Liam McLennan

ASP.NET MVC - Validate Request

Liam McLennan — Wed, 17 Sep 2008 01:42:35 GMT

Since .NET 2.0 Asp.net webforms has protected the programmer from cross-site scripting by validating all input sent to the server. Unfortunately, this does not happen in Asp.net mvc. I tested my application by typing 'alert("xss");' surrounded by script tags in the first name textbox. The form saved successfully and I got a javascript alert box with the message "xss".

In asp.net mvc it is the programmers responsibility to validate all input. Calling Request.ValidateInput() in a controller tells the framework that any values read from the request should be validated. If an invalid character is found a HttpRequestValidationException is thrown.

Here is an example implementation:

    Request.ValidateInput();                  
    try { UpdateModel(b, new[] { "FirstName", "LastName", "Email" }); }         
    catch (HttpRequestValidationException) { /* Handle request validation error  */ }

ASP.NET MVC - Beautifying Views

Liam McLennan — Fri, 05 Sep 2008 04:22:29 GMT

This is a simple technique I recently started using to clean up MVC views.

Here was my first attempt at rendering a list of alerts:

<table class="tabTable">
    <tr>
        <th></th><th>VEHICLE</th><th>ALERT TYPE</th><th>WHEN</th><th>ACT</th>
    </tr>
<%
    foreach (FleetAlertDTO alert in ViewData.Model)
    {
%>
        <%= Html.RenderUserControl("~/Views/Alert/FleetAlert.ascx", alert) %>
<%
    }
%>
</table>

I didn't like it because there are to many <% %>. Using Response.Write() can help eliminate much of the switching between html and C#. Here is what I ended up with.

<table class="tabTable">
    <tr>
        <th></th><th>VEHICLE</th><th>ALERT TYPE</th><th>WHEN</th><th>ACT</th>
    </tr>
<%
    foreach (FleetAlertDTO alert in ViewData.Model)
    {
        Response.Write(Html.RenderUserControl("~/Views/Alert/FleetAlert.ascx", alert));
    }
%>
</table>
It's a simple change, but I think it is much more readable.

Stackoverflow.com - The Jeff Atwood Joel Spolsky marketing machine

Liam McLennan — Tue, 26 Aug 2008 02:54:12 GMT

Stackoverflow.com is a soon-to-be-released developer community website from Jeff Atwood and Joel Spolsky. It is an evolution of existing sites in the genre, adding reddit and wiki type features to the traditional forum style site.

The technology stack it uses is nearly identical to my current personal project: Asp.Net MVC, jQuery, Linq-to-sql, sql 2005. The truly fascinating thing about stackoverflow.com is the buzz. There are already thousands of users on the private beta. I predict, and Joel Spolsky concurrs, that when it goes live it will be huge. Not because its a great site, which it is, but because of the spectacular Atwood/Spolsky marketing machine. These two gentleman have enourmous credibility in the developer community and it shows in the early success of their new joint venture. It is a perfect demonstration of how online reputation is an asset and how to leverage that asset into a business that makes money.

My final prediction is that their server will crash in the first week of go-live. It will be karma's revenge for making fun of twitter.

American Gangster

Liam McLennan — Wed, 20 Aug 2008 08:54:18 GMT

Americal Gangster is an excellent film. My feelings about it are shared by the first imdb commenter, "I can hardly believe that this amazing package of a story was delivered by Ridley Scott". Highly recommended.

Reasons why Vista is great for a Web Application Development Machine

Liam McLennan — Thu, 07 Aug 2008 23:28:29 GMT

1. IIS 7 Allows Multiple Web Sites

On XP IIS was limited to one web site. To develop multiple web site one had to use virtual directories or develop solely with Cassini (VS Web server). The problem with both of the aforementioned strategies is that they create a significant difference between the development and production web servers. I prefer to develop with IIS, and Vista allows me to do that.

2. IIS 7 Plays Well with Asp.Net MVC

I love Asp.Net MVC but it really does not work well without IIS 7.

3. Vista works with my hardware

Most of my development work is done on my Dell Inspiron 6400, which had loads of driver issues that I never resolved when I was running XP Pro. Vista Business just works.

