Develop Reference

Reading System Properties in Web.XML

in order to access global values stored in the file src/resources/settings.properties from web.xml on a JBoss EAP 7 Server, I implemented the following class from a similar Stack Overflow topic:
public class ConfigurationWebFilter implements ServletContextListener {
protected static final Properties properties = new Properties();
#Override
public void contextInitialized(final ServletContextEvent event){
try {
try (InputStream stream = new FileInputStream("/settings.properties")) {
properties.load(stream);
}
for (String prop : properties.stringPropertyNames())
{
if (System.getProperty(prop) == null)
{
System.setProperty(prop, properties.getProperty(prop));
}
}
} catch (IOException ex) {
logger.error("Failed loading settings from configuration file for web.xml", ex);
}
}
}
Then I added the according listener to web.xml:
<listener>
<listener-class>
com.product.util.ConfigurationWebFilter
</listener-class>
</listener>
The code gets called properly and I can verify by debugging that the system variables get set correctly. However, the properties of my web.xml do not seem to be replaced/interpreted. The following parameter does still evaluate to ${serverName}, even after restarting the server and/or republishing:
<filter>
<filter-name>CAS Authentication Filter</filter-name>
<filter-class>(...)</filter-class>
<init-param>
<param-name>serverName</param-name>
<param-value>${serverName}</param-value>
</init-param>
</filter>
All the other topics on this issue were of no use because no solution worked for me. How can I replace web.xml parameters by values stored in a properties file?

Works now, I had to set a parameter related to the replacement of variables to true (was false) in the Wildfly standalone.xml.

Spring single page for every url route and subroute "/a/** => /a/index.html except /a/static/**"

I'm building spring website that has react single page app under subroute and my current url structure should look like
localhost/admin/** => react app
localhost/** => spring thymeleaf/rest/websocket app for everything else
react app mapping:
localhost/admin/static/** => static react files
localhost/admin/** => react index.html for everything else
Example of project resources structure:
resources/
admin/ <= my admin react files is here
index.html
static/ <= react css, js, statics
templates/ <= thymeleaf templates
static/ <= theamleaf static
...
So i need to forward react index.html file for every url route and its subroutes. Basically single page app for everything except static files
Looks like a common task, and here is some things i have already tried:
Full working demo of project spring + react + how gradle builds project and why i can't put react files in different directory (/resources/static for example): https://github.com/varren/spring-react-example
Can't use forward:/admin/index.html for /admin/** because this will create recursion because admin/index.html is also under admin/** and have to intercept admin/static/** somehow.
Can't use addResourceHandlers in WebMvcConfigurerAdapter
#Override
public void addResourceHandlers(ResourceHandlerRegistry registry) {
registry.addResourceHandler("/admin/**")
.addResourceLocations("classpath:/admin/");
}
index.html mapped only to /admin/index.html url, and this option almost works but only if you access the react app from localhost/admin/index.html
Saw this and this and this and many other links and i also have kinda solution, but maybe there is generic option i just can't see

Right now i'm using custom ResourceResolver to solve this
Demo: https://github.com/varren/spring-react-example
#Configuration
public class BaseWebMvcConfigurerAdapter extends WebMvcConfigurerAdapter {
#Override
public void addResourceHandlers(ResourceHandlerRegistry registry) {
ResourceResolver resolver = new AdminResourceResolver();
registry.addResourceHandler("/admin/**")
.resourceChain(false)
.addResolver(resolver);
registry.addResourceHandler("/admin/")
.resourceChain(false)
.addResolver(resolver);
}
private class AdminResourceResolver implements ResourceResolver {
private Resource index = new ClassPathResource("/admin/index.html");
#Override
public Resource resolveResource(HttpServletRequest request, String requestPath, List<? extends Resource> locations, ResourceResolverChain chain) {
return resolve(requestPath, locations);
}
#Override
public String resolveUrlPath(String resourcePath, List<? extends Resource> locations, ResourceResolverChain chain) {
Resource resolvedResource = resolve(resourcePath, locations);
if (resolvedResource == null) {
return null;
}
try {
return resolvedResource.getURL().toString();
} catch (IOException e) {
return resolvedResource.getFilename();
}
}
private Resource resolve(String requestPath, List<? extends Resource> locations) {
if(requestPath == null) return null;
if (!requestPath.startsWith("static")) {
return index;
}else{
return new ClassPathResource("/admin/" + requestPath);
}
}
}
}

How to run WebSockets with Spark Framework via Tomcat?

