Programmatically configuring an WCF service without using .config files (using FluentSharp REPL)

This post will show how to consume an WCF service directly, firstly using VisualStudio and secondly using the O2 Platform C# REPL environment.

The VisualStudio example will use the FluentSharp – C# REPL NuGet package (which will also show how to dynamically program the WCF service in a REPL environment

Part 1) The WCF test service

In VisualStudio start by creating a new WCF Service Library project called WcfServiceLibrary1

Viewing Eclipse and SWT objects (Workbench, Display and Shell) using Groovy's ObjectBrowser and using TeamMentor's Plugin ObjectBrowser

Using the Groovy REPL included in TeamMentor's Eclipse Plugin (see update site and more info here, here, and here) it is possible to view in real time a number of Eclipse/SWT objects (for example the Workbench, Display or Shell )

Using Groovy's ObjectBrowser:

Let's start with Groovy's ObjectBrowser which I used to use just about every day, since it gave me access to a live view of an particular Object's Fields, Properties (from getters) and Methods.

Research on Azure WebSite security: Process Execution (cmd.exe, git.exe, node.exe, xyz.exe) and Folder Browsing (outside azure root)

Following the presentation I did a couple weeks ago at the UK Azure user-group event (http://ukwaug.net/events/security-compliance/), here are my rough notes on my research (for a couple hours/days before the event)

Using  DotNet_ANSA (see end of post for more info about this tool) I was able to show a number of security issues that exist with Azure Websites

BUT (Important disclaimer):

• I was not able to see data from other Azure websites hosted on the same server (since I was limited by the IIS user account used)
• This happens because of running .NET code under Full Trust (which is the default in most ASP.NET apps, since partial trust is dead now)
• Although this is nothing new, I was surprised by the number of ASP.NET Azure specialists that were not aware that it was possible to (for example) browse files/folders outside the allocated folder and start new processes on the azure server
• These are ‘Security Issues’ and ‘Areas of concern’ for Azure (and other) deployed websites.
• These are not ‘Security Vulnerabilities’ since they happen by ‘design’
• The key is to make sure that all parties understand that this is possible (namely remove process execution on cloud/hosted services)
• I didn’t upload any exploits or metasploit-like tools (since that would be pushing my Azure testing a bit too far), but as far as I can see, they should work 
• I didn't spent a lot of time on this, and there are a number of other research areas that should be pursued

Installing NDepend

After a nice correspondence with NDepend’s Patrick Smacchia who offered me a license of in exchange for some blog posts on how I used it, here is my first one covering the installation and first run

If don't know about NDepend, here are some references :

• on NDepend Website:
• Getting Started
• Features
• CQL Syntax , CQL Features and CQL Rules Help 
• API
• Exploring Existing Code Architecture in Visual Studio 
• NDepend on Wikipedia (with more references links)
• Pattrick's blog 
• Other blog posts and articles:
• .NET Tools: NDepend static analysis tool, leave T-Pain behind. 
• Educating Programmers with Placemats - NDepend Static Analysis Poster  which talks about this NDepend Metrics pdf
• Exiting The Zone of Pain - Static Analysis with NDepend 
• Continuous code quality measurement with NDepend and TeamCity 
• Static Code Analysis based on NDepend 

Controlling Selenium and Chrome WebDriver from a C# REPL GUI (while fixing UnitTest)

When I was Running TeamMentor WebAutomation UnitTests locally (using Selenium and ChromeDriver), there were a number of TeamMentor's UnitTests that failed, and could not be fixed with simple changes or re-execution

This post shows how I used the O2 Platform's FluentSharp REPL script_Me capabilities to debug the problem and find a solution.

Minecraft In-Game C# REPL

This is really cool, just saw on this reddit thread the video below which shows a REPL inside minecraft

This is part of C# Minecraft written in C#:

• https://github.com/SirCmpwn/PartyCraft
• http://sircmpwn.github.io/PartyCraft/ and https://github.com/SirCmpwn/PartyCraft
• Another powerful video: writing a Minecraft Classic server from scratch in 6 hours. 

(grab a coffee first) Using AST to programatically create a Proxy class for a WSDL webservice (in this case HacmeBank and Checkmarx ASMX)

For this past week I worked on a way to intercept and change data returned from an C# ASMX web service (exposed via a WSDL)

After trying multiple options (including PostSharp), I found a way to:

Programatically use AST C# generation (from ICSharpCode.NRefactory and O2 Platform's FluentSharp.REPL APIs) to:

• create a 'proxy' C# of  an ASMX with the same exposed web methods as the original one
• by default the new proxy ASMX WebService will call the original WebService's method (think class A implements class B, with all methods in class A calling the base method from class B)
• make it easy to extend the new ASMX WebService  C# code and change the data sent/received from/to the original WebService's methods.

While I was working on the solution, I created a number of (long) blog posts that explains in detail all the steps I took to create the 'proxy' C# of  an ASMX.

Here are they, ordered by creation date (so if you want to see the final result, look at the last one)

Using WebServices Proxy Wrapper to replace Checkmarx’s CWE Guidance with TeamMentor’s Articles

After Creating a WebServices Proxy Wrapper for Checkmarx’s CxWebService its time to replace the existing guidance with TeamMentor’s articles.