Subversion (SVN) Clients

Liam McLennan — Wed, 02 Jul 2008 07:43:44 GMT

Subversion is a version control server. To use subversion you need a subversion client. There are many available, including a command line client, free gui clients and commercial clients.

When recommending subversion for source code control nearly everyone seems to recommed TortoiseSVN as the client program. TortoiseSVN is a windows shell extension that allows subversion to be used via the Windows Explorer context menu. One thing I love about it is that it integrates effortlessly with IDEs/editors that use the windows shell as their file browser (such as e). Unfortunately, Visual Studio does not use the windows shell so you don't automatically get TortoiseSVN integration.

I have recently dumped TortoiseSVN for the following reasons:

the interface is clunky. Everything seems to require more dialogs and clicks than it should.
the synchronization with the windows shell is slow. When files are commited they often remain marked as modified for several minutes until the synchronization catches up.
TortoiseSVN is resource intensive. Once again I think this may have to do with the shell integration. Both CPU and memory usage are relatively high.

An alternative to TortoiseSVN is RapidSVN. RapidSVN is a more traditional GUI source control client. The downside of this is that you will usually need to have the RapidSVN gui open as well as your IDE when developing. What I like about RapidSVN is that it is less resource intensive and quick to use that TortoiseSVN. What I dont like about it is that it does not show the list of non-versioned files when commiting like TortoiseSVN does.

TortoiseSVN and RapidSVN are both fantastic free SVN clients. The purpose of this post is to address what I feel is an unjustified bias towards TortoiseSVN. When selecting a subversion client be sure to take a look at other alternatives, including TortoiseSVN.

Upgrading to Asp.Net MVC Preview 3

Liam McLennan — Sun, 08 Jun 2008 04:44:02 GMT

When Asp.net AJAX was about to be born I was an early adopter. I dutifully downloaded each new preview and upgraded my solution to handle the API changes. This experience taught me that living on the edge is a world of pain. Each new release could mean hours of wasted time, just to get back to where I started.

Since then I have avoided working with pre-release software - until Asp.Net MVC came along looking too good to refuse. So now I am back in the familiar cycle of responding to preview releases. I knew the upgrade to preview 3 would be a tough one just by looking at the forum traffic it generated. This release includes a lot of changes. But since I had already skipped an interim code drop I decided that I could not afford to delay any longer. As bad as these upgrades are they are even worse if you skip a release.

The upgrade was complicated by MVCContrib, which is versioned to match Asp.Net MVC, meaning that when MVC is upgraded MVCContrib must also be upgraded. Here I re-learned an important lesson about MVCContrib. There is almost no documentation, but there are excellent sample applications distributed with the source. Had I looked in the sample application to begin with I would have saved hours of trying to work out how to get the new MVCContrib to work with Castle Windsor.

The other changes were straight forward. All of the controller actions had to be changed to return an ActionResult, which I think is an excellent change. All of the Html helpers for drop-down lists and list boxes have also changed. The old API for these was definately a weak spot and I like the new API much better. Finally, strongly typed view data is now available in the views as ViewData.Model instead of just ViewData so that meant a lot of simple changes.

Now that I am finished the upgrade appears to have been a success. I have all the latest-and-greatest goodness and my application is still working.

Implementing the Repository Pattern with Linq-to-Sql

Liam McLennan — Thu, 05 Jun 2008 23:36:43 GMT

I had too much content for a blog post, so I posted a full article to code project:

http://www.codeproject.com/KB/architecture/linqrepository.aspx

JAOO Brisbane - Day 3

Liam McLennan — Sat, 31 May 2008 23:15:29 GMT

I began the third and final day of JAOO Brisbane by arriving late. I had left my name tag at home so I had to go back for it.

I was in time for Robert Martin's keynote Clean Code. Uncle Bob is well known for his enthusiastic, entertaining presentation style. I greatly enjoyed his talk, even though it was really just a back-to-basics on writing code. He did a tutorial on advanced design that I missed, but I'm sure it would have been excellent.

