bradleybeddoes

$> git checkout master
$> git pull origin beddoes oneill
$> vi food.rb
$> vi environment.rb
$> git add .
$> git commit -m "creates spawn v1.0 - not yet tested, bugs probably exist"
Writing objects: 30%, eta: 6 months.

bradleybeddoes

$(document).on('click', '.ajax-modal', function() {
  $.get($(this).attr('data-load'),function(d){
    $("#show-ajaxload-modal .modal-body").html(d);
    $("#show-ajaxload-modal").modal('show');
  });
});

----

<a href="#" class="btn btn-small ajax-modal" data-load="${createLink(controller:'subject', action:'showpublic', id:subject.id, absolute:true)}" ><g:message code="label.quickview" default="Quick View"/></a>

bradleybeddoes

Regular expressions
A common pitfall in Ruby's regular expressions is to match the string's be-
ginning and end by ^ and $, instead of \A and \z.

Ruby uses a slightly different approach to match the end and the beginning of a string. That is why even many Ruby and Rails books make this wrong. So how is this a security threat? Imagine you have a File model and you validate the file name by a regular ex- pression like this:
class File < ActiveRecord::Base
validates_format_of :name, :with => /^[\w\.\-\+]+$/
end

This means, upon saving, the model will validate the file name to consist only of alpha- numeric characters, dots, + and -. And the programmer added ^ and $ so that file name will contain these characters from the beginning to the end of the string. However, in Ruby ^ and $ matches theline beginning and end. And thus a file name like this passes the filter without problems:

bradleybeddoes

dataSource {
	dbCreate = "update"
	dialect= org.hibernate.dialect.MySQL5InnoDBDialect
	jndiName= "java:comp/env/jdbc/FEDERATIONREGISTRY"	
}

bradleybeddoes

<VirtualHost 1.1.1.1:443>
	ServerName fr.host.edu.au:443
	DocumentRoot /var/www/hosts/fr.host.edu.au

	Include include/ssl-defaults.conf

	SSLCertificateFile ...
	SSLCertificateKeyFile ...
	SSLCertificateChainFile ...

bradleybeddoes

	public boolean equals(Object obj) {
		if (obj == null) { return false; }
		if (obj == this) { return true; }
		if (obj.getClass() != getClass()) {
			return false;
		}
		
		Uri rhs = (Uri) obj;
		return new EqualsBuilder()
			.appendSuper(super.equals(obj))

bradleybeddoes

def subject = "CN=idp1-aaftest.usq.edu.au,OU=Division of ICT,O=University of Southern Queensland,STREET=1 West St.,L=Toowoomba,ST=Queensland,2.5.4.17=#130434333530,C=AU"

def cn = subject =~ /^(?:.*,)*[cC][nN]=([^,]+)(?:,.*)*$/

cn.each {println it}

bradleybeddoes

	import fedreg.core.*

	/*
	 Initial SAML 2.x specification environment population for Federation Registry
	*/

	// Overall SAML2 protocol support, all SAML 2.0 compliant RoleDescriptors need this.
	def samlNamespace = new SamlURI(type:SamlURIType.ProtocolSupport, uri:'urn:oasis:names:tc:SAML:2.0:protocol').save()
	

bradleybeddoes

<n:confirmaction action="fedreg.endpoint_delete(${ep.id}, '${endpointType}', '${containerID}' );" title="${message(code: 'fedreg.template.endpoints.remove.confirm.title')}" msg="${message(code: 'fedreg.template.endpoints.remove.confirm.descriptive')}" accept="${message(code: 'label.accept')}" cancel="${message(code: 'label.cancel')}" label="${message(code: 'label.delete')}" icon="trash" />

bradleybeddoes

httpRedirect.location.uri == "http://idp.test.com/SAML2/redirect/SSO"
|            |        |   |
|            |        |   false
|            |        |   1 difference (97% similarity)
|            |        |   http://idp.test.com/SAML2/(R)edirect/SSO
|            |        |   http://idp.test.com/SAML2/(r)edirect/SSO