Raible Designs

OSCON 2007: Comparing Java Web Frameworks

This afternoon I delivered my Comparing Java Web Frameworks talk at OSCON in Portland. I told attendees I'd post it here afterwards, so here it is:Download Comparing Java Web Frameworks Presentation (5.1 MB)

For comments on this presentation from earlier this year, see related postings from ApacheCon EU and JA-SIG. This presentation is pretty much the same as the one from ApacheCon and JA-SIG, except it has a different theme and I chopped out the Sweetspots section (due to time constraints).

Portland is great this time of year, but unfortunately I won't be sticking around. I'm heading down to Salem to work remotely for a couple of days, returning for the Oregon Brewers Festival on Friday and heading back to Denver on Saturday. I'll be glad when July is over - I've traveled to a new state every week.

Java Web Frameworks and XSS

In preparation for my talk at OSCON next week, I've been doing some research on cross-site scripting and how good Java web frameworks handle it. I'm disappointed to report that the handling of XSS in Java web frameworks is abysmal. First of all, the JSP EL doesn't bother to handle XSS:

With JSP 2.0 you can use the following to emit the description of a "todo" item:
${todo.description}
That's pretty nice. What happens when someone has entered a description like this?
<script type="text/javascript">alert('F#$@ you!');</script>
Well, it executes the JavaScript and pops up a nice little message to you.
...
My question is this: Why in the world did the expert group on the JSP 2.0 JSR decide to make not escaping XML content the default for EL expressions, when they made the opposite decision for c:out?

(Emphasis mine) If a company/developer wants to make sure their JSP-based code is not susceptible to XSS, they have two choices (as I see it):

• Do lots of code review to make sure <c:out> is used instead of ${}.
• Hack the jsp-compiler/el-engine to escape XML by default.

The good news is #2 doesn't seem to be that hard. I pulled down commons-el yesterday, added a hack to escape XML, re-jarred and put it in Tomcat 5.0.25's classpath. This actually worked and I was impressed it was so easy. However, when I looked at Tomcat 6, commons-el is no longer used and now there's a "jasper-el.jar" in the lib directory. I don't mind modifying another library, but what's the difference between jasper-el and commons-el?

Of course, the whole problem with JSP EL could be solved if Tomcat (and other containers) would allow a flag to turn on XML escaping by default. IMO, it's badly needed to make JSP-based webapps safe from XSS.

On a related note, there's a couple of web frameworks that I've found to be susceptible to XSS: namely Spring MVC and Struts 2. For Spring MVC, its <form:input> and <form:errors> tags are vulnerable. For Struts 2, OGNL expressions are evaluated, which is way worse than XSS and actually allows you to shutdown the JVM by putting %{@java.lang.System@exit(0)}" in a text field.

Even though it was surprising for me to see the issues with Struts 2 and Spring MVC, I'm somewhat glad they exist. If I hadn't discovered them, I might blissfully think that Java web frameworks aren't susceptible to XSS. However, it appears they're not only susceptible, but no one is really thinking about XSS when developing these framework. To further prove that theory, the Spring MVC and Struts 2 teams are aware of these issues, have been for quite some time - yet they've done nothing in the form of releasing upgrades or patches.

Seems kinda strange doesn't it?

Mountain View Tech Meetup

Like I mentioned a few weeks back, a few of us are going to get together this week for a tech meetup. Wednesday (tomorrow) looks like the best night for most. The only question is where? Please leave any suggestions in a comment. Most of the guys coming (so far) work in Mountain View, so it'd be nice to do something close by. 6:00 seems like a good time to start.

What is a tech meetup? It's a user group meeting w/o the meeting part. You go straight to the bar, grab some drinks, maybe some dinner, and talk tech.

Update: We have a location! The Blue Chalk Cafe in Palo Alto. Hope to see you there tomorrow at 6.

How popular is your web framework?

From the Struts user mailing list:

Since its release in June 2001, Apache Struts has become the most popular web framework for Java. Six years later, by any objective measure, Struts is still Java's most popular web framework.

In February and March 2007, the group released both Struts 1.3.8 and Struts 2.0.6 to the general public, and Struts downloads zoomed to over 340,000 a month from the Apache site alone. And this is just the tip of the iceberg. Most copies of Struts are downloaded from an network of mirrors or obtained from Maven repositories.