Next was Jim Webber speaking about distributed programming using the internet. Jim is also an excellent and insightful speaker. I enjoyed the talk even though I don't particularly care about the topic. He talked about WS-* and described an approach for using RESTful services.

Before lunch Gregor Hohpe spoke about some of the new services offered by google. Things like GData, Google Apps, and Google Mashup editor. I did not get much from the talk because I am not interested in those tools. It seemed like a really bad way to make software.

After lunch Robert Martin spoke about functions. Because the talks are limited to 45 minutes they work best when the speaker focuses on one small aspect - such as functions. I got some good ideas from the talk that I will be trying to implement.

After a short break I was back to listen to Michael Feathers talk about designing testable APIs. This is a topic that is very close to Michael's heart, but it seemed that some of the audience did not feel it was relevant (so why did they come?). I learnt some things and will definately keep unit testing in mind when designing APIs.

Finally, Eric Dornenburg gave us his thoughts on Software Quality - specifically how to use visualazation tools to provide feedback on software quality. Some interesting metrics came up and I will be looking for some tools for .NET when I get the chance. He showed thought works toxicity chart which I thought was particularly interesting. It basically provided a way to measure the health of an application, broken down by class. I wish that it was available to the public.

After Eric's talk there was some time for socialising and meeting the speakers. Because the conference was nice and small (~200) I was able to have a chat with most of the speakers which was nice. Overall the JAOO experience was very positive and I have already signed up for next year.

JAOO Brisbane 2008 - Day 2

Liam McLennan — Thu, 29 May 2008 21:56:55 GMT

The conference proper began with a faux improvised discussion about the conference. There were some attempts at humour, which I appreciate, but they struggled.

Eric Meijer from Microsoft had the first keynote. His central theme was that imperative OO programming is fatally flawed and we should all embrace functional programming. His presentation was entertaining and thought provoking.

The next talk I chose to attend was by Dave Thomas (not the Pragmattic Dave Thomas) on the topic of next generation IT. I felt like Dave enjoyed giving this talk because it allowed him to look a long way into the future and present his strong opinions. I did not agree with everything he said but I appreciate that he was not afraid to express an opinion, in an industry dominated by fence-sitters.

The last talk I sqeezed in before lunch was Lessons Learned from Architecture Reviews by Rebecca Wirfs-Brock. Unfortunately for me, this was mostly a repeat of the content I heard Rebecca discuss in a podcast from last year. Even so it was a good refresher containing lots of practical advice for handling both sides of an architecture review.

After lunch it was Enterprise Patterns with Martin Fowler. This was really old news for me. In the forty-five minute session he had just time to cover what are patterns and what are enterprise patterns.

Next up was Don Syme from Microsoft introducing F#. Don is a local boy who now works for Microsoft research in Cambridge. Once again the 45 minute limit really prevented this talk from getting very deep at all. Mostly he just demonstrated running some scripts and discussed some of the properties of the language. He had lots of slides that we never got to.

After Don it was back to Dave Thomas; this time speaking about introducing agile processes into large organisations. On suprise for me was that Dave made a point that agile development does not lead to business agility - when I thought that was sort of the point. My other observation is that Dave seems to be frustrated with the state of the art. He suggested in his earlier talk that user generated applications are the way of the future. I think he needs to have a look at No Silver Bullet (Brooks).

The last session before the keynote was a panel on Enterprise Systems. It was a little strange because they began the discussion without introducing the speakers. I for one had no idea who most of them were (though I later met some of them at the bar). The panel was enjoyable and actually something of a highlight for me. It was clear that most, if not all, of the panel had carefully considered viewpoints on the topic. Product plugging was kept to a minimum.

The last session of the day was Eric Dornenburg and Martin Fowler's keynote simply titled Simplicity in Design. It was ok. The themes were: simplicity is good, complexity is bad. There was an interesting exploration of the notion of technical debt.

After the keynote the majority of the attendees and speakers made our way to the Belgian Beer Cafe for the social event. This was a great chance to meet some people to discuss the conference and exchange ideas. I am looking forward to Robert Martin's talks tomorrow.

JAOO Brisbane 2008

Liam McLennan — Wed, 28 May 2008 21:52:29 GMT

Yesterday was the first day of JAOO Brisbane 2008. Choosing tutorials was hard. Should I learn from Rebecca Wirfs-Brock about telling design stories, or Robert Martin about agile O-O design? I chose to attend the Martin Fowler and Erik Dornenburg tutorial on test driven development. It was a full day tutorial so it meant I missed out on the other tutorials.

As someone who is familiar with test-driven development I was hoping for some expert insight beyond just an explanation of the basic red-green-refactor process. I liked the way that they related test-driven development to the values of XP.

SIMPLICITY: Tests narrow focus and help to avoid speculative generality.
COMMUNICATION: Tests help drive the design of clear interfaces and also serve as documentation of the interface.
FEEDBACK: Tests provide nearly immediate, and unarguable feedback about the correctness of the code they test.
COURAGE: Tests give a reason to act with courage. This was contrasted with the smalltalk community who apparently had courage without discipline.

To introduce the example application they used story cards. Something new for me was the following formula for writing stories:

As a ________ I would like to be able to ___________ so that ____________.

This seems like a good formula and I will certainly be giving it a try on my projects.

There was quite a look of talk using the language of Eric Evan's Domain-driven design. We were encouraged to refactor variable and class names to match the ubiquitous language and to use immutable value objects.

There is no substitue for an experienced teacher and although there was really no new content for me I feel that it was worthwhile. A book can present rules but without a quality teacher it is difficult to know how to apply the rules and in particular how dogmattic to be. I am looking forward to some great talks today.

Restricting HTTP methods with an Asp.net MVC ActionFilter

Liam McLennan — Thu, 22 May 2008 02:59:13 GMT

HTTP methods are not often thought about when coding Asp.net webforms applications. Links are GETs, buttons are POSTs and it all happens automatically. With Asp.NET MVC, and other MVC frameworks like Rails, the HTTP method used is more obvious and developers are begining to care about which they use.

The problem is that GET requests tell visitors to your site, including search engines, client-side web optimizers and other automatic tools, that it is safe to make the request. Which is a problem if your checkout button causes a GET. To quote Dave Thomas, paraphrasing Tim Berners-Lee, "Use GET requests to retrieve information from the server, and use POST requests to request a change of state on the server".

To help me correctly control which HTTP methods are used to access my controller actions I created an ActionFilterAttribute. ActionFilters provide a declarative way to access the executing context immediately prior to, and immediately following, the execution of an action. They are an excellent way to introduce aspect oriented programming to an asp.net mvc application. To use my action filter you attribute a controller action like this:

[AllowedHttpMethods(AllowedMethods= new HttpMethods[] {HttpMethods.POST})]
public void Save()
{ ... }

The code for the Action Filter inherits from ActionFilterAttribute and overrides the OnActionExecuting event.

public class AllowedHttpMethodsAttribute : ActionFilterAttribute
    {
        public HttpMethods[] AllowedMethods { get; set; }

        public override void OnActionExecuting(FilterExecutingContext filterContext)
        {
            int count = AllowedMethods.Count(m => m.ToString().Equals(filterContext.HttpContext.Request.HttpMethod));
            if (count == 0) throw new Exception("Invalid http method: " + filterContext.HttpContext.Request.HttpMethod);
        }
    }

    public enum HttpMethods
    {
        GET,POST
    }

By adding the AllowedHttpMethods attribute to all of my controller actions I can assure that http methods are used correctly.

I also use an action filter attribute to authorize which roles can access with actions. The technique I used is based upon the article Securing Your Controller Actions by Rob Conery.

How to Generate URLs with ASP.NET MVC

Liam McLennan — Thu, 22 May 2008 01:21:20 GMT

I have been working with ASP.NET MVC for some time and yet I still had trouble trying to generate a URL in a view. URL generation is particularly important for ASP.NET MVC because it uses a routing engine to map URLs to code. If we hard code a URL then we lose the ability to later vary our routing scheme.