I've taken an Example from https://sparktutorials.github.io/2015/11/08/spark-websocket-chat.html and want to deploy it as war to Tomcat to run it on web server. I've found several examples with basic request (like get, for Ex.) but such way doesn't work with web sockets.
public class Chat implements SparkApplication{
static Map<Session, String> userUsernameMap = new HashMap<>();
static int nextUserNumber = 1; //Used for creating the next username
public static void main(String[] args) {
new Chat().init();
}
//Sends a message from one user to all users, along with a list of current usernames
public static void broadcastMessage(String sender, String message) {
userUsernameMap.keySet().stream().filter(Session::isOpen).forEach(session -> {
try {
session.getRemote().sendString(String.valueOf(new JSONObject()
.put("userMessage", createHtmlMessageFromSender(sender, message))
.put("userlist", userUsernameMap.values())
));
} catch (Exception e) {
e.printStackTrace();
}
});
}
//Builds a HTML element with a sender-name, a message, and a timestamp,
private static String createHtmlMessageFromSender(String sender, String message) {
return article().with(
b(sender + " says:"),
p(message),
span().withClass("timestamp").withText(new SimpleDateFormat("HH:mm:ss").format(new Date()))
).render();
}
#Override
public void init() {
String route = "/chat";
webSocket(route, ChatWebSocketHandler.class);
}
}
When I run it I get
org.apache.catalina.core.StandardContext.filterStart Exception starting filter SparkFilter
java.lang.IllegalStateException: WebSockets are only supported in the embedded server
at line webSocket(route, ChatWebSocketHandler.class); in void init() method.
If smth depends on my web.xml (i've not changed it), the list is here:
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<display-name>Messenger</display-name>
<filter>
<filter-name>SparkFilter</filter-name>
<filter-class>spark.servlet.SparkFilter</filter-class>
<init-param>
<param-name>applicationClass</param-name>
<param-value>com.barbarian.messenger.Chat</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>SparkFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
If I put new SparkFilter(); before that line (just tried) I got
org.apache.catalina.core.StandardContext.filterStart Exception starting filter SparkFilter
java.lang.IllegalStateException: WebSockets are only supported in the embedded server
at the same line.
Does anybody have ideas of valid running it?

Based on the documentation (at least the current one):
WebSockets only works with the embedded Jetty server, and must be defined before regular HTTP routes......
http://sparkjava.com/documentation.html#websockets
Which is why you do not see any servlet config in web.xml in the sample code (https://github.com/tipsy/spark-websocket) since the embedded Jetty container can be run directly in the main method. Also it uses the org.eclipse.jetty.websocket.api.* package for websocket implementation.
If you need websocket to be run on Tomcat, you might want to consider using WebSocketServlet implementation in catalina package. I've found sample codes here (even though I haven't tested it yet): https://gist.github.com/chitan/3063774. Hope this helps.

Custom Annotation JSF

I wanted to make a custom annotation to check security on some functions for my JSF web application. For security I use Tomcat security with JaaS, so I have no application managed security to my disposal.
What actually want to do is make an annotation for my methods in the Backing Beans like Spring Security (#Secured("role")). My security system is implemented so that every function is a role and you can dynamically make "user roles" these are stored in the DB and when somebody logs in all the (function)roles in that "user role" will be set in tomcat security as roles.
So now I have this piece of code to check if my user can access the function:
public static void checkSecurity(final String function) {
final FacesContext facesContext = FacesContext.getCurrentInstance();
try {
if (facesContext.getExternalContext().getRemoteUser() == null) {
facesContext.getExternalContext().redirect("login.xhtml");
return;
}
if (!facesContext.getExternalContext().isUserInRole(function)) {
facesContext.getExternalContext().redirect("restricted.xhtml");
return;
}
} catch (final Exception ex /* Mandatory "IOException e" will be caught + all other exceptions. */) {
facesContext.getExternalContext().setResponseStatus(403); // HTTP Status 403: Forbidden. Can also throw 401.
facesContext.responseComplete();
}
}
Now I have to call this SecurityUtil.checkSecurity("name_of_function"); in every method.
But I want to have an annotation like this #CustomSecurity("function_name_role").
#Target(ElementType.METHOD)
#Retention(RetentionPolicy.RUNTIME)
public #interface CustomSecurity {
// Single Element called value.
String value();
}
And when a method has this annotation the checkSecurity function automatically has to be performed. So I have to scan for this annotation at a point, or make some kind of actionlistener. JSF should have some options for this but all the forums I found on this don't really help.
Does somebody has some ideas?
EDIT:
I tried this blog it works but only on an action of a component (and components don't render when you don't have the role). So how secure is this when people try to hack into the JSF structure. And I rather have it running on every method.
public class SecurityActionListener extends ActionListenerImpl implements ActionListener {
private static final Logger LOGGER = FacesLogger.APPLICATION.getLogger();
#SuppressWarnings("unused")
#Override
public void processAction(final ActionEvent event) {
final FacesContext context = FacesContext.getCurrentInstance();
final Application application = context.getApplication();
final ConfigurableNavigationHandler navHandler = (ConfigurableNavigationHandler) application.getNavigationHandler();
// Action stuff
final UIComponent source = event.getComponent();
final ActionSource actionSource = (ActionSource) source;
MethodBinding binding;
binding = actionSource.getAction();
final String expr = binding.getExpressionString();
if (!expr.startsWith("#")) {
super.processAction(event);
return;
}
final int idx = expr.indexOf('.');
final String target = expr.substring(0, idx).substring(2);
final String t = expr.substring(idx + 1);
final String method = t.substring(0, (t.length() - 1));
final MethodExpression expression = new MethodExpressionMethodBindingAdapter(binding);
final ELContext elContext = context.getELContext();
final ExpressionFactory factory = context.getApplication().getExpressionFactory();
final ValueExpression ve = factory.createValueExpression(elContext, "#{" + target + '}', Object.class);
final Object result = ve.getValue(elContext);
// Check if the target method is a secured method
// and check security accordingly
final Method[] methods = result.getClass().getMethods();
for (final Method meth : methods) {
if (meth.getName().equals(method)) {
if (meth.isAnnotationPresent(CustomSecurity.class)) {
final CustomSecurity securityAnnotation = meth.getAnnotation(CustomSecurity.class);
System.out.println("Function to check security on: " + securityAnnotation.value()); // TODO TO LOG
SecurityUtil.checkSecurity(securityAnnotation.value());
} else {
super.processAction(event);
}
break;
}
}
}
}
And this in the faces-config.xml:
<action-listener>
com.nielsr.randompackagebecauseofnda.SecurityActionListener
</action-listener>
This blog could also be an answer, but I don't know how it will work with my JaaS Tomcat security because the security is in a separate project deployed as a standalone JAR in the tomcat lib folder.
But I actually don't know that I have to secure my Beans. Because I have configured all the functions (aka roles see above) that are on 1 page in the Web.xml as security constraints. And I render the components on the page only if you have to rights or "function_role" on that component. So is this secured enough? Or if somebody has a right to a function on a page can he render the components himself and so hack my site?
I'm not that familiar to JSF to know this, what is going on in that extra JSF abstraction layer between Controller and View? (I'm more of a Spring MVC developer, but because of requirements I have to use JSF but it's nice to broaden my knowledge.)

