Dangerous samples

OI !

w3.org and comments

Can we (miss) USE this somehow ?

Generated from data/head-home.php, ../../smarty/{head.tpl} 
 Generated from data/mast-home.php, ../../smarty/{mast.tpl} 
 #w3c_mast / Page top header 
 w3c_sec_nav is populated through js 
 
 Main navigation menu 
 /end #w3c_mast 
 
 
 
 
 
 
 
 
 end events talks 
 end main content 

    <div id="w3c_home_video">
      <h2 class="category">
        <a href="/participate/podcastsvideo">Featured Video
            <img src="/2008/site/images/header-link.gif" alt="Header link" width
="13" height="13" class="header-link"/>
        </a>
      </h2>
      <p>Here</p>
    </div>
    
 end main col 
 Generated from data/footer.php, ../../smarty/{footer-block.tpl} 
 #footer address / page signature 
 /end #footer 
 Generated from data/scripts.php, ../../smarty/{scripts.tpl} 

Processing.js

great library but:

//Can you simplify this ?
if (obj === null || other === null) {
      return (obj === null) && (other === null);

//.. do I need braces ? Throwing Strings ? Not good for onerror handlers... 
throw ("XMLHttpRequest failed, status code " + xhr.status);

// try to count number of "this." in minimized version ;-(
 
// how many times will you call the same functionn in one line....
a.charAt(0) === "(" || a.charAt(0) === "[") return a.charAt(0)

//loops; could be even shorter right ? (++ vs. --)
a = 0;
for (c = h.length; a < c; ++a) h[a].owner = this;

//could you be more verbose ?
//hardly !
DrawingShared.prototype.vertex = function() {
      var vert = [];

      if (firstVert) { firstVert = false; }

      if (arguments.length === 4) { //x, y, u, v
        vert[0] = arguments[0];
        vert[1] = arguments[1];
        vert[2] = 0;
        vert[3] = arguments[2];
        vert[4] = arguments[3];
      } else { // x, y, z, u, v
        vert[0] = arguments[0];
        vert[1] = arguments[1];
        vert[2] = arguments[2] || 0;
        vert[3] = arguments[3] || 0;
        vert[4] = arguments[4] || 0;
      }

      vert["isVert"] = true;

      return vert;
    };

etc..etc...

TODO: will be continued

Client side XSS: document.write(location.href)

Is this safe ?
(C) www.orace.com

if (USER.guid) {
    document.write('Welcome ' + USER.firstname + ' ( <a class=profile href=https://myprofile.oracle.com/EndUser/faces/profile/sso/updateUser.jspx?nextURL=' + location.href + '\>' + 'Account' + '<\/a> | <a class=profile href=/us/corporate/contact/about-your-account-070507.html>' + 'Help' + '<\/a> | <a class=profile href=javascript:sso_sign_out();>' + 'Sign Out' + '<\/a> )');
}
else {
    document.write('<span class=profile>( ' + ' <a href=http://www.oracle.com/webapps/redirect/signon?nexturl=' + location.href + '>Sign In/Register for Account</a> ' + ' <span style=color: rgb(0, 0, 0)>|</span> ' + '<a href=/us/corporate/contact/about-your-account-070507.html>Help</a>' + ' )</span>');
}

UPDATE: 16.6.2011
Somehow they decided to fix it ? based on this article ? I dont believe so, if yes please next time give some credits by comment ;-)

if (USER.guid) {
    document.write('Welcome ' + USER.firstname + ' ( <a class=profile href=https://myprofile.oracle.com/EndUser/faces/profile/sso/updateUser.jspx?nextURL=' + encodeURI(location.href) + '\>' + 'Account' + '<\/a> | <a class=profile href=/us/corporate/contact/about-your-account-070507.html>' + 'Help' + '<\/a> | <a class=profile href=javascript:sso_sign_out();>' + 'Sign Out' + '<\/a> )');
}
else {
    document.write('<span class=profile>( ' + ' <a href=http://www.oracle.com/webapps/redirect/signon?nexturl=' + encodeURI(location.href) + '>Sign In/Register for Account</a> ' + ' <span style=color: rgb(0, 0, 0)>|</span> ' + '<a href=/us/corporate/contact/about-your-account-070507.html>Help</a>' + ' )</span>');
}

Any ideas now ?

