teleren/devto huggingface dataset:
Configure your Java XML-parsers to prevent XXE
Tags: java, security, xml, xxe
Published: 2019-12-12 12:31:11


With XML eXternal Entity (XXE) enabled, it is possible to create a malicious XML, as seen below, and read the content of an arbitrary file on the machine. It’s not a surprise that XXE attacks are part of the OWASP Top 10 vulnerabilities.Java XML libraries are particularly vulnerable to XXE injection because most XML parsers have external entities by default enabled.  

```xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!DOCTYPE bar [
       <!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<song>
   <artist>&xxe;</artist>
   <title>Bohemian Rhapsody</title>
   <album>A Night at the Opera</album>
</song>
```

A naive implementation of the DefaultHandler and the Java SAX parser, like that seen below, parses this XML file and reveal the content of the passwd file. The Java SAX parser case is used as the main example here but other parsers, like DocumentBuilder and DOM4J, have similar default behaviour.

```java
SAXParserFactory factory = SAXParserFactory.newInstance();
SAXParser saxParser = factory.newSAXParser();

DefaultHandler handler = new DefaultHandler() {

    public void startElement(String uri, String localName,String qName,Attributes attributes) throws SAXException {
        System.out.println(qName);
    }

    public void characters(char ch[], int start, int length) throws SAXException {
        System.out.println(new String(ch, start, length));
    }
};

```
Changing the default settings to disallow external entities and doctypes for [xerces1](https://xerces.apache.org/xerces-j/) or [xerces2](https://xerces.apache.org/xerces2-j/), respectively, prevents these kinds of attacks.

```java
...
SAXParserFactory factory = SAXParserFactory.newInstance();
SAXParser saxParser = factory.newSAXParser();

factory.setFeature("https://xml.org/sax/features/external-general-entities", false);
saxParser.getXMLReader().setFeature("https://xml.org/sax/features/external-general-entities", false);
factory.setFeature("https://apache.org/xml/features/disallow-doctype-decl", true); 
...
``` 


For more hands-on information about preventing malicious XXE injection, please take a look at the [OWASP XXE Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)

This was just 1 of 10 Java security best practices. Take a look at [the full 10](https://snyk.io/blog/10-java-security-best-practices/) and the easy [printable one-pager](https://snyk.io/blog/10-java-security-best-practices/) available
How to connect to a PostgreSQL database from Python with Psycopg2 [Video]
Tags: javascript, python, beginners
Published: 2019-12-12 12:20:14

---
title: "How to connect to a PostgreSQL database from Python with Psycopg2 [Video]"
published: true
description: "Are you learning Python? Do you want to get serious and scratch your own hitch with PostgreSQL? Learn how to connect to a PostgreSQL database from Python!"
tags: javascript, python, beginners
canonical_url: https://www.youtube.com/watch?v=JLXep5DQTqM
---

_Are you learning Python? Do you want to get serious and scratch your own hitch with PostgreSQL? Learn how to connect to a PostgreSQL database from Python!_

{% youtube JLXep5DQTqM %}
What's the difference between __proto__ and prototype?
Tags: javascript, typescript, react, angular
Published: 2019-12-12 12:11:47

The __proto__ a reference works on every object to refer to its [[Prototype]]property.

The prototype is an object automatically created as a special property of a function, which is used to store the properties (including methods) of a function object.
With these two, we could mentally map out the prototype chain. 

![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/tr3cwpfhx5pfvistoqji.png)

#As an Example,
<div style="background: #ffffff; overflow:auto;width:auto;border:solid gray;border-width:.1em .1em .1em .8em;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #008800; font-weight: bold">function</span> Foo() {}

<span style="color: #008800; font-weight: bold">var</span> b <span style="color: #333333">=</span> <span style="color: #008800; font-weight: bold">new</span> Foo();

b.__proto__ <span style="color: #333333">===</span> Foo.prototype <span style="color: #888888">// true</span>
Foo.__proto__ <span style="color: #333333">===</span> <span style="color: #007020">Function</span>.prototype <span style="color: #888888">// true</span>
<span style="color: #007020">Function</span>.prototype.__proto__ <span style="color: #333333">===</span> <span style="color: #007020">Object</span>.prototype <span style="color: #888888">// true</span>
</pre></div>

#You should check out the <a href="https://www.code-sample.com/2015/04/javascript-interview-questions-answers.html" target="_blank">docs.</a>
Bootcamp 2019
Tags: freshers, bootcamp, initiation
Published: 2019-12-12 11:59:14


At [SoluteLabs](https://www.solutelabs.com/), we conducted a one-day workshop for our new joiners who will intern and hopefully turn into full-time employees in no time.