I have found two ways that currently (ASP.NET MVC preview 2) work to generate URLs in a view. The first uses the GetVirtualPath method and seems overly complicated - so I wrapped it in a global helper:

        public static string GenerateUrl(HttpContext context, RouteValueDictionary routeValues)
        {
            return RouteTable.Routes.GetVirtualPath(
                new RequestContext(new HttpContextWrapper2(context), new RouteData()),
                routeValues).ToString();
        }

But then I found that I could achieve the same result more simply using UrlHelper, accessible via the Url property of the view.

// link to a controller 
Url.Action("Home");

// link to an action 
Url.Action("Home", "Index");

// link to an action and send parameters 
Url.Action("Edit", "Product", new RouteValueDictionary(new { id = p.Id }));

Or, if you want the url for a hyperlink you can get that in one step using the ActionLink method on the Html property:

Html.ActionLink<HomeController>(c => c.Index(),"Home")

So I no longer see a need for my GenerateUrl method and have removed it from my helper. All of this would be much easier if there was some documentation. Im sure there is a better way so if you can think of an improvement please leave it in the comments.

Cashbacks are a scam

Liam McLennan — Thu, 22 May 2008 00:56:20 GMT

Lately I have noticed a trend in electronics retailing. Shops have started selling a large number of items with cashbacks. Here is an example of what I mean. Cashbacks are provided by the wholesaler to the consumer as a means of passing on discounts in a way that cannot be absorbed by the retailer. For example, if the wholesaler discounts the cost of an item by $250 what is to stop the retailer absorbing the $250 as additional profit? But if the wholesaler offers a $250 cashback then the consumer is theoretically protected from the retailers opportunism.

I strongly dislike cashbacks. They are effectively an interest free, indefinite term, loan from the consumer to the wholesaler. Instead of the vendor asking the consumer for money in exchange for goods the consumer is left asking the vendor for their own money back. Frankly there is very little compelling the vendor to actually pay the cash back. Here is an exerpt I received from Sony after I tried to claim a cashback for my television:

We've sent you this email to let you know that we have received the information you sent us in order to claim CASHBACK.
However, the following problem(s) have been identified with the cash back claim(s):

Claim XXXXXX - $150.00 cash back for BRAVIA TV Model:KDL40D3100 -
We did not receive the section of the product packaging showing the product serial number.

This email was sent without any contact details that might be used to resolve the problem. Of course the problem is that they did receive the serial number in question. I cannot resend the piece of packaging that I have already sent to them. The lack of contact information in their email is what annoys me the most. The message is clearly that they will resist paying as much as they can.

When important things go missing, such as the piece of packaging required to claim a $150 cashback, it makes me wonder if someone has found a way to beat the system.

Building a Vista Media Center Home Theatre PC

Liam McLennan — Mon, 12 May 2008 08:22:41 GMT

For a while I have been thinking about building a media center PC but I could not bring myself to purchase a new machine just for home theatre. Then it occurred to me that I already have a server that runs constantly - why not use it for media center as well?

I began with a fresh install of Vista Ultimate since it includes media center. The first problem I encountered was that Vista does not support my old AGP graphics card. When building a home theatre PC (HTPC) two important considerations are noise and power consumption. So when chosing a new video card I wanted a passively cooled solution to minimize power use and noise.
I settled on a Geforce 6200, because I could get an AGP version and because it was passively cooled. This turned out to be a bad decision as the 6200 is not sufficient for Vista media center. It works but the performance is not what I would like, and it is completely incapable of handling the new HD digital channels.

The server that I converted to a HTPC is based on an AMD Athlon 64 3000 with 2g of RAM. This was also insufficient. The CPU usage varies between 30%-60% resulting in occassional pausing and stuttering that ruins the HTPC experience. I have overclocked the chip 10% (from 1.8Ghz - 2Ghz) but it is too little too late.

For the digital TV tuner I went with the Leadtek Winfast DTV2000H because they are well reviewed, cheap and readily available. Installing the drivers was a pain but other than that I think it is a good card and the compatability with Vista Media Center seems to be excellent.

Overall I am happy with the system. It works, even if it is a little noisy (PSU) and a little underpowered. My favourite feature of HTPC is the easy access to my digital music collection, and that function at least works perfectly. If I was to do it again I would use a higher spec machine, or the older XP Media Center. Total cost for the upgrade was around $250.00.