Setting up a GWT application to run as a Microsoft Html Application (HTA) is not as straight forward as renaming the host page with a .hta extension. There are a couple of things we need to look at.

Chrome Frame Detection Bug

GWT 2.4 incorrectly chooses the Safari permutation for IE instances where Chrome Frame is merely installed but not enabled, meaning that GWT applications may/may not run with errors.

For HTAs (as tested on IE9) the problem is slightly different causing an error message to always popup. The bootstrap nocache.js fails to choose the Safari permutation (due to an exception thrown while attempting to load Chrome Frame), instead loading the IE permutation. Then once the permutation is loaded, the user agent detector starts returning Safari, causing an annoying popup to display:

“ERROR: Possible problem with your *.gwt.xml module file. The compile time user.agent value (ie9) does not match the runtime user.agent value (safari). Expect more errors.”

Issues with Frames

Frame Security

Out of the box GWT applications using an iframe permutations will not load, due to the requirement that all frames that form part of the application to have the application attribute set to “yes”. There are no plans to support this however Thomas Broyer suggests either using our own version of the nocache.js bootstrap template  or avoiding iframes altogether. The documentation describes how linkers are setup in your module XML file (under “Controlling compiler output”) however I’ve summarised it below.

Note that the iframe solution will not only allow you to target different IE user agents – IE9, IE8, Chrome Frame (once the bug is fixed) but to also split your code if you decide to host your HTA. If you’re not interested in either of these features then don’t worry about the hassle of enabling frames.

Removing Frames

Use SingleScriptLinker as the primary linker, done by adding the following to your module XML file:

<add-linker name="sso" />

Despite the name “add-linker”, there can be only one primary linker so this command will in fact replace the default primary linker “std”.

Note: The SingleScriptLinker doesn’t seem to include the loading of GWT themes so this you’ll have to do manually by adding a link in your host page.

Enabling Frames

Alternatively, to override an iframe linker, subclass the linker of your choice (IFrameLinker/CrossSiteIframeLinker) and overload the appropriate method that returns the bootstrap template’s path. Copy the template to somewhere in your classpath and add the following before the iframe is added to the document:

iframe.setAttribute("application", "yes");

Note: It must be an attribute and not a property, so doing iframe.application = “yes” will not work.

Then add the linker to the compilation process by using:

<define-linker name"ourlinker" value="your.version.of.IFrameLinker" />
<add-linker name="ourlinker" />

Packaging

When packaging for distribution, don’t forget to only compile the necessary permutations. If you’re requesting Chrome Frame then make sure to include both Safari and IE:

<set-property name="user.agent" value="safari,ie9" />

Rename the module.html to module.hta. Remember to remove the WEB-INF directory which will contain some sizeable jars that will unnecessarily increase the download size.

Packaging into a Self-Extracting Executable

Downloading a single file to run the application may be a better option for end users. The Microsoft tool, IExpress, generates self-extracting executables using the Cabinet archive format.

IExpress’ cab tool, makecab, does not extract into folders and will flatten the archive. You must either setup your application to run flattened or use your own archiving software on top of the cabinet (using something like 7zip which is LGPL licensed). The archiving binary will need to be added to the cabinet along with the archive in order for the client to unzip it again.

The application to run your HTA is mshta.exe. You’ll need to create a batch file to run it as it requires the absolute path to your *.hta host page and this may be retrieved from within a batch file by using the %CD% environment variable. The command to launch your batch file is:

cmd /c your_batch_file.bat

Today I read an article about how security consultant Patrick Webster stumbled across a serious security flaw within the First State Super’s members area of their site. First State’s irrational response by notifying the police and threatening legal action is a whole other story but what I also find interesting is the fact that these kinds of flaws happen in the first place.

Authentication & Authorisation

When logging into a website 2 very basic, yet fundamental, things need to happen to make sure that a site’s data is protected:

1. A person needs to be able to prove who they are – known as authentication
2. They must only be allowed to see information relevant to them – known as authorisation

This article explains the difference between the two in more depth.

First State’s Flaw

In First State’s case, the authentication seems to have been fine however the programmers implementing the site have obviously either forgotten about authorisation or perhaps, even worse, don’t understand the problem. I have worked with people who have written software with holes similar to this and didn’t understand until I demonstrated how easily I could circumvent their code.

The flaw centres around the server allowing authenticated clients to change an ID used by the software to retrieve records from the database. Changing the ID is quite simple as it appears in the page’s URL and is therefore just a matter of guessing a new one and substituting the original. Patrick was able to quickly whip up some software to retrieve a client list from the database by cycling through a range of IDs that the server would accept, which in this case would most likely have been as simple as a positive number.

At some point the software should have been executing authorisation checks by asking “Are you allowed to look at this?”. Making sure this is done for every entry point is a simple way to prevent this disastrous result.

Software Quality

These kinds of mistakes should never happen and is symptomatic of a software system written without basic quality checks. Too often though building quality software is ranked last in the list of priorities as quality has a cost and is not as easily tangible as things like bells and whistles.

Here’s a short, but not exhaustive, list of things that will improve the quality of software:

• Hiring the right resources
• Training
• Reviewing software by peers
• Paying off Technical Debt
• Software testing

And finally if your data’s security is crucial and your software development team is inexperienced with security matters hiring an agency such as Patrick’s – OSI Security to audit your system may be well worth the investment.

When using orphanRemoval=true on a collection in a Spring Roo project, the generated setter for the collection needs to be pushed in to use retainAll() rather than it being replaced.

I needed to add a column to a CellTable where the user was able to click on the cell to download a file, however I didn’t want the row to become selected. After looking at writing my own cell and overriding handlesSelection(), which seemed to disable the selection model altogether, I found a post by John LaBlanca where he describes how to disable SelectionEvents selectively.

He mentions that the selection events can be controlled by a DefaultSelectionEventManager. You can create an instance of this which has been set to ignore or trigger selection if certain columns are clicked. The instance is then passed along with your selection model into your CellTable.

If you’d like to upgrade your Roo application to use GWT 2.3.0 there’s a couple of points that you’ll need to know:

• GWT now requires that the source for javax.validation.api must be included. To do this add <classifier>sources</classifier> under the javax.validation.api dependency in your pom.xml.
• 2.3.0 introduces a bug where validation errors are not shown for newly created entities. This is due to constraint violations from bean validation not being forwarded onto editors. An issue report suggests that it’s due to the parent proxy not being set on a violation object with the reporter supplying a suggested patch.
• 2.3.0 allows you to set an empty row widget for CellTable so that you may show a message when there’s no data to display. Simply call table.setEmptyTableWidget(new Label(“No data”)) in your entity list view’s constructor.

With jQuery:

$(target).dblclick();

With GWT:

DOMEvent.fireNativeEvent(Document.get().createDblClickEvent(detail,
  screenX, screenY, clientX, clientY, ctrlDown, altDown, shiftDown,
  metaDown), target);