JavaScript

Tools

http://www.javascriptlint.com/

Language Variants

CoffeScript and Spine MVC-Framework

Objective-J and the Cappucino framework

PHP

Tools

http://www.icosaedro.it/phplint/

http://pear.php.net/package/PHP_CodeSniffer

http://www.program-transformation.org/PHP/PhpSat

Articles

Lorna Jane on ‘PHP Static Analysis Tool Usage’

Some time ago, I found a mechanism to protect

• the control flow
• and all parameters

of web-application (controllers) against highjacking.

The technique provides this:

• All parameters of request are kept at the server side
• No parameter ever reaches any URL
• The control flow of an application strictly gets controlled by server-side state

The base principle is this:

• Define a controller FlowController
• If a web page needs to include a link to another controller with certain parameters, askFlowController to prepare the link
• FlowController does not provide the link directly, but maintains a server side state, which keeps all link-related information [controller class to be called, arguments to get passed]
• Ultimately, FlowController returns not an actual link, but a random hash-value, which identifies the server side’s state
• Once a hashed link comes back from the browser, it gets passed to FlowController, which looks up the related state and manages to instantiate the controller and pass arguments

Consequences:

• No link can be predicted.
• Thus, no controller can be called without before getting authorization by FlowController.
• All parameters retrieved form FlowController managed state passed to controllers can safely be trusted.

Moreover:

• FlowController manages link states using a stack
• FlowController provides set-back points: FlowControler::TerminateFlow() forces the application to re-establish the last set-back point.
• If FlowController gets asked to start a non-top flow, it automatically deletes all flows above. Thus, if you return to an earlier state of the application, all follow-up states automatically get invalidated.

Consequences: One can call certain workflows – sequences of controllers – in a pure subroutine fashion: Request a set-back point to get set. Run the first controller of the workflow. Eventually, some controller will call FlowControler::TerminateFlow() and the control-flow will return to the caller’s environment.

Note, that the first called controller – more general the whole workflow of several controllers - doesn’t know which other part of of the applications requested its execution. The initiator of the workflow started it using a fire-and-forget fashion: The workflow will eventually come back to me. At a certain point, the workflow signals, that it is done. Important: It does not request a certain continuation controller. Thus, the workflow is fully decoupled from any caller.

Comments?

Teensy USB Development Board, a sweet small development board and a compatible video display

expressFlow, a workflow engine running on GAE

Various examples of how to use OpenStreetMap using the OpenLayers framework

An iOS theme for Adobe Flex in Jason’s Flex Blog

I’ve moved the Pantomime framework into an XCode 3 project and changed some settings to make it compile.

Pantomime is provides classes for mime coding/Encoding, SMTP, POP3 and much more. Since Apple dropped support to send emails using Cocoa, Pantomime might be a good replacement.

Find the zipped XCode project folder here.

Starting to write Cocoa for Mac OS X oder iOS? Have a look at these sites:

• CocoaDevCentral – Very good tutorial. Huge amount of material.
• Cocoa with Love – Well written articles
• CocoaCast – Articles, sample code and podcast

I really wonder, why Apple dropped support for NSMailDelivery since Mac OS 10.5.  In fact, all methods of NSMailDelivery are declared as:

AVAILABLE_MAC_OS_X_VERSION_10_0_AND_LATER_BUT_DEPRECATED_IN_MAC_OS_X_VERSION_10_5

Too bad. Even worse, Apple didn’t provide an alternative – except calling ScriptingBridge as seen in the SBSendEmail sample.

Today, the best option available is CSMail from Corriolis systems. CSMail sends Emails through Apple.Mail (or some other mail clients).

For historical reasons, I mention the no longer maintained Pantomime (LGPL license), MailCore (New BSD license) and EdMessage (BSD syle license).

This snippet converts a NSAttributedString to HTML markup returned as NSString:

+ (NSString*) htmlForAttributedString:(NSAttributedString*) attrString {
  NSArray * exclude = [NSArray arrayWithObjects:@"doctype",
     @"html",
     @"head",
     @"body",
     @"xml",
     nil
     ];
  NSDictionary * htmlAtt = [NSDictionary
     dictionaryWithObjectsAndKeys:NSHTMLTextDocumentType,
     NSDocumentTypeDocumentAttribute,
     exclude,
     NSExcludedElementsDocumentAttribute,
     nil
   ];
  NSError * error;
  NSData * htmlData = [attrString dataFromRange:NSMakeRange(0, [attrString length])
        documentAttributes:htmlAtt error:&error
  ];
  //NSAttributedString * htmlString = [[NSAttributedString alloc]
     initWithHTML:htmlData
     documentAttributes:&htmlAtt
     ];
  NSString * htmlString = [[NSString alloc] initWithData:htmlData encoding:NSUTF8StringEncoding];
  return htmlString;
} // htmlForAttributedString

While this is by no means a complete way to protect against each and any SQLInjection attack, putting these lines inside a .htaccess file at least protects against certain cases:

Could someone post pointer for a Dropbox client ActionScript 3 library for Flex?

I found this http://code.google.com/p/dropbox-as3/ in GoogleCode, but it is kind of undocumented.

Watch and listen PomplamooseMusic or buy their album from iTMS: