Develop Reference

How to validate Java parameters in wrapper.conf

I have using the following parameters in wrapper.conf in my JBoss_EAP_7.1.5 :
wrapper.java.additional.1=-Dprogram.name=JBoss_EAP_7.1.5
wrapper.java.additional.2=-Dsun.rmi.dgc.client.gcInterval=3600000
wrapper.java.additional.3=-Dsun.rmi.dgc.server.gcInterval=3600000
wrapper.java.additional.4=-Xms5G
wrapper.java.additional.5=-Xmx5G
wrapper.java.additional.6=-XX:MaxPermSize=512m
wrapper.java.additional.7=-Dsun.lang.ClassLoader.allowArraySyntax=true
wrapper.java.additional.8=-Djava.net.preferIPv4Stack=true
wrapper.java.additional.9=-server
wrapper.java.additional.10=-XX:+UseParNewGC
wrapper.java.additional.11=-XX:NewRatio=10
wrapper.java.additional.12=-Djboss.platform.mbeanserver
wrapper.java.additional.13=-Dorg.eclipse.emf.ecore.EPackage.Registry.INSTANCE=org.eclipse.emf.ecore.impl.EPackageRegistryImpl
#Below parameter is added to support emptySessionPath in mod_jk connector
wrapper.java.additional.14=-Dorg.apache.catalina.connector.Request.SESSION_ID_CHECK=true
#Below parameter is added to support acceptCount in JBoss EAP
wrapper.java.additional.15=-Dorg.apache.tomcat.util.net.WAITFORWORKER=true
wrapper.java.additional.16=-Dorg.jboss.resolver.warning=true
wrapper.java.additional.17=-Djboss.modules.system.pkgs=org.jboss.byteman,org.aspectj
wrapper.java.additional.18=-Djava.awt.headless=true
wrapper.java.additional.19=-Dorg.jboss.boot.log.file=..\standalone\log\boot.log
wrapper.java.additional.20=-Dlogging.configuration=file:..\standalone\configuration\logging.properties
wrapper.java.additional.21=-Dorg.jboss.logmanager.nocolor=true
wrapper.java.additional.22=-Djava.ext.dirs=..\jdk\jre\lib\ext;..\modules\org\aspectj\main
wrapper.java.additional.23=-javaagent:..\modules\org\aspectj\main\aspectjweaver-1.8.9.jar
wrapper.java.additional.24=-Dorg.aspectj.tracing.enabled=false
wrapper.java.additional.25=-Dorg.aspectj.tracing.factory=default
wrapper.java.additional.26=-Dorg.apache.activemq.SERIALIZABLE_PACKAGES=*
wrapper.java.additional.27=-XX:+PrintGCDetails
wrapper.java.additional.28=-XX:+PrintGCTimeStamps
wrapper.java.additional.29=-Xloggc:C://xxxx_gc.log
wrapper.java.additional.30=-XX:PermSize=512m
wrapper.java.additional.31=-XX:ReservedCodeCacheSize=128m
wrapper.java.additional.32=-XX:+CMSClassUnloadingEnabled
wrapper.java.additional.33=-XX:+UseConcMarkSweepGC
wrapper.java.additional.34=-XX:CMSInitiatingOccupancyFraction=85
wrapper.java.additional.35=-XX:+UseCMSInitiatingOccupancyOnly
wrapper.java.additional.36=-XX:+ExplicitGCInvokesConcurrent
wrapper.java.additional.37=-XX:CMSIncrementalSafetyFactor=20
wrapper.java.additional.38=-XX:+UseLargePages
wrapper.java.additional.39=-XX:-UseParallelGC
wrapper.java.additional.40=-XX:+CMSConcurrentMTEnabled
wrapper.java.additional.41=-XX:ConcGCThreads=4
wrapper.java.additional.42=-XX:ParallelGCThreads=12
wrapper.java.additional.43=-XX:MaxTenuringThreshold=10
wrapper.java.additional.44=-XX:InitialTenuringThreshold=10
So now I am trying to find the use of each parameter and if they deprecated or not.
Is there any documentation for this or anyone can hep me in this?

