Yang Li's blog

Visual Studio (VS) 2005 IDE for IronPython (Python)

2007-07-10T20:43:00Z

I think it's worth posting this blog because it's really hard for me to find IronPython IDE integrated with Visual Studio 2005 directly. The following instructions show how to build IronPython IDE for VS 2005 by using VS 2005 SDK.

1. Download the latest Visual Studio 2005 SDK version 4.0 and install it. (requirements: Visual Studio 2005 Standard Edition or above, and Visual Studio 2005 Service Pack 1 installed)

2. Open the IronPython.sln solution in the <InstallationPath>\VisualStudioIntegration\Samples\IronPythonIntegration folder.

3. Press F5 to build the sample, you will see VS launched from the experimental hive. And a couple of IronPython project templates are seen from New Project dialog. Also IDE includes Intellisense features.

4. Next time, if you want to new IronPython project, just launch Visual Studio from Start->All Programs->Visual Studio 2005 SDK->2007.02->Tools->Start Visual Studio 2005 under Experimental hive, because it doesn't want to affect current your stable VS 2005.

You're done! Enjoy IronPython!

Build managed applications using Visual Studio 2005 that target .NET 1.1

2007-07-05T20:44:00Z

We have VS2005 installed. What if we need to provide managed app for .NET 1.1? Do we have to install VS2003 as well? Not really, the following steps instruct us how to build .NET 1.1 managed apps under VS2005.

1. Make sure that .NET 1.1 SDK installed. Check if “Program Files\Microsoft.NET\SDK\v1.1” exists, otherwise, we can download one from here.

2. Download MSBee and install it. By default, it will locate at “Program Files\MSBuild\MSBee”.

3. Assume we already have VS2005 csproj file (also works for vbporj) and it should be back-compatible with .NET 1.1. Edit it by using any text editor tool, for example, notepad. Find the line

“<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />” and insert line

“<Import Project="$(MSBuildExtensionsPath)\MSBee\MSBuildExtras.Fx1_1.CSharp.targets" Condition=" '$(BuildingInsideVisualStudio)' == '' AND '$(TargetFX1_1)'=='true'" />” after it.

4. Open Visual Studio 2005 Command Prompt (under Start->All Programs->Microsoft Visual Studio 2005->Visual Studio Tools). Go to the directory csproj located and type command

“msbuild ourApp.csporj /t:Rebuild /p:TargetFX1_1=true”. From build log in console, we’ll see the project refers to .NET 1.1 SDK.

5. Make sure the folder “FX1_1” is created under bin directory. The managed app or assembly should be inside it. By using “ildasm ourTarget.dll”, the manifest shows version as v1.1.4322. This is exactly what we want.

For other detailed info of MSBee, please refer to its document as "Program Files\MSBuild\MSBee\MSBee ReadMe.doc"

Five ways debugging .NET Windows service

2007-05-02T02:21:00Z

Although debugging a Windows service is not so easy, especially you want to step into OnStart codes, there still exist a couple of techniques to get it done. I compiled them here in order to let Internet searchers get their work done as easy as possible.

1. Sleeping reasonable time to let you attach the service process into Visual Studio.

Writing the first line of OnStart as “System.Threading.Thread.Sleep(25000);”, you’ll be able to have enough time to attach service process into Visual Studio. It’s a little annoying if you’re fast hand, because you have to wait some seconds before hitting your breakpoints. Life is short. (see ref.)

2. Using conditional directive to determine running in service or normal console mode.

By applying #if(!DEBUG)…(1)…#else…(2)…#endif on your Main method, you’ll be able to write service codes into (1) and the testing codes into (2). What does testing codes look like? Please see the following snippets. You can set breakpoints whichever line you want. (see ref.) Michael also mentioned checking "Environment.UserInteractive" to distinguish it's running under service mode. (for details, see comments below from Michael)

Service1 service = new Service1();

service.OnStart(null);

Console.ReadLine();

service.OnStop();

3. Breaking at service process runtime. (Thanks Paul Ballard's comment)

In debug mode, you can insert “System.Diagnostics.Debugger.Lauch() ;” before the codes where you'd like to be prompted debugger window. So once you start the service from SCM (Service Control Manager), the codes has chance being hit. It actually reminds me that Windows API -- "DebugBreak" or even lower level -- INT 3, both of them might do the same thing in unmanaged world. (see ref.)