To ease their transition into this Corporate Jungle, we conduct a one-day workshop for them to play games, connect with each other, have good food and get to know first hand about what it means to join Solutelabs and how this marks an end to their (mostly carefree) university life!
Short syntax mediaquery utility?
Tags: help
Published: 2019-12-12 11:58:03

There are various custom mediaquery syntaxes out there within container/element queries libs having syntaxes like `100px <= width < 500px` and so on, but does anyone know of an utility that only focuses on expanding short custom media queries into full queries that can then be passed to `matchMedia` or be used together with Styled Components?

I tried to have a look at NPM, but didn't really find anything that would focus on this specific issue.
.NET Core 3.1 Release New Features
Tags: netcore, dotnetcore31, dotnetcorenewrelease
Published: 2019-12-12 10:45:28

Microsoft has released the new version of .NET Core 3.1 with the resolution of all errors and drawbacks of .Net Core 3.0. It allows the developers to work efficiently with C++/CLI throughout different Operating Systems. As per the Microsoft team, no provision of further changes is required for the next 3 years. So, this version is considered a more stable software application.
**[>>> Subscribe YouTube Channel] (http://bit.ly/2lSE3r6)**
{% link https://dev.to/anjankant/visual-studio-learn-free-webscriping-in-easy-10-steps-data-mining-htmlagilitypack-linq-618 %}
Hence, it’s recommended to [Download Visual Studio 2019](https://visualstudio.microsoft.com/vs/) version 16.4 instead of only .NET core 3.1 to get downloaded both Visual studio and ASP.NET core 3.1 together. It’s available for Windows, Linux, and macOS.


*Following new features are found in .Net Core 3.1*
##1. Preview channel option of Mac 8.4 OS##
Visual Studio version for Mac also supports along with .NET Core 3.1 for preview channel option of Mac 8.4 OS.

##2. Paying attention to Blazor and Windows Desktop##
The .NET Core 3.1 primarily focused on the two new and big additions in .NET Core 3.0 such as Windows Desktop and Blazor and also provides great support for C#, C++/CLI with CLR Class Library (.NET Core) and CLR Empty Project (.NET Core).

##3. Operating Systems##
*.NET Core 3.1 is compatible following operating systems:*

- openSUSE: 15+
- RHEL: 6+
- Debian: 9+
- Alpine: 3.10+
- Ubuntu: 16.04+
- Fedora: 29+
- SUSE Enterprise Linux (SLES): 12 SP2+
- macOS: 10.13+
- Windows Server: 2012 R2+
- Windows Client: 7, 8.1, 10 (1607+)
{% link https://dev.to/anjankant/asp-net-web-api-interview-questions-and-answers-3kk6 %}

*Please Note: Only the Win Forms and WPF apps are functioning and supported on Windows client.*

##4. Chip support##
- x86 on Windows
- x64 on Windows, Linux, and macOS,
- ARM64 on Linux (Use Linux kernel version 4.14 or later)
- ARM32 on Windows and Linux

##5. Which Controls of Win Forms are removed from .NET Core 3.1?
The .NET Core 3.1 has removed the Win Forms controls such as:##
- DataGrid
- ContextMenu
- Toolbar
- Menu
- MainMenu

[>>> Source Article &#8594;](https://www.technologycrowds.com/2019/12/release-of-new-version-net-core-3-1.html)
Nirmal Web Studio

Published: 2019-12-12 10:18:29

With over 12 years of experience in website development, we have a deep understanding on employing different web technologies and online strategies to make your website stand out. We offer a wide range of services that will fit your budget. And, our commitment to serve does not end there. We make sure that we satisfy your needs and provide you support services even after completing the project. For more details at: https://www.nirmal.com.au/services/ecommerce-website-design-sydney/
Wavesplatform introduction at BlockchainSpace Philippines Christmas Party
Tags: blockchain, wavesplatform, waves, philippines
Published: 2019-12-12 09:57:29

Thanks to BlockchainSpace Philippines for the opportunity to introduce @wavesplatform at their Christmas event. Lot of fun and meeting nice peoples. See you on next event everyone!

![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/amvfhtujgib4azze4mi9.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/rdwajccvnjme9x2p1g8d.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/6np6q7jp2qu2bvgprebi.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/nhpnbfwl93pyv2rijr6t.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/n1eznhtto68wk4k56zdi.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/r3l7k0sksp6hnddjxgn5.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/o8mzfsed937j29o9s40y.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/i7cki6lla1q6mgdpase6.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/3hy2iybyce7mb1wr1lop.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/93x4w02cxcmgvcjjyt8x.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/3k1k7a0vwxaxnq9ir2fp.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/hwhtco2fj6maoqo708he.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/3k3w4f69g78r0ssl1bw2.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/n46y45oa7innxjxbc8ft.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/azsmizef0cqfqy92y8xd.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/svp4ht1d6evc26kizpxu.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/gssy57z6d82c9zbion56.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/323b7e2tu7pb4uilm83e.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/0aeeyxf5r31qw6ax8io6.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/57c0j9qrojmt502upbri.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/uatesq73y6em5uz2yvgy.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/66q0wcgqi63lt18p