is reading web.config from a class insecure? - asp.net

i wanted a way of getting settings without having to look them up every time so i made this simple class. ex:
public class CustomConfigSettings
{
public CustomConfigSettings()
{
// Default constructor.
}
public string MySetting
{
get { return ConfigurationManager.AppSettings["mySetting"]; }
}
}
it works fine, but it feels like it might be insecure (for some reason i can't put my finger on). would appreciate feedback on security issues, if any, and any possible alternatives. (webforms; .net 3.5).

This is not insecure by itself. Security depends on who will access your class and if this class permits changes to configurations, then if somebody access your code, he can change settings.

I don't see any reason it would be considered more or less secure to read AppSettings from a class than to read them directly from your code. You're using the proper calls and syntax.

There is no problem with your code.
Anyway you can make the function static, it will look better and do not require creating new instance.

Related

Remove cache created with <cache> tag helper

I have used <cache> tag helper in my Asp.Net Core 3.1 website to cache some parts of the page. However, in some situations I want to clear these cache entries and make the website re-create those. How can I achieve that? I tried the code mentioned in this answer but couldn't get it to work. When I register the service the application seems to ignore it and no entries get cached in my custom service.
Here is a way to do it:
private readonly CacheTagHelperMemoryCacheFactory factory;
public MyClass(CacheTagHelperMemoryCacheFactory factory)
{
this.factory = factory;
}
and later
(this.factory.Cache as MemoryCache).Compact(1.0);

Weird error when creating new Action Script class

Good Morning,
I have a very odd error working in adobe flexbuilder 3.
Ever since yesterday when ever I create a new class, Flex builder do not see anything wrong in my class.
how do i create one:
Right click on a folder in the package hierarchy
--> new
--> action script class
I leave everthing as is but i give it a name obviously
finish
The class is created.
I can now type anything into this class... Even the words "abc" and flex builder do not see that this is wrong.
if i go to an existing class and type "abs" , the moment i hit save it complains about the "abc"
I have tried the following but the problem still persists.
Deleted my workspace and created a new one and re-import.
If i right click on the class in the Flex navigator the "inlcude class in library" is greyed out.
if anyone can give me an idea, even if it is silly, please do. I really need to be able to add new classes.
thanks
The new class that i have created looks like
package za.co.dcs.cib.das.application.vo.authorisation.appDetails.memberDetails
{
public class MyNewlyTestClass
{
public function MyNewlyTestClass()
{
}
}
}
and then i add "ABC" to it... to which it don't complain about. I can add just about anything i want to this class... and nothing is ever an error.
package za.co.dcs.cib.das.application.vo.authorisation.appDetails.memberDetails
{
public class MyNewlyTestClass
{
public function MyNewlyTestClass()
{
abc
}
}
}
Or if i remove the function
package za.co.dcs.cib.das.application.vo.authorisation.appDetails.memberDetails
{
public class MyNewlyTestClass
{
public MyNewlyTestClass()
{
}
}
}
Flash Builder is plain stupid. The ide does not translate the ActionScript into an abstract syntax tree when typing, only check for the syntax when saving.
Don't know if this is default behavior but what i have found is that...
If I change an existing class the compiler checks the syntax but if I add a random file the compiler will only check the file if that file is used by my application.
I have tried this and it seems to work. The moment that you call that file from within your application it validates and give me errors where should be.
Thanks for all your updates

Do all methods have to be public for Caliburn.Micro to match them

I just started using Caliburn.Micro and I've noticed in all the examples that the methods are all public. I decided to test this by adding a button with:
x:Name="CloseMainWindow"
In my VM I added a method:
private void CloseMainWindow()
{
TryClose();
}
When I click the button, nothing happens and I don't hit the breakpoint, but if I change the method to public it works.
I can't see this being the best way to do this.
Would creating ICommand properties for all the methods be an acceptable solution?
Edit: I just read the answer to the question immediately above, there is not and never will be ICommands in Caliburn.Micro. So my original question still needs an answer, why does everything have to be public in the VM and is this safe?
I don't know what you mean by "is this safe?". Safer than what?
Anyway, Caliburn.Micro could have been designed to allow its conventions to bind to private methods, but that has a couple of drawbacks. First, it wouldn't work in partial-trust environments, like Silverlight or XBAPs or sandboxed plugins. You need full trust to use Reflection to access private members, and Caliburn.Micro is designed to be able to run in partial-trust (it does support Silverlight, after all).
But a bigger reason is that it would violate encapsulation. These are methods that you intend to be called from outside the class. (The view is a separate class, after all; you'd have to make the viewmodel method public if you were wiring it up yourself in the code-behind.) There's a word for "I intend to call this from outside my own class" in the language specification, and that's public. If you set up some magic that calls private methods from outside the class, you're violating both encapsulation and the Principle of Least Astonishment, because that's not what private means.
If you really want to be able to bind to private methods, you can customize the conventions. But it would make your code much harder to understand, so I wouldn't recommend it unless you can come up with a really good justification.

How can I use Caliburn.Micro conventions to set a button's text and its action?

If I have a button in my View named, say, Save, then I can add a Save property to my ViewModel, and Caliburn.Micro will automatically bind it to my button's Content. For example:
public string Save { get { return StringResources.Save; } }
Or I can add a Save method to my ViewModel, and Caliburn.Micro will execute that method when the button is clicked. For example:
public void Save() {
Document.Save();
}
But what if I want to do both? C# doesn't let me declare a method and a property with the same name. Can I use conventions to both set the button's Content and the action to perform when it's clicked?
(I know I can manually bind one or the other, but I'd rather use conventions if it's practical.)
This is a common need, so you'd think it would be built into Caliburn.Micro, but it doesn't seem to be. I've seen some code that extends the conventions to support this (and I'll post it as an answer if nothing better comes along), but it's a workaround with some bizarre quirks -- so I'd like to hear if anyone else has made this work more cleanly.
Note: I did see this similar question, but it seems to be about whether this is a good idea or not; I'm asking about the mechanics. (I'll reserve judgment on whether it's a good idea until I've seen the mechanics. (grin))
Quick and dirty
<Button x:Name="Save"><TextBlock x:Name="SaveText"></TextBlock></Button>

How to hack private static field in Flex?

Is there a way to change private static field of an alien class?
For example:
package mx.managers {
public class TooltipManager ... {
private static var _impl:IToolTipManager2; // <- assign my own value here
...
}
}
In Java it is possible to do it using Reflection API. What about Flex?
No, that is not possible.
If you are looking into changing the implementation of the TooltipManager, have a look at the Singleton class in the Flex SDK. You'll need to create a custom implementation and register it via the Singleton class before the application initializes. The best is to override the application preloader and do the registration there.
Well, if you feel like you can handle the extra responsibility, you can monkey patch the class by copying the source into your own source tree with the same package and apply the necessary modifications. That way the flex compiler will use your implementation rather than the SDK implementation.
This technique is sometimes used as a last resort to fix issues which cannot be fixed otherwise. Drawbacks include issues such as forwards compatibility and unintended side effects in the same or other classes dependant on the class your editing.

Resources