4. Using self-built switcher to specify running in service or normal console mode.

Moving forward, if we add switcher in the program, which might be even convenient. For example, if we run “Service1.exe console”, it will silently run as console app, otherwise it just go ahead as service. The detail implementation is quite similar to the codes of #2. The only difference is that whether to run testing codes is based on the Main method's parameters instead of using conditional directive. The benefit of the approach is even in release mode, we are able to monitor the service status if we enable kind of tracking mechanism.

5. Building separate assembly.

Regardless any service or console context, we can simply build an assembly implementing kind of interfaces like Start, Stop, etc. We can test these methods by using unit test or any other test scenarios you want. Once it’s done, it’s basically OK for you to embed the assembly into a service project template created by Visual Studio. (for details, see comments below form Jack)

The only drawback of #2, 4 and 5 is that using normal console mode, the account of service might not be able to get tested, because it’s probably not launched as the account's privilege supposed to be, such as localsystem, networkservice, etc. For the account privilege tests, the #1 and 3 are still valid.

Happy compiling…

Logging customized info in IIS by using AppendToLog

2007-04-26T23:30:00Z

When we try to log HTTP request and response info of IIS, essentially, we'd like to enable IIS logging as W3C extended format. Unfortunately, IIS (at least 6), doesn't allow to log some customized items such as customized HTTP headers. That's what AppendToLog comes from.

Actually, there are two versions of AppendToLog methods. One is IIS COM API (IResponse::AppendToLog); another is ASP.NET (Response.AppendToLog). Both of them will append the string to the request uri in the log entry. Once the response is done, the log entry will be flushed to IIS log file. So developers need to define specific separator to distinguish different logging items if AppendToLog is called multiple times.

One difference between those two is that IResponse::AppendToLog explicitly says there is 80 bytes limitation, but for Response.AppendToLog, my test proves that there is no problem for 1K.

Unique Web Identification

2007-03-31T03:00:00Z

From browser's point of view, what is the unique identification of web site? Nobody won't disagree that it's url in the address bar. Programmatically, you can simply get it by accessing document.location DOM object through Javascript in client side.

Thinking in-depth, it kind of plays a public key to specific page. Web page should be able to verify the signature by using that. The purpose is to prove that the page what the user is looking is exactly from the same server.

One interesting case is if you don’t want somebody else hosts your page inside IFrame in their page, you can write a simple javascript to prevent. Actually more interesting applications regarding web identification already utilize the technique.

IIS7 and ASP.NET

2007-03-28T02:06:00Z

IIS7 provides two modes while integrating with ASP.NET. One is classic mode as back-compatibility approach, in which ASP.NET plays a role as an ISAPI extension (aspnet_isapi.dll) -- standalone app domain. Another is integrated mode -- "enabling ASP.NET components to become full members of the IIS request processing pipeline", in which aspx, web forms and ASP.NET modules are working side by side with native C++ IIS modules in the same pipeline. That means they can take advantage of each other's different services.

Reference:

Explore The Web Server For Windows Vista And Beyond

Nice figure inside the article above

Taking advantage of the IIS7 Integrated Pipeline

Dive into “PreAuthenticate”

2007-02-07T02:28:00Z

Based on the definition of “PreAuthenticate” of System.Net in MSDN, http://msdn2.microsoft.com/en-gb/library/system.net.httpwebrequest.preauthenticate.aspx

“After a client request to a specific Uri is successfully authenticated, if PreAuthenticate is true and credentials are supplied, the WWW-authenticate header is sent with each request to that Uri; otherwise, the request uses standard authentication procedures.

