October 2004 - Posts

Monad timetable

Paul Thurrott writes at  http://www.winnetmag.com/Article/ArticleID/44294/Windows_44294.html that Monad will be available on Longhorn Server. I hope that Monad will ship much much earlier as a "go-live" Beta2/3 with Whitbey and Yukon.

favorite classes in .NET 2.0

reject a user/web request with following classes 

IPAddressRestriction

IPDomainRestriction
IPRestriction
IPRestrictionCollection
IPSecurity

to insert lots of stuff fast into sql server use (using some funnel pattern):

SqlBulkCopy
SqlBulkCopyColumnMapping
SqlBulkCopyColumnMappingCollection

 

Myth debunking: SQL Server vs MySQL security 2003-2004(SQL Server has less bugs !!)

MS SQL Server (or MSDE) vs MySQL

Seems that yet again a MS product has less bugs that the corresponding LAMP product (here are unscientific reports for ASP.NET vs PHP and IIS6 vs APACHE)

MSSQL    2003    12 
MySQL    2003     12 + 1 multiple (2003-10-30:  MySQL Multiple Vulnerabilities )

MSSQL     2004    3 
MySQL      2004    8

Am sure everybody will get (yet again) into splitting hairs as which is more or less secure, depending on
lines of code, number of installations, Service Packs vs latest build, etc etc

This is the list:

  2004-10-07:  MySQL MaxDB WebDBM Server Name Denial of Service Vulnerability
  2004-09-30:  MySQL Unspecified Insecure Temporary File Creation Vulnerability
  2004-09-27:  MySQL Bounded Parameter Statement Execution Remote Buffer Overflow Vulnerability
  2004-09-07:  MySQL Mysqlhotcopy Script Insecure Temporary File Creation Vulnerability
  2004-07-08:  MySQL Authentication Bypass Vulnerability
  2004-07-05:  MySQL Password Length Remote Buffer Overflow Vulnerability
  2004-05-25:  MySQL MYSQLD_Multi Insecure Temporary File Creation Vulnerability
  2004-05-25:  MySQL Aborted Bug Report Insecure Temporary File Creation Vulnerability
  2003-11-24:  MySQL Password Handler Buffer Overflow Vulnerability
  2003-10-30:  MySQL Multiple Vulnerabilities
  2003-09-18:  MySQL mysqld Privilege Escalation Vulnerability
  2003-09-18:  MySQL Double Free Heap Corruption Vulnerability
  2003-07-22:  MySQL AB ODBC Driver Plain Text Password Vulnerability
  2003-06-12:  MySQL libmysqlclient Library mysql_real_connect() Buffer Overrun Vulnerability
  2003-05-12:  MySQL COM_CHANGE_USER Password Memory Corruption Vulnerability
  2003-05-12:  MySQL libmysqlclient Library Read_One_Row Buffer Overflow Vulnerability
  2003-05-12:  MySQL COM_CHANGE_USER Password Length Account Compromise Vulnerability
  2003-05-12:  MySQL libmysqlclient Library Read_Rows Buffer Overflow Vulnerability
  2003-05-12:  MySQL COM_TABLE_DUMP Memory Corruption Vulnerability
  2003-05-05:  MySQL Weak Password Encryption Vulnerability
  2003-03-07:  MySQL Control Center Insecure Default File Permission Vulnerability


  2004-08-24:  Microsoft SQL Server User Authentication Remote Buffer Overflow Vulnerability
  2004-04-14:  Microsoft Remote Procedure Call Service DoS Vulnerability
  2004-04-07:  Microsoft SQL Server 2000 Resolution Service Stack Overflow Vulnerability
  2003-07-25:  Microsoft SQL Server / MSDE Named Pipes Privilege Escalation Vulnerability
  2003-07-25:  Microsoft SQL Server LPC Port Request Buffer Overflow Vulnerability
  2003-07-25:  Microsoft SQL Server / MSDE Named Pipe Denial Of Service Vulnerability
  2003-07-25:  Microsoft SQL Server / MSDE Multiple Vulnerabilities
  2003-07-15:  Microsoft SQL Server JET Database Engine 4.0 Buffer Overrun Vulnerability
  2003-06-16:  Microsoft SQL Server 2000 Resolution Service Heap Overflow Vulnerability
  2003-06-04:  Microsoft SQL MS Jet Engine Unicode Buffer Overflow Vulnerability
  2003-02-01:  Microsoft SQL Server 7.0/2000 DBCC Buffer Overflow Vulnerability
  2003-02-01:  Microsoft SQL Agent Jobs Privilege Elevation Vulnerability
  2003-02-01:  Microsoft SQL Server Extended Stored Procedure Privilege Elevation Vulnerability
  2003-01-27:  Microsoft SQL Server Web Task Stored Procedure Privilege Escalation Vulnerability
  2003-01-25:  Microsoft SQL Server 2000 Bulk Insert Procedure Buffer Overflow Vulnerability