Here you have a great guide to what you need. There is A LOT of information, so you have to take a look and do some research, and here you have a list of properties.
Maybe all the parameters you need will not be available, but you can find the great part of them. Here is an advanced list, you can try to find more parameters.
As #apangin indicated here is a list of properties and their availability, or if they are deprecated, obsoleted or expired, version by version.
Finally, here is an Oracle guide.
Last but not least, if all of above is not enough, you can look here, where you can type and search what you need and even get a good example

In focframework were can I get a list of all properties supported in config.properties file, and how to add my own properties to be used in my own

I am developing a web application using the full stack framework focframework, and I want to know what are the properties that I can control in my config.properties file. Is there a doc for this?
I tried searching the doc but dodn't find anything
Obviously we can figure out some of then from the sample on GitHub by looking at the config.properties file:
jdbc.drivers=org.h2.Driver
jdbc.url=jdbc:h2:./myfocapplication_data_h2
jdbc.username=sa
jdbc.password=
gui.rtl=0
allowAddInsideComboBox=0
focWebServerClassName=com.focframework.sample.myfocapplication.MyFocAppWebServer
dataSourceClass=b01.focDataSourceDB.FocDataSource_DB
cloudStorageClass=com.focCloudStorage.FocCloudStorageS3
cloudStorageClass=com.foc.cloudStorage.FocCloudStorage_LocalDisc
devMode=1
unitDevMode=0
unitAllowed=1
log.dir=c:/01barmaja/log
log.ConsoleActive=1
log.fileActive=1
log.popupExceptionDialog=1
log.dbRequest=1
log.dbSelect=1
debug.showStatusColumn=0
log.debug=1
perf.active=0
Is there any hint on how to get all of them? And what if I want to add my own to be used in my code?

The ConfigInfo.java file is the one responsible of reading all the properties and storing them in variables. It is straight forward to understand and check the variables names and usage. Yet I agree that someone should work on the documentation and add these parameters.
To add your own without modifying the ConfigInfo.java you can simply use this method in the middle of your code.
String myProperty = ConfigInfo.getProperty("my.property.with.a.meanignful.name");

Generating BPEL files programmatically?

Is there a way to generate BPEL programmatically in Java?
I tried using the BPEL Eclipse Designer API to write this code:
Process process = null;
try {
Resource.Factory.Registry reg =Resource.Factory.Registry.INSTANCE;
Map<String, Object> m = reg.getExtensionToFactoryMap();
m.put("bpel", new BPELResourceFactoryImpl());//it works with XMLResourceFactoryImpl()
//create resource
URI uri =URI.createFileURI("myBPEL2.bpel");
ResourceSet rSet = new ResourceSetImpl();
Resource bpelResource = rSet.createResource(uri);
//create/populate process
process = BPELFactory.eINSTANCE.createProcess();
process.setName("myBPEL");
Sequence mySeq = BPELFactory.eINSTANCE.createSequence();
mySeq.setName("mainSequence");
process.setActivity(mySeq);
//save resource
bpelResource.getContents().add(process);
Map<String,String> map= new HashMap<String, String>();
map.put("bpel", "http://docs.oasis-open.org/wsbpel/2.0/process/executable");
map.put("tns", "http://matrix.bpelprocess");
map.put("xsd", "http://www.w3.org/2001/XMLSchema");
bpelResource.save(map);
}
catch (Exception e) {
e.printStackTrace();
}
}
but I received an error:
INamespaceMap cannot be attached to an eObject ...
I read this message by Simon:
I understand that using the BPEL model outside of eclipse might be desirable, but it was never intended by us. Thus, this isn't supported
Is there any other API that can help?

You might want to give JAXB a try. It helps you to transform the official BPEL XSD into Java classes. You use those classes to construct your BPEL document and output it.

I had exactly the same problem with the BPELUnit [1], so I started a module in BPELUnit that has the first things necessary for generating and reading BPEL Models [2] although it is far from complete. Supported is only BPEL 2.0 (1.1 will follow later) and handlers are also currently not supported (but will be added). It is under active development because BPELUnit's code coverage component will be based on it so it will get BPEL-feature complete over time. You are happily invited to contribute if you need to close gaps earlier.
You can check it out from GitHub or grap the Maven artifact.
As of now there is no documentation but you can have a look at the JUnit tests that read and write processes.
If this is not suitable for, I'd like to share some experiences with you:
Do not use JAXB: You will need to read and write XML Namespaces which are not preserved with JAXB. That's why I have chosen XMLBeans. DOM would be the other alternative that I can think of.
The inheritance in the XML Schema is not really developer friendly. That's why there are own interface structures and wrappers around the XMLBeans generated classes.
Daniel
[1] http://www.bpelunit.net
[2] https://github.com/bpelunit/bpelunit/tree/master/net.bpelunit.model.bpel

This has been solved using the unify framework API after adding the necessary classes to handle correlation. BPELUnit stated by #Daniel seems to be another alternative.

The Eclipse BPEL API is based on an EMF Model. So you could generate your own artifacts using JET or Xpand based on that. This way there is no requirement to run inside Eclipse.
Although you may can't use BPEL outside of Eclipse, have you considered moving parts of your application inside it?
The BPEL XML Schemas are listed in the appendig of the spec. So you could also base your work on that and integrate with existing BPEL applications where necessary.