With the exception of the first request, the PreAuthenticate property indicates whether to send authentication information with subsequent requests to the specific Uri without waiting to be challenged by the server.”

The example is shown as below:

PreAuthenticate is false :

1. Client: GET someUrl

Server: 401 WWW-Authenticate Basic

Client: GET with Authorization headers

Server: 200 OK

2. Client: GET someUrl

Server: 401 WWW-Authenticate Basic

Client: GET with Authorization headers

Server: 200 OK

PreAuthenticate is true :

1. Client: GET someUrl

Server: 401 WWW-Authenticate Basic

Client: GET with Authorization headers

2. Server: 200 OK

Client: GET someUrl with Authorization headers

So, if the authentication scheme supports pre-authenticate, for instance, see RFC 2617 – Digest Access Authentication, we will save (n – 1) round trips. We cannot simply avoid the first one because the initial nonce should be sent from server side.

The secret behind the curtain is “Nc” in HTTP AuthData. “For subsequent requests, “Nc” maintained by client must be greater than the last value it used and nonce of server got from the first HTTP 401 response, will be reused.

Microsoft Anti-Cross Site Scripting Library V1.5

2007-02-07T01:45:00Z

Download library from http://www.microsoft.com/downloads/thankyou.aspx?familyId=EFB9C819-53FF-4F82-BFAF-E11625130C25&displayLang=en

The libary uses "the principle of inclusions technique where a set of valid characters are first defined and anything outside that set is automatically encoded." Seven main encoding methods cover 7 normal web encoding cases: HTML, HTML attributes, Javascript, URLs, VB Script, XML and XML attributes.

Encoding Method	Should be Used if …	Example / Pattern
HtmlEncode	Un-trusted input is used in HTML output, except when assigning to an HTML attribute.	<a href=”http://www.contoso.com”>Click Here [Un-trusted input]</a>
HtmlAttributeEncode	Un-trusted input is used as an HTML attribute	<hr noshade size=[Un-trusted input]>
JavaScriptEncode	Un-trusted input is used within a JavaScript context	<script type=”text/javascript”> … [Un-trusted input] … </script>
UrlEncode	Un-trusted input is used in a URL (such as a value in a querystring)	<a href=”http://search.msn.com/results.aspx?q=[Un-trusted-input]”>Click Here!</a>
VisualBasicScriptEncode	Un-trusted input is used within a Visual Basic Script context	<script type=”text/vbscript” language=”vbscript”> … [Un-trusted input] … </script>
XmlEncode	Un-trusted input is used in XML output, except when assigning to a XML attribute.	<xml_tag>[Un-trusted input]</xml_tag>
XmlAttributeEncode	Un-trusted input is used as a XML attribute	<xml_tag attribute=[Un-trusted input]>Some Text</xml_tag>

Note that UrlEncode is only for encoding component of url instead of the whole url. If the whole url passed as one parameter, it should be validated using regular expressions as

^(ht|f)tp(s?)\:\/\/[0-9a-zA-Z]([-.\w]*[0-9a-zA-Z])*(:(0-9)*)*(\/?)([a-zA-Z0-9\-\.\?\,\'\/\\\+=&%\$#_]*)?$

References:

¾ Document: Microsoft Anti-Cross Site Scripting Library V1.5 - User Guide (after installation library)

¾ Forum of ASP.NET XSS attack: http://forums.asp.net/1107/ShowForum.aspx

¾ How To: Prevent Cross-Site Scripting in ASP.NET, http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/PAGHT000004.asp

¾ How To: Protect From Injection Attacks in ASP.NET, http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/PAGHT000003.asp

¾ Design Guidelines for Secure Web Applications, http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/thcmch04.asp

¾ How To: Use Regular Expressions to Constrain Input in ASP.NET, http://msdn.microsoft.com/library/en-us/dnpag2/html/PAGHT000001.asp