Flex Time

It looks like I’ll be doing Flex RIA development, which I’m really looking forward to. Right now I need to tuck away a few links for further study…

Cairngen - for generating the basics for a Cairngorm Flex app:
http://code.google.com/p/cairngen/wiki/GettingStarted

Paul Williams - a series of blog posts on presentation tier design patterns with an eye to Flex:
http://weblogs.macromedia.com/paulw/

dpUint - Flex unit testing framework with async testing support baked-in:
http://code.google.com/p/dpuint/wiki/Introduction

Prana - an IoC for Flex… useful with Cairngorm:
http://www.herrodius.com/blog/64

Steven Weber very good introduction to Cairngorm:
http://www.adobe.com/devnet/flex/articles/cairngorm_pt1.html

Bruce Eckel articles on Artima:
http://www.artima.com/weblogs/viewpost.jsp?thread=212818
http://www.artima.com/weblogs/viewpost.jsp?thread=230610

And Getting Started with Flex at Adobe:
http://learn.adobe.com/wiki/display/Flex/Getting+Started

Preventing XSS from entering your database

I had all of our data being html-escaped as it was rendered to the page, but the problem is that other systems interact with ours — we send data to web analytics systems and to SalesForce.com. In that case you can’t count on escaping entities on display — you need to catch it on the way into your database.

I found a few sites with some fixes, though most were still focused on cleaning the data on display. I ended up taking Rick’s plugin and applying it at save time in the model object. I’m not sure it’s the cleanest — I’d almost certainly say there is a more elegant way to do this — but this was quick and works great.

It’s still basically designed to be used at output time:

<%= white_list @article.body %>

But instead I include the helper directly to a model and overwrite the attribute setters:


class Contact < ActiveRecord::Base

include WhiteListHelper

def name=(text) write_attribute(:name, white_list(text)) end

end

I tried setting up a before_filter and stepping through the param[] object, but my data was fairly simple and the above was dead easy.