You can "scan for your Annotations" using
http://code.google.com/p/reflections/
Regards

Object suddenly missing from HttpServletRequest

I print a list directly in the servlet using the print writer and the list prints.
When I try to put in the jsp however the list doesn't print whether I use JSTL or scriptlets.
I tried to test in JSTL and scriptlet if the object is null and turns out that it is!
Why does this happen and how can I fix this?
Servlet code that works
for (Artist artist:artists){
resp.getWriter().println(artist.getName());
}
Servlet code that puts object in the request
public void doGet(HttpServletRequest req, HttpServletResponse resp)
throws IOException {
ApplicationContext ctx =
new ClassPathXmlApplicationContext("com/helloworld/beans/helloworld-context.xml");
ArtistDao artistDao = (ArtistDao) ctx.getBean("artistDao");
List<Artist> artists = null;
try {
artists = artistDao.getAll();
} catch (SQLException e) {
e.printStackTrace();
}
req.setAttribute("artists", artists);
try {
req.getRequestDispatcher("index.jsp").forward(req, resp);
} catch (ServletException e) {
e.printStackTrace();
}
scriptlet code that suddenly finds the object null
<%
List<Artist> artists = (List<Artist>) request.getAttribute("artists");
if (artists == null) {
out.println("artists null");
}
else {
for (Artist artist: artists){
out.println(artist.getName());
}
}
%>
Even the jstl code seems to agree
<c:if test="${artists eq null}">
Artists are null
</c:if>
<c:forEach var="artist" items="${artists}">
${artist.name}
</c:forEach>
For my app I am using weblogic, spring 2.5.6 and ibatis.

I think it depends on the web server. But without changing your previous directory structure,
try putting the list in session like this
req.getSession(false).setAttribute("artists", artists);
and in your jsp,
write
List<Artist> artists = (List<Artist>) request.getSession(false).getAttribute("artists");
I think my approach will work for all web servers.

Maybe the app server is resetting your request object. You can work around this by creating a new request object, that wraps your original request, and pass that to the reqest dispatcher.
e.g.
MyHttpRequest myRequest = new MyHttpRequest(req);
myRequest.setAttribute(...);
req.getRequestDispatcher("index.jsp").forward(myRequest, resp);
And the MyHttpReqest code:
class MyHttpRequest extends HttpServletRequestWrapper
{
Map attributes = new HashMap();
MyHttpRequest(HttpRequest original) {
super(original);
}
#Override
public void setAttribute(Object key, Object value) {
attributes.put(key, value);
}
public Object getAttribute(Object key) {
Object value = attributes.get(key);
if (value==null)
value = super.getAttribute(key);
return value;
}
// similar for removeAttribute
}

I just discovered inadvertently while trying to fix my directory structure in WebContent/
My previous directory structure was
WEB-CONTENT/
- META-INF/
- WEB-INF/
index.jsp
Then I tried to create a folder jsp in WEB-CONTENT and placed index.jsp there. It works!
My current directory structure now is
WEB-CONTENT/
- META-INF/
- WEB-INF/
- jsp/
-index.jsp
I don't know why it works but it did.
Anyone here with any idea why?