Develop Reference

SimpleFormatter dd.mm.yyyy HH:mm:ss

I want to change the way my log looks (java.util.logging.Logger) and I found this:
System.setProperty("java.util.logging.SimpleFormatter.format","[%1$tF %1$tT] [%4$-7s] %5$s %n");
So my log entries look now like this:
[2017-08-24 15:55:40] [INFORMATION] Hello World!
I'd like to set the format to following:
[24.08.2017 15:55:40]
I've been trying for so long, shouldn't be that hard. Can anybody help me or sending me some good and easy documentations/examples?

From documentation Class Formatter
Instead of :
[%1$tF %1$tT]
You can use :
[%1$te.%1$tm.%1$tY %1$tT]
You can see the result in this example :
Calendar c = Calendar.getInstance();
String example = String.format("[%1$te.%1$tm.%1$tY %1$tT]", c);
System.out.println(example);
Output
[24.08.2017 15:19:30]

I've been trying for so long, shouldn't be that hard.
SimpleFormatter.format is a static property that is set at class loading time. You can only use System.setProperty to change the format if that is done before the java.util.logging.SimpleFormatter class is loaded. Instead you should modify your logging.properties or modify your startup script to set the property during the JVM startup.
If there is an error in your format the behavior is to just use a default format. This makes it hard to debug because you can't tell the difference between an error or just not setting the property correctly.
Your best bet is to use a test program like YCF_L made and then apply the format to the startup script.

Error when using Esapi validation

I hope someone could help me with some issue.
I'm using OWASP ESAPI 2.1.0 with JavaEE, to help me to validate some entries in a web application. At some point I needed to validate a Windows file path, so I added a new property entry in the 'validation.properties' like this one:
Validator.PathFile=^([a-zA-Z]:)?(\\\\[\\w. -]+)+$
When I try to validate, for example, a string like "C:\TEMP\file.txt" via ESAPI, I get a ValidationException:
ESAPI.validator().getValidInput("PathFile", "C:\\TEMP\\file.txt", "PathFile", 100, false);
Alternatively, I also tried the java.util.regex.Pattern class to test the same regular expression with the same string example and it works OK:
Pattern.matches("^([a-zA-Z]:)?(\\\\[\\w. -]+)+$", "C:\\TEMP\\file.txt")
I must say that I added other regex in 'validation.properties' and worked OK. Why this one is so hard? Could anyone help me out with this one?

This is happening because the call to validator().getValidInput("PathFile", "C:\\TEMP\\file.txt", "PathFile", 100, false); wraps a call to ESAPI.encoder().canonicalize() that is transforming the input to the char sequence (Not literal String!) C:TEMP'0x0C'ile.txt before it passes to the regex engine.
Except for the second "\" getting converted to the char 0x0c this is normally desired behavior. That could be a bug in ESAPI.
What you want, is to make a call to ESAPI.validator().getValidDirectoryPath()

Strange OGNL behaviour when using #this in s:select

Consider the following where availableExclusions is an array of Date objects.
<s:select listValue="(new java.text.SimpleDateFormat('MM/dd/yyyy')).format(new java.util.Date(#this[0].time))" size="25" id="inputExclusionDates" name="available" list="availableExclusions" multiple="true" cssClass="multi-select" />
I created the above in response to this question How would I format a list of dates within a struts 2 select tag? (and I also recommended that the other solution may be the better way to go). Regardless if using such long OGNL expression is a good idea or not, I can't see the need for: new java.util.Date(#this[0].time) despite creating that fragment out of frustration and to my surprise found it worked where the seemingly equivalent #this[0] did not (produced no output).
If we substitute in listValue="#this[0].class" we see what we would expect: class java.util.Date
Creating a new Date behaves as expected, and calling the deprecated properties of Date such as listValue="#this[0].day" produces the expected output.
Why must I use the redundant expression new java.util.Date(#this[0].time) instead of #this[0] in this select statement?
Using Struts 2.3.1.2

Because #this[0] is automatically converted to String. If you turn log level to debug you can see an exception message that's normally suppressed.