So how popular is Struts compared to the other heavy hitters like Spring and Hibernate? Spring has about 1/2 as many (80K) downloads in the same period and so does Hibernate. How do MyFaces, Wicket and Tapestry stack up? Here's their best download numbers in the past few months:

• MyFaces: ~12K (and that's only because of a rate 3-times-normal spike)
• Tapestry: ~12K
• Wicket: ~10K

Sorry JSF, you appear to be losing. Badly. This is an incorrect statement as pointed out by commentors. Thanks for keeping me honest guys.

Disclaimer: Yes, I realize that these statistics are not very accurate, especially considering Maven. Unfortunately, until Maven has repository download stats, this information is the best we've got.

AppFuse 2.0 Status Update

It's been far too long since the release of AppFuse 2.0 M5. When we released that version, I fully expected to finish up RC1 a week or two later, and follow that with 2.0 Final a week later. Fast forward a month and a half, and there's still 38 issues left for 2.0 RC1. What happened?

Life got in the way.

There's probably less than 40 hours left to complete 2.0. I could say that I haven't had the time, but you all know that's a lie. Everyone has time. When someone says "I don't have time to do X right now", this really means "that's not on my priority list and I'm not going to make time to do it". So unfortunately AppFuse hasn't been on my priority list. Finding a new gig, vacationing with my family and buying a new mountain bike were on my priority list.

So if there's only 40 hours worth of work left, why didn't I just work a couple hours a day on it? Primarily because when I work on AppFuse it possesses me. I tend to get caught up in it and it's tough for me to concentrate on other things, especially work that I'm supposed to be doing during the day. Since I've had two new clients in the past few weeks, I've been aware of this and purposely stayed away from working on it.

The good news is things should settle down soon. I have a couple weekends on the horizon that look to be free, so hopefully I can crank it out and finish it up in the next month or so. As far as the project itself, there's plenty of users happily using the 2.0 milestone releases and there's still lots of traffic on the mailing list. It's crazy to think that the planning for AppFuse 2.0 started over a year ago and development started one year ago next month. If I knew it'd take this long, would I still have done it? Absolutely. I've never heard so many positive comments from users.

In other AppFuse News, Contegix has graciously donated an entire managed server to the project. We have licenses for the Atlassian Suite (JIRA, Confluence, Bamboo and Crowd) and will be moving/installing everything over the next week or so.

Thanks Contegix!

As anyone that uses them knows, they're simply the best hosting company in existence today. Their customer support and response time is incredible.

First Day at LinkedIn

Today was my first day onsite at LinkedIn in Mountain View, California. I'm very impressed by two things so far: they gave me a new MacBook Pro and Sushi is on tap for lunch tomorrow. Of course, there's a lot more impressive things going on there, but the new MacBook was today's highlight. The strange thing is I don't need one - I just got a new 17" a few months ago. Nevertheless, I received and configured a new 15" today. It's not the machine that impresses me, but the company's willingness to buy the best machines for its developers.

I was introduced to almost the entire company this morning, and I only saw one Windows machine in a sea of Macs. My favorite quote? "If the MacBook Pro isn't fast enough for you, we can see about getting you a Mac Pro." I like a company that knows what developers like and doesn't have a problem treating them well.

The last time I received a new computer as part of a contract or full-time position? I believe that was way back in 2002. Working at LinkedIn seems like a developer's paradise. Does your company provide new MacBook Pros and Cinema Displays to its developers?

JA-SIG Keynote: Comparing Java Web Frameworks

This morning I did my first keynote at the JA-SIG Summer Conference in Denver. My talk was on Comparing Java Web Frameworks. I told attendees I'd post it here afterwards, so here it is:Download Comparing Java Web Frameworks Presentation (1.1 MB)

In addition, I mentioned my Java Web Frameworks Sweetspots Whitepaper.

Will I be comparing web frameworks at conferences for the rest of my life? Possibly. I've been submitting 2-3 proposals to conferences and it's the only one that keeps getting selected. I'll be delivering it at OSCON, JavaZone, Colorado Software Summit and ApacheCon US.

The Colorado Software Summit wants to have an original presentation - so I may need to drop a framework or two and add in Seam, Grails and GWT. If you are planning on attending one of these talks, which frameworks would you like to see compared?

