Think that it will get worse? There is a fund out there for bears to sink their teeth into the market, tripling down their bet on the further decline of financial and capital markets.

I'm bullish on financial bear, as I'll need to see one of three things to start selling off my holding:

Unemployment rates decline.
Foreclosure rates decline.
Standard of living increase.

It recently ran to as high as 200 when news came out that Paulson would not use bailout money towards its original intention of buying troubled assets from financial firms and Citibank needed an additional cash infusion. Comboed with the indexes at their lows in late November, this fund ran hyper.

The next coming weeks this fund will see a decline, but this one could run through the same scenario, dependent on whether or not Congress will give Paulson the second half of this bailout.