We start with a folder containing the CxWebService.asmx

Creating a WebServices Proxy Wrapper for Checkmarx’s CxWebService

Now that we have the an API to create proxies (see Creating an API to create the WebServices Proxy Wrapper classes/asmx files) its time to create the proxy I really need, which is the Checkmarx webservice responsible for (amongst other things) returning security guidance (see Adding O2's CSharp REPL to the Checkmarx main WebService for more details)

Currently I have the latest version of Checkmarx installed on my dev box, which uses the UltraDev web server:

Running the Asmx WebServices WebMethod invocation wrapper on a local WebServer (i.e Hacmebank UserManagement.asmx)

After the Creating an Lambda Method that creates an Asmx WebServices WebMethod invocation wrapper post, the next step is run the proxy class as a local webservice and consume it from HacmeBank.

Following from the code sample in the last blog post, I did a bit of refactoring so that the both files (the original WSDL C# file and the wrapper file) are saved on the same local folder.

Also the CSharp generation is now on a separate lambda method:

Creating an API to create the WebServices Proxy Wrapper classes/asmx files

Following from Running the Asmx WebServices WebMethod invocation wrapper on a local WebServer (i.e Hacmebank UserManagement.asmx) the next step is to wrap this code in an easy to consume API.

So let’s open the O2 Development Environment tool (available from the main O2 platform menu)

Creating an Lambda Method that creates an Asmx WebServices WebMethod invocation wrapper

After the Using AST to programmatically create an Asmx WebServices WebMethod invocation wrapper post, the next step is to create an API that helps in the creation of such ‘WebServices proxies’

Using the same technique described on the Creating a REPL editor that is linked to a Code editor post , here is a first code snippet with:

• An WSDL generated C# file is loaded and assigned into the object fileAst
• The type/class with the base class of System.Web.Services.Protocols.SoapHttpClientProtocol was assigned to the object wsClass
• The Login WebService’s WebMethod was assigned to the object loginMethod
• A new Ast Type (based on name of the wsClass) was added to the compilationUnit object, and assigned to the object wrapperType
• The loginMethod was added to the wrapperType object
• The CSharp representation of the compilationUnit object was created and showed in the codeEditor (with *.cs syntax colouring)

Using AST to programmatically create an Asmx WebServices WebMethod invocation wrapper (for HacmeBank)

Following the Creating a REPL editor that is linked to a Code editor and a Using AST technology (from ICSharpCode.NRefactory) to script the creation of a C# file  posts, here is how use AST technology to create a wrapper for HacmeBank web services:

Using AST technology (from ICSharpCode.NRefactory) to script the creation of a C# file (using O2's C# REPL editor)

Sometimes the best/only way to create a script is to codify it (i.e with another script).

In this post I’m going to show how the O2’s FluentSharp APIs can be used to create valid C# code that can then be compiled and executed.

There is already a huge amount of C# AST APIs and extension methods in the FluentSharp.REPL which we will use to dynamically create a C# script (i.e. we are going to create an AST object which will then create a C# source code file)

Here are some of the APIs we are going to use:

Creating a REPL editor that is linked to a Code editor (with detailed step-by-step description of how I use O2 to 'evolve an C# UI via quick REPL')

Today I needed to script the creation of a C# script needed a C# REPL that was linked into a Code Editor (to make code development faster).

Since there wasn’t such script in the O2.Platform.Scripts library, I quickly created one.

This post shows how I created this script

Adding O2's CSharp REPL to the Checkmarx main WebService

I’m working on the integration of TeamMentor with Checkmarx and needed to have some control on how the data the WebServices returns.

The previous version of this integration made direct changes to the Checkmarx content database, but this time around that will not work, since for example CheckMarx maps it’s guidance to CWE_ID and we want to map the guidance to the Checkmarx’ Query_ID (TeamMentor has technology/application specific guidance, so we can show an SQL Injection article for Java and a different article for .NET (both have the same CWE_ID, but have different Query_ID)

Initially I was going to use PostSharp to add the TM specific code ‘on top’ of Checkmarx dlls, but since in effect this would mean the modification of CheckMarx dlls (to insert PostSharp aspects), I went for an hook on Http Pipeline instead :)

Practical Example of using Web CSharpREPL in TeamMentor’s development/customizations

Kofi asked me a couple days ago for practical examples of using the CSharpRepl that is included in TeamMentor’s Admin pages.

Well here is one.

I am currently writing a couple customizations for a TeamMentor client which are deployed/applied via the (new to 3.3.) UserData WebRoot_Files folder.

Is RNGCryptoServiceProvider is 'fast enough' to create a GUID (and using O2’s C# REPL to quickly test some C# code (i.e. s)

Earlier today Kofi (TM Dev) asked me if we could use the .NET's RNGCryptoServiceProvider (see Generating Cryptographically Secure Random Numbers) to create GUIDs:

Using CSharpRepl to batch change TeamMentor’s users email and settings

While deploying the 3.3. version of TeamMentor into the multiple servers we maintain, there are a number of edge cases that are usually a pain to deal with, but now that TM has the ability to run C# scripts directly on a server, I can codify the transformations required :)

The two problems I’m going to deal here are:

• Batch setting the email based on the username
• Batch setting the Account expiry date (based on a search)

Note that on both cases I’m going to first do the changes into a locally hosted version of TM that is consuming the respective UserData GitHub repo (and if anything goes wrong, I’m a git stash or git reset away from a clean start)

Running Customized C# code loaded from TeamMentor’s UserData repository

A really powerful feature of TeamMentor 3.3. is its ability to run CSharp Scripts included in the mapped UserData repository (script execution is powered by O2 Platform's FluentSharp APIs).

This blog post shows how it works