2018-02 on Funky Si's Test

Refactoring if statements

funkysi1701@gmail.com (funkysi1701) — Mon, 26 Feb 2018 00:00:00 +0000

The code base I am working on contains a huge if block. By huge I mean 77 if statements one after the other, each if checks to see what page id you are on and loads different content. This is not easy to maintain and I want to refactor it.

One option would be to replace the if statements with a switch block. However this is just as unmanageable as the huge if block. Lets look at a better option.

Polymorphism is where you create a base class and then create sub classes from it. In my case I created an interface IPage with a single method CreateContent.

public interface IPage
{
 string CreatePageContent();
}

and then create 77 classes for each page which implemented this single method.

Now comes the fun bit how do I call the correct page class from my original code?

I created a dictionary than maps page ids to the class names.

public static Dictionary<PageIds, Type> PageIdToClass = new Dictionary<PageIds, Type>()
{
 {
 PageIds.HomePage,
 typeof(HomePage)
 },
 {
 PageIds.ContactPage,
 typeof(ContactPage)
 },
 //etc 
}

This is the one step I am not 100% happy with as I think it may be possible to remove or simplify this step.

Now I have a way to map ids to classes I can write a class to do this.

public class MyPage
{
 IPage _repo;

 public MyPage(int pageId)
 {
 PageIds p = (PageIds)pageId;
 Type t = PageIdToClass[p];
 ConstructorInfo constructor = t.GetConstructor(new Type[] { });
 _repo = (IPage)constructor.Invoke(null);
 }

 public string Create()
 {
 return _repo.CreatePageContent();
 }
}

So in my constructor I take the pageId and pass it to my dictionary to get which subclass to load. I then get its Constructor and invoke it.

Now I can remove the huge if block and replace it with a single line of code.

var page = new MyPage(pageId);

On the face of it this change might look like a lot of work for not much gain as we started off with one file and now we have the original file, an interface, 77 subclasses and the MyPage class. However the original file is a lot more manageable and each sub class can be altered independently of each other.

This is a big step towards making this code more maintainable, there is always more that can be done but that can wait for another day.

Chrome distrusts SSL Certificates

funkysi1701@gmail.com (funkysi1701) — Mon, 19 Feb 2018 00:00:00 +0000

One of the websites I have been working on has been displaying an error in the console. The error reads as follows.

The SSL certificate used to load resources from https://example.com will be distrusted in M70. Once distrusted, users will be prevented from loading these resources. See https://g.co/chrome/symantecpkicerts for more information.

But what does this mean? Well let’s start by looking at the link provided.

In January 2017 it was revealed that Certificate Authorities run by Symantec which include Thawte, VeriSign, Equifax, GeoTrust, and RapidSSL had been issuing certificates that did not comply with baseline standards.

Starting with Chrome 66, Google has decided to remove trust for these certificates. Chrome 66 is due for release around 17th April. My error mentions M70 so what does that refer to?

Chrome 70 which is due to be released in October 2018 will removed the trust for another batch of Symantec certificates.

If you are getting one of these errors because you are using a certificate that is going to be distrusted what will your site look like in Chrome 66 or Chrome 70?

Well Chrome 66 is now in the dev channel so we can give it a try.

Not very nice for your users is it? Now is the time to order a new SSL certificate to avoid this happening to your site.

I first saw this error a few months ago and have been reading up about it and waiting for Chrome 66 to reach the dev channel so I could test what it did to my site. However now that I have Chrome 66 installed I spotted the intranet for the company I work for is also affected. I do not directly work on the intranet so I notified the security team that they may want to look into this.

Unfortunately the response I received has been that Google needs to fix this before Chrome 66 is released. I am not criticising my employer or the security team, however this isn’t something Google can just “ fix “.

The certificates issued were issued by a CA that had issues so in order to maintain the trustworthiness of all certificates Google had little choice but to distrust them. Google and security experts need to be making more of a fuss about this and I am joining in on making a fuss by writing this blog. Scott Helme estimates that there are about 7000 websites which may be affected by the M66 and M70 distrusts.

Content Security Policies

funkysi1701@gmail.com (funkysi1701) — Mon, 12 Feb 2018 00:00:00 +0000

A content Security Policy or CSP is a HTTP response header that defines what sources of content can be loaded on a web page. It is a way to combat Cross Site Scripting (XSS) attacks.

What is a XSS attack then?

When you load a webpage it also loads various other resources like images, some css style sheets, various javascript files that you want to run and probably many other things.

How do you know that you can trust all of these things? If you created them and they live under you control then the answer is probably yes. However these days you will probably want to use resources from across the internet, like youtube videos, google analytics, disqus comments, jquery libraries from a cdn etc and you can’t be sure exactly what they are doing.

Imagine you had a page which you could add any text into a form which would then be displayed. A malicious user could add evil javascript or get the browser to load evil code from anywhere on the internet.

CSP to the rescue!

A CSP allows the browser to only load from sources that you specify. You could specify that resources from your own site will load but the evil script will not.

Let’s look at some examples

Content-Security-Policy: script-src 'self'

This allows <script> tags to only load from the current webhost. script-src is not the only keyword you can use, let’s look at some of the others.

script-src – control what <script> tags will load
style-src – control what css will load
img-src – control what images will load
frame-src – control what frames will load
font-src – control what fonts will load
object-src – control what object tags will load
connect-src – control what resources a script can connect to
media-src – controls what media (audio/video) will load
default-src – if no specific rule exists then the default directive will run

Content-Security-Policy: default-src https

This allows any content to be loaded from any site as long as it comes from a secure (https) site

Content-Security-Policy: default-src https://example.com

This allows any content to be loaded from https://example.com only.

How do I use this on my site?

I have added CSPs into my web.config which works great for my .Net Framework code.

 <system.webServer> <httpProtocol> <customHeaders> <add name="Content-Security-Policy" value="default-src https://example.com" /> </customHeaders> </httpProtocol> </system.webServer>

For .net core it is a bit more complex as you don’t tend to use web.config files, however check out Anthony Chu’s post , which has a solution to that problem.

Report Only

One last thing about CSPs to mention is the Report Only flag.

Content-Security-Policy-Report-Only

This does the same as the above but doesn’t enforce anything, so you can fix any problems before you break anything.

To view your issues just look in the developer tools in your favourite browser. Or you can configure all your reports to be collated in one place with a report-uri directive.

Content-Security-Policy: default-src https://example.com; report-uri https://example.report-uri.com/r/d/csp/reportOnly;

Scott Helme and Troy Hunt have a site called report-uri which offer a service for collating and viewing all your CSP violations so check it out if you want to know more about CSPs.

Pluralsight

funkysi1701@gmail.com (funkysi1701) — Mon, 05 Feb 2018 00:00:00 +0000

Earlier this year I signed up for pluralsight. If you want to sign up to pluralsight as well use this link https://referral.pluralsight.com/mQd8BJ4 to get money off.

Pluralsight is a website that sells training videos on a wide variety of technical topics. You sign up for a monthly or annual subscription and you can watch over 6000 courses whenever and where ever you like.

I am not a big fan of videos as if I am sat in front of a screen I would rather be building something, however I do spend a lot of time listening to podcasts. So I have decided to convert this time to listening to pluralsight videos.

If we assume that by not seeing the visual portion of the videos you lose out on 75% of the learning (This is just a guesstimate I am not sure what the exact figure is or how you would calculate it). However this is still 25% more learning than if I hadn’t signed up at all.

Since I signed up I have listened to over 27 hours of technical videos. These have covered topics like C#, Security, Xamarin, MVVM, Interfaces, Getting Involved and Clean architecture. The number one thing I have learnt is that there is a lot that I still don’t understand.

That said I would like to think that since starting to listen to pluralsight concepts have gone from being unknown unknowns (I don’t know about them and I don’t understand them) to known unknowns (I know about them but don’t yet fully understand them)

To keep track of your learning pluralsight has some tests which you can complete. I am particularly proud of my score on the Azure test which ranks me as an expert.

Why not check out what you can learn from pluralsight?