Customize your Modernizr download (errors on page)

I have tried this web site today and have run ito "lame code" controlling the
checkboxes to customize download:
http://modernizr.github.com/Modernizr/2.0-beta/

 $("a.toggle-group").live('click', function() {
    var group = $(this).closest(".features");
    var checkbox = $(group).find(':checkbox');
    checkbox.each(function(){
      $(this).attr('checked', !$(this).is(':checked'));
    });
    event.preventDefault();
  });

Please fix otherwise we will end with errors like:
Error: event is not defined

Source File: http://modernizr.github.com/Modernizr/2.0-beta/#
Line: 173

Yes, Troy McClure have read WCAG ;-)

http://www.w3.org/TR/2010/NOTE-WCAG20-TECHS-20101014/C30
...............
The objective of this technique is to demonstrate how CSS can be used to replace structured HTML text with images of text in a way that makes it possible for users to view content according to their preferences. To use this technique, an author starts by creating an HTML page that uses semantic elements to mark up the structure of the page. The author then designs two or more stylesheets for that page. One stylesheet presents the HTML text as text and the second uses CSS features to replace some of the HTML text with images of text.
.......
Where possible, authors should deliver the presentation that does not include images of text as the default presentation. In addition, the control used to switch should be located near the beginning of the page.
-------------------
keep reading samples and:
The CSS for the presentation that includes images of text follows. Note that the CSS uses positioning to place the contents of the heading elements offscreen so that the text remains available to screen reader users.


-------------------
P.S: Troy McClure: "He was a star in the early 1970s, but his career went downhill:..... I'm younger does not fit.
P.P.S: Sorry for quoting newer version 2. I know w3 does not like to promote it very much ;-)))

A better(????) way to author alternate text The real function of alternate text

I have read this
http://xstandard.com/en/articles/better-alt/
since it apeared in my twitter few days ago.

Pure bullshit ! Sorry folks. Image should be used for "Content"
and ALT should really represent content, so it SHOULD describe what is on the image.

For "trick" like heart image, button image etc...

we are talking about

alternate graphical representation for text
not alternate text representation of graphical image content.


So it is all wrong from the begining
from the very markup point of view.

Use any reasonable tag to encapsulate text and style it using CSS.
It can be ABBR if you text contains shortened form like heart pictogram,
or use A HREF if you want to link as well, STRONG,
or use SPAN in the worst case.


Antisable:

save the document by pressing <img alt="save button">

Better:

save the document by pressing <span class="img-as-text save-btn">save button</span>.


heart example would look like:

Is eval evil ?


var tact = (eval("args.S_TACT") == undefined ? "" : "S_TACT=" + eval("args.S_TACT"));


In this case it is really evil, and dangerous !
specially if args is "somehow built" from document.URL

For those interested: code comes from big blue web site.

ssajax.js

This computer program contains valuable, confidential and proprietary
information.


IsUndefined = function (obj) { return (typeof obj == 'undefined'); }
IsNull = function (obj) { return (obj == null); }
IsValid = function (obj) { return (!IsNull(obj) && !IsUndefined(obj)); }


Sad but true

More "valuable" code can be found here:
http://www........com/ocom/resources/sitestudio/ssajax/ssajax.js

Beware, my lovely specs

SRV.2.3.2 Initialization
After the servlet object is instantiated, the container must initialize the servlet before
it can handle requests from clients. Initialization is provided so that a servlet can
read persistent configuration data, initialize costly resources (such as JDBC API based
connections), and perform other one-time activities.

SRV.2.3.3.1 Multithreading Issues
A servlet container may send concurrent requests through the service method of
the servlet. To handle the requests, the Servlet Developer must make adequate provisions
for concurrent processing with multiple threads in the service method.
Although it is not recommended, an alternative for the Developer is to implement
the SingleThreadModel interface

EE.4.2.3Transactions and Threads
In web components not implementing SingleThreadModel,
transactional resource objects
should not be stored in class instance fields,
and should be acquired and released within the same invocation of the service method.

I do not understand what "initialize JDBC connection means" or the first suggestion is just excelent antisample ;-))

Can this be any worse ?

Can this be any worse ?


if (!Array.prototype.containsKey) {
Array.prototype.containsKey = function(srch) {
for ( var key in this ) {
if ( key.toLowerCase() == srch.toLowerCase() ) {
return true;
}
}
return false;
};
}
................
var getNamedEntity = function(input) {
var entity = '';
while (input.hasNext()) {
var c = input.peek();
if (c.match(/[A-Za-z]/)) {
entity += c;
input.next();
if (entityToCharacterMap.containsKey('&' + entity)) {
if (input.peek(';')) input.next();
break;
}
} else if (c == ';') {
input.next();
} else {
break;
}
}

return String.fromCharCode(entityToCharacterMap.getCaseInsensitive('&' + entity));
};
............
var entityToCharacterMap = [];
entityToCharacterMap["""] = "34"; /* 34 : quotation mark */
entityToCharacterMap["&"] = "38"; /* 38 : ampersand */
entityToCharacterMap["<"] = "60"; /* 60 : less-than sign */
entityToCharacterMap[">"] = "62"; /* 62 : greater-than sign */



Let's make contest ;-)
How many "bad practices" (cannot find other polite word)
can you "spot" in this code ?

Trinidad JavaScript

Trinidad JavaScript

In short ?
Bad,obsolete,space consuming,sub-optimal .... practices,
in the order discovered.....
judged by my average JS knowledge....

1. everything in global scope
   
2. using new Array()
   
3. var; var; var;
   
4. Browser detection (sniffing)


5. Useless chars eg: typeof (elem) == "string"
   
6. ... this makes no sence to continue.....
   

Shocking:

TrUIUtils.createCallback = function(thisObj, func) {
 // create a function that sets up "this" and delegates all of the parameters
 // to the passed in function
 var proxyFunction = new Function(var f=arguments.callee; return f._func.apply(f._owner, arguments);");

 // attach ourselves as "this" to the created function
 proxyFunction._owner = thisObj;

 // attach function to delegate to
 proxyFunction._func = func;

 return proxyFunction;
}

TrUIUtils._cssToJs = function(prop) {
 var jsProp = '';
 var upperNext = false;
 for (var c = 0; c < prop.length; c++) {
  if (prop.charAt(c) == '-') {
   upperNext = true;
   continue;
  }

  if (upperNext) {
   jsProp += prop.charAt(c).toUpperCase();
  }
  else {
   jsProp += prop.charAt(c);
  }

  upperNext = false;
 }
 return jsProp;
}

I had to stop after while... ... since this could be book of "JavaScript antisamples". I have no idea about the libs origin, they mention IE 4 versions, however Trinidad claim support to 6+, I belive a lot of code is "ported" from some other languages with little JS knowledge or care, or comes from aged libs written in the dark and deep web history. I have to quote Mr.D: http://javascript.crockford.com/style1.html

There are no good texts on JavaScript programming. Most of the people on the web who are producing JavaScript programs learned it by copying really bad examples from bad books, bad websites, and bad tools. We have an amazingly good community of JavaScript programmers here, but still we can benefit from better practice of style.

Antisample - Custom implementation of TextBoxWithLabelFor

Another, this time "almost dangerous" code from ISBN 978-1-933988-62-7 already mentioned


// helper code
public static string TextBoxWithLabelFor<TModel, TProperty>(
this HtmlHelper<TModel> htmlHelper,
Expression<Func<TModel, TProperty>> expression,
string label)
where TModel : class
{
string labelHtml =
string textboxHtml = htmlHelper.TextBoxFor(expression);
return labelHtml + "&nbsp;" + textboxHtml;
string.Format("<label for=\"{0}\">{1}:</label>",
ExpressionHelper.GetInputName(expression),
label); // !!!!!! ENCODING ???????
string textboxHtml = htmlHelper.TextBoxFor(expression);
return labelHtml + "&nbsp;" + textboxHtml;
}
// usage
<%= Html.TextBoxWithLabelFor (c => c.MaxAttendees, "Max Attendees")


Raw string, outputed to HTML Plane without encoding.
Today "the label" is constant typed in the view,
tomorrow it can be metadata obtained from other source,
some next day a user input....