(Figues provided by http://www.securityfocus.com/bid/vendor/)

Download manager in C# with BITS (Background Intelligent Transfer Service)

Download Manager in C#

I' ve used the wrapper of the Background Intelligent Transfer Service (BITS) from http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnwxp/html/WinXP_BITS.asp, the tecnology behind Automatic Windows Updates and modified the given sample winforms app slightly to allow adding new items to download.

It is very simple, but to work , you need to download and install the .MSI from http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnwxp/html/WinXP_BITS.asp and add Microsoft.Msdn.Samples.BITS.dll as refrence in VS.

You can find the code at http://www.xpertdotnet.com/code/Form1.cs.txt

some links with BITS (Background Intelligent Transfer Service)

http://www.kbcafe.com/iBLOGthere4iM/?guid=20040904223316
http://weblogs.asp.net/sbchatterjee/archive/2003/06/12/8585.aspx
http://dotnetjunkies.com/WebLog/demiliani/archive/2004/08/26/23309.aspx
http://weblogs.asp.net/mikehall/archive/2004/07/11/180144.aspx
http://pensieve.thinkingms.com/CommentView,guid,3cbfe252-63b5-47da-a27a-74de0d79a6a7.aspx

export datagrid to excel

this code can be run outside of page, or can be converted to run in and extended datagrid control

imports System.Drawing
Imports System.Web.UI
Imports System.Web.UI.WebControls

Namespace demetz


    Public Class DemExportGridExcel

        Sub RenderGridToExcelFormat(ByVal grid As DataGrid, ByVal saveAsFile As String)
            ' check Excel rows limit
            If grid.Items.Count.ToString + 1 < 65536 Then
                HttpContext.Current.Response.Clear()
                HttpContext.Current.Response.ContentType = "application/vnd.ms-excel"
                HttpContext.Current.Response.AddHeader("content-disposition", "attachment;filename=" & saveAsFile & ".xls")
                ' Remove the charset from the Content-Type header.
                HttpContext.Current.Response.Charset = ""
                'HttpContext.Current.Response.WriteFile("style.txt")
                ' Turn off the view state.
                grid.EnableViewState = False
                Dim tw As New System.IO.StringWriter()
                Dim hw As New System.Web.UI.HtmlTextWriter(tw)
                ' Get the HTML for the control.
                grid.HeaderStyle.ForeColor = Color.Black
                grid.HeaderStyle.BackColor = Color.Red
                grid.ItemStyle.ForeColor = Color.Black
                grid.BorderColor = Color.White
                ClearControls(grid)
                grid.RenderControl(hw)
                ' Write the HTML back to the browser.
                HttpContext.Current.Response.Write(tw.ToString())
                ' End the response.
                HttpContext.Current.Response.End()
            Else
               
                HttpContext.Current.Response.Write("Too many rows - Export to Excel not possible")
            End If
        End Sub

        Sub ClearControls(ByVal control As Control)
            Dim i As Integer
            For i = control.Controls.Count - 1 To 0 Step -1
                ClearControls(control.Controls(i))
            Next i

            If TypeOf control Is System.Web.UI.WebControls.Image Then
                control.Parent.Controls.Remove(control)
            End If

            If (Not TypeOf control Is TableCell) Then
                If Not (control.GetType().GetProperty("SelectedItem") Is Nothing) Then
                    Dim literal As New LiteralControl()
                    control.Parent.Controls.Add(literal)
                    Try
                        literal.Text = CStr(control.GetType().GetProperty("SelectedItem").GetValue(control, Nothing))
                    Catch
                    End Try
                    control.Parent.Controls.Remove(control)
                Else
                    If Not (control.GetType().GetProperty("Text") Is Nothing) Then
                        Dim literal As New LiteralControl()
                        control.Parent.Controls.Add(literal)
                        literal.Text = CStr(control.GetType().GetProperty("Text").GetValue(control, Nothing))
                        control.Parent.Controls.Remove(control)
                    End If
                End If
            End If
            Return
        End Sub 'ClearControls

    End Class

End Namespace