Solutions for elusive IT issues

In Java world, JNDI (Java Naming and Directory Interface) is one very common method for applications to access server resources like data sources, EJB's, JMS queues, file stores etc. The security risk is that: Not only JNDI can be called by applications hosted in the same container, but also remotely. In an organization, application server admins do not take care of security risks unknowingly or neglect by assuming they or on a secure LAN. This exposes the resources to grave risk as anyone within LAN can access unauthorized data without being detected and abuse the system. ctx = null ; Properties env = new Properties (); env . put( Context . INITIAL_CONTEXT_FACTORY , "CONTEXT_FACTORY" ); env . put( Context . PROVIDER_URL , "CONTEXT_PROVIDER_URL" ); DataSource datasource = ( DataSource )initialContext . lookup( "DATASOURCE_CONTEXT_NAME" ); try { ctx = new InitialContext (env); Connection conn = datasource . getConnection(); //...

A high-security risk, leading to identity theft and impersonation. This security issue is mostly caused by lack of knowledge of security aspects on part of application developers/ architects. PROBLEM One person signs into a sun access manager policy-enabled application from a web browser. After completing his task, he signs out and goes home relieved of his/ her work. But this machine is in public access, say some kiosk or cyber cafe. Another user comes in and signs into the same application which the previous user used. Viola....he logs into an application as the first person instead. CAUSE Sun access manager is responsible for deleting cookies of the application, which stores session and may store some other credentials too. Now one can only delete the cookies that belong to it. So in case, Sun access manager agent resides in www.xyz.com domain (see the site URL in the address bar for respective sites), it cannot delete cookies from another application from www.abc.com ...

 There are many utilities like Xstream which can provide this functionality, but i did not find them easy to use, so i am putting this small utility to help unmarshelling complex objects into readable format for easier debugging. Most of the tools rely on toString method overrides to unmarshall the objects and fail to unwrap the multilevel nesting.   This code also converts strings containing xml or html into character data so that output remains readable in XML editors. There are two helper flags, sample output is as follows. 1. SIMPLE_TYPED = false and CANONICAL_TYPED = false  <ArrayList><String><String>mystery</String><Boolean><Boolean>true</Boolean><ArrayList><String><String>one</String><String><String>two</String></ArrayList></ArrayList> 2. SIMPLE_TYPED = true and CANONICAL_TYPED = false  <ArrayList:java.util.ArrayList><String:java.lang.String...