Writing API should be responsible for encoding.....no assumtions about clients....
CWE-116: Improper Encoding or Escaping of Output

Anti-Sample of the day, bad sample variable, wasting time .....

This a sample from one of the MVC books I have been reading:


using System.Web.Mvc;
namespace ViewSamples.Controllers
{
public class ViewDataController : Controller
{
public ActionResult Index()
{
ViewData.Add("one", "onevalue");
ViewData.Add("two", "twovalue");
ViewData.Add("three","threevalue");
return View(3);
}
}
}

WTF the 3 stands for ? IS it somehow magically related to "three" or the collection size ?

Try matching signatures in msdn:

View(Object) Creates a ViewResult object using the model that renders a view to the response.

Then continue reading "the book":
Notice the values that are added in the controller in listing 4.6. We have three key/value
pairs and an object set to the Model property (by virtue of passing in “3” to the View
method).

Virtue ? "3" ?

Passing some reasonable OBJECT as Model insted of magical autoboxing small int with coincidental value 3, would be bit easier to understand....

Anti-sample Of The Day - Msxml3.XMLHTTP

http://www.quirksmode.org/js/xmlhttp.html

We have been reviewing different frameworks to see how they use MSXML progids - different versions of MSXML parser and XMLHTTP.
Look at this one:

Msxml3.XMLHTTP

Shame, the sample comes from PPKs highly credited web site http://www.quirksmode.org/js/xmlhttp.html
and if you google a bit you will see how this incorrect version is spread wide (copy-pase development ?).

This is MS XmlTeam suggestion using-the-right-version-of-msxml-in-internet-explorer(from 2006!).
After quick mailing with MS Team thay had confirmed there is no Msxml3.XMLHTTP ;-)

Anti-Sample Of The Day - Request.ApplicationPath +"/mypath"

Imagine the following 3 alternatives of setting link URI:

<asp:HyperLink ID="HyperLink1" runat="server" NavigateUrl="~/foobar.txt" Text="asp:HyperLink ~foobar.txt"/><br/>
<asp:HyperLink ID="HyperLink2" runat="server" NavigateUrl="" Text="HyperLink2.NavigateUrl = Request.ApplicationPath + '/foobar.txt';"/><br/>
<a href="<%=Request.ApplicationPath+"/foobar.txt"%>">Request.ApplicationPath+"/foobar.txt"</a>
<script runat="server">
protected void Page_Load(object sender, EventArgs e)
{
HyperLink2.NavigateUrl = Request.ApplicationPath + "/foobar.txt";
}
</script>


Run under /sample application (seems fine):
href=
1."../../../../foobar.txt"
2."/sample/foobar.txt"
3."/sample/foobar.txt"

Run under / (breaks links 2,3):
1."foobar.txt"
2."//foobar.txt"
3."//foobar.txt"



Source: MSDN, search for ApplicationPath samples. Or one is located directly under ApplicationPath docs:
http://msdn.microsoft.com/en-us/library/system.web.httprequest.applicationpath.aspx
with small excuse in Remarks section

Use this property to construct a URL relative to the application root from a page or Web user control that is not in the root directory.

BTW: In "equivalent Servlet API" getContextPath()" they have made decision elminating this sort of concat mistake:

The path starts with a "/" character but does not end with a "/" character. For servlets in the default (root) context, this method returns "".

Anti-sample Of The Day - Cast, Null reference, If Too Late

Unbelievable what we can find on the net :-(

public void Init(HttpApplication context){
context.BeginRequest += delegate(Object sender, EventArgs ea) {
HttpApplication ha = sender as HttpApplication;
String absoluteUrl = ha.Context.Request.Url.ToString( ).ToLower( );
if (ha != null) {


Sample is called "Real World HttpModule Examples", subtitle of the web site is "... Home for AJAX, Silverlight, and .NET Technology, Architecture, and Elegance" Date of publishing 2007.
More bad news, author is MVP [ASP.NET] ;-(
http://www.netfxharmonics.com/2007/08/Real-World-HttpModule-Examples.aspx