In case anyone is looking to solve the above problem while still running inside eclipse environment.
The problem can be resolved as stated by Luca Pino here by adding:
AdapterRegistry.INSTANCE.registerAdapterFactory( BPELPackage.eINSTANCE, BasicBPELAdapterFactory.INSTANCE );
before the resource creation line i.e.
Resource bpelResource = rSet.createResource(uri);
Note: Another solution, to the same problem, also stating how to resolve the dependencies to make this code work, can be found in my other answer here.

log forging fortify fix

I am using Fortify SCA to find the security issues in my application (as a university homework). I have encountered some 'Log Forging' issues which I am not able to get rid off.
Basically, I log some values that come as user input from a web interface:
logger.warn("current id not valid - " + bean.getRecordId()));
and Fortify reports this as a log forging issue, because the getRecordId() returns an user input.
I have followed this article, and I am replacing the 'new line' with space, but the issue is still reported
logger.warn("current id not valid - " + Util.replaceNewLine(bean.getRecordId()));
Can anyone suggest a way to fix this issue?

I know this was already answered, but I thought an example would be nice :)
<?xml version="1.0" encoding="UTF-8"?>
<RulePack xmlns="xmlns://www.fortifysoftware.com/schema/rules">
<RulePackID>D82118B1-BBAE-4047-9066-5FC821E16456</RulePackID>
<SKU>SKU-Validated-Log-Forging</SKU>
<Name><![CDATA[Validated-Log-Forging]]></Name>
<Version>1.0</Version>
<Description><![CDATA[Validated-Log-Forging]]></Description>
<Rules version="3.14">
<RuleDefinitions>
<DataflowCleanseRule formatVersion="3.14" language="java">
<RuleID>DDAB5D73-8CF6-45E0-888C-EEEFBEFF2CD5</RuleID>
<TaintFlags>+VALIDATED_LOG_FORGING</TaintFlags>
<FunctionIdentifier>
<NamespaceName>
<Pattern/>
</NamespaceName>
<ClassName>
<Pattern>Util</Pattern>
</ClassName>
<FunctionName>
<Pattern>replaceNewLine</Pattern>
</FunctionName>
<ApplyTo implements="true" overrides="true" extends="true"/>
</FunctionIdentifier>
<OutArguments>return</OutArguments>
</DataflowCleanseRule>
</RuleDefinitions>
</Rules>
</RulePack>

Alina, I'm actually the author of the article you used to solve your log injection issue. Hope it was helpful.
Vitaly is correct with regards to Fortify. You'll need to build what Fortify calls a "custom rule".
It will likely be a dataflow cleanse rule. A basic example can be found here: http://www.cigital.com/newsletter/2009-11-tips.php. If you own Fortify, there should be a custom rule writing guide in your product documentation.
I don't know what the taint flag you'll use is, but it would look something like "-LOG_FORGING". You would essentially write a rule to remove the log forging "taint" whenever data is passed through your utility method. Fortify will them assume that any data passed through there is now safe to be written to a log, and will not cause log forging.

You need to mark your replaceNewLine as sanitiser in Fortify (if I remember correctly) and it will stop reporting the issue.

You can actually create a new rule from a particular method.
Navigate to the function on the right side of audit workbench after you've done a scan.
Find your sanitizing method and right click on it.
You can generate a rule from it. What you want is a general DataflowCleanseRule.
I just did this based on the xml someone posted above. You can save the rule as a .xml file.
When updating your scan you can pass the -rule argument and point at the .xml file.

Restlet : Unable to find a converter for this representation : [application/json,UTF-8]

I have researched this quite heavily but have been unable to find a solution. I have created the simplest unit test to fetch a single entity but am still receiving the "Unable to find converter" exception. I have included the org.restlet.ext.servlet.jar,org.json.jar and org.restlet.ext.net.jar in my class path. I am also able to see the json returned and have been able to print using the cr.get(MediaType.APPLICATION_JSON) method.
ClientResource cr = new ClientResource("http://localhost:8888/r/establishment/29");
Establishment est = cr.get(Establishment.class);
System.out.println("Establishment name is " + est.getName());
I am using restlet-gae-2.1rc6 on GAE vs 1.7.1

You need to register a converter. Example:
Engine.getInstance().getRegisteredConverters().add(new JacksonConverter());
See a question with the same solution but a different problem: Android to gae restlet example doesn't work on the Android side
I found the solution here: https://stackoverflow.com/a/5205993/435605