Related: Comments after I delivered this presentation at ApacheCon EU.

Wicket Graduates

From the Wicket user mailing list:

We have Graduation! Apache Wicket is established as a top level project within the Apache Software Foundation.

Congratulations to the most enthusiastic and passionate web framework development team in Javaland!

Webinar on Wednesday: Introduction to Apache Roller

If you're not doing anything this Wednesday, you might want to checkout my Introduction to Apache Roller Webinar. It's sponsored by Covalent and has the following agenda:

11:00: Introductions
11:05: What is Apache Roller 
11:10: Installing Roller
11:20: Roller Architecture
   - 11:25: Blog Customization
   - 11:35: Server Customization
11:40: Other Features: Using Weblog Clients and Planet
11:50: Q & A

Heck, even if you are doing something, you should still check it out - especially if you're planning on installing Roller for yourself or for your company. Here's the details and how to signup:

To register, click here and follow the provided steps.

About Covalent and Roller
Covalent recently announced it is offering full commercial support for Apache Roller, the open source blog server from the Apache Software Foundation (ASF). Apache Roller drives the Covalent blog, Sun Microsystem's blogs.sun.com blogging site, IBM DeveloperWorks blogs, the Javalobby's 10,000 user strong JRoller Java community site, and hundreds of other blogs world-wide. Roller is a Java Web application that is run on any Java EE server and any relational database.

<Sidenote/>
I think it's important to point out that JRoller and Roller are not the same thing. JRoller is a service provided by JavaLobby that provides free blogs, whereas Roller is the software that powers it. There's been a lot of negative press about JRoller in recent months and from talking to folks, it sounds like most of it is well-deserved. The service is down a fair amount and when it's up, it's extremely slow.

The good news is these problems should go away in the near future. From Matthew Schmidt in a recent JavaLobby Newsletter:

DZone Network Server Upgrades Coming
Over the weekend, Rick and I started the long and painful process of finally upgrading our three-year-old servers to some hardware that should let us scale and meet the needs of the network for the foreseeable future. With these new servers, comes some upgrades that many of you have been trying to beat into my head for months now, including an upgrade to a recent a version of Roller (powers JRoller) as I can find, and an upgrade to the latest and greatest Codebeamer (powers JavaForge). In addition, there's also going to be a much-needed make over to Javalobby and EclipseZone. Of course, these changes won't happen immediately and we'll be migrating to the new hardware first, but keep your eyes open for some nice updates to nearly all our communities. These upgrades have already started and we'd appreciate any feedback you have on whether things like Javalobby and EclipseZone are working properly. Drop me a line if you notice anything not working properly or feeling slow.

IMO, JavaLobby has been mostly mute about its stance on JRoller, and I've heard from folks there's virtually no support. My guess is this is because they've been concentrating on DZone so much. Maybe they need some volunteers to make JRoller more robust? Or maybe it should be moved to other servers that can make money off the service and re-invest it (like wordpress.com)? Hopefully nothing has to change and JRoller can become a higher priority for JavaLobby in the near future.

Update: The webinar went quite well - thanks to everyone who attended! You can download the PowerPoint (or PDF) and audio from Covalent's Webinars. Also, I mentioned a couple of Dave's presentations in my talk. You can download those by clicking on the links below:

• Roller: An Open Source Java EE Blogging Platform
• Roller and blogs as a web development platform

JAR Hell with XFire 1.2.6

I discovered something somewhat disturbing last week. As part of AppFuse 2.0 M5, we added "xfire-all" as a dependency so web services could be supported out-of-the-box. What I didn't know is that xfire-all has transitive dependencies to 40 other libraries, which total 13.4 MB in size. Yikes!

Does XFire take the cake for the most bloated library you can use or are we just including too much (xfire-all vs. fine-grained dependencies)? I tried changing to the recommended Maven configuration and there's still 28 JARs added by XFire.

The WEB-INF/lib directory of a basic Struts 2 + Spring + Hibernate AppFuse application is already 19.2 MB to start. Adding XFire for web services increases the size to 29.2 MB. While disk space may be cheap, some users have noticed "mvn jetty:run" is much slower with XFire (presumably from the JAR processing that happens at startup). Is there an uber XFire JAR we can use instead?