Velocity - How to avoid ParseErrorException when using jQuery?

I'm trying to add a jQuery post to some JavaScript on a web page. The entire page is built up of several Velocity templates. Everything has been fine until I've tried to add the jQuery post, now I get:
org.apache.velocity.exception.ParseErrorException: Encountered "," at line 282, column 24 of /WEB-INF/velocity/www/comments.vm
Was expecting one of:
"(" ...
<RPAREN> ...
<ESCAPE_DIRECTIVE> ...
~~~snip~~~
Line 282 is $.post(... and column 24 appears to be the first "," character. Initially I had the JSON on this line, but I moved it up (to the var myJSONObject ... line)as I thought the error related to invalid JSON (tabs at the start of the line gave a misleading column number).
var myJSONObject = {"body": "", "action": "postcomment", "submitted": "true", "ajax": "true"};
myJSONObject.body = $("body").val();
$.post("$!{articleurl}", myJSONObject, function(result){
btn.textContent='Comment sent successfully.';
});
Minor Update
I changed the following lines:
var url = "$articleurl";
$.post(url, myJSONObject, function(result){
~~~snip~~~
The parse exception still focuses on the first ",". I'm assuming the issue is that Velocity thinks it should be able to resolve $.post - when in fact, it's jQuery. I've used jQuery in other Velocity VM templates without any problem. Is there a way to get Velocity to ignore certain lines / statements when parsing?
Update 2
I found this link about escaping references in Velocity, but it does not resolve my issue. Adding a "\" before $.post gives me the exact same error, but the column is one extra, because of the character added at the start of the line.

You can wrap your javascript with #[[ ... ]]# which tells Velocity to not parse the enclosed block (new in Velocity 1.7)
#[[
<script>
...
</script>
]]#

Ok, there appears to be two solutions for this:
First, with jQuery we can just avoid using the global alias $ and instead use the jQuery object directly:
jQuery.post(url, myJSONObject, function(result){
~~~snip~~~
In my case, the above works great. But I suspect in other scenarios (non-jQuery) this may not be possible. In which case, we can 'hide' our character within a valid Velocity reference like this:
#set( $D = '$' )
${D}
Source: http://velocity.apache.org/engine/devel/user-guide.html#escapinginvalidvtlreferences
I'd still like to know why the backslash escape didn't work, but the above will at least get me moving again. :)

I think this is a bug in version 1.6.x, because it works fine in 1.7(If it did not, please tell me, I test it many times..), according to the reference, the $ takes effect only when it is followed by a-zA-Z. I want to try do debug what happened really, but the translation code is generated by Java CC tool, it is too hard to recognize the logic...

you must create a js file with your javascript code
and import your js file into your vm code

I couldn't get it to work with any of the other fixes like escaping "$" in velocity unfortunately. I got it working by loading an external js-file with the jQuery instead of writing jQuery directly in velocity. Worked out for me at least, hope it helps someone :)
/björn

Parsing a String representation of XML

From a String like
<TestData Identifier=\"Test\" requiredAttribute=\"Present\"></TestData> <TestData Identifier=\"Test1\" requiredAttribute=\"Present1\"></TestData> <TestData Identifier=\"Test2\" requiredAttribute=\"Present2\"></TestData> <TestData Identifier=\"Test3\" requiredAttribute=\"Present3\"></TestData>
whats the best way to get the values of the attributes requiredAttribute i.e (Present,Present1,Present2...)

You can look into JAXB unmarshalling. Check out this page for more details, it should point to what you need
http://jaxb.java.net/tutorial/section_3_1-Unmarshalling-and-Using-the-Data.html#Unmarshalling and Using the Data

For basic XML parsing like this, I've found NanoXML # http://nanoxml.cyberelf.be/ to be about the easiest and mostlightweight.
Working with XML in Java send you down a long road to pain if you start using all the other libraries.

That's not XML - but you could do it with regex or by converting it to XML and parsing it out. The latter is probably more expensive. It depends on what the actual test data is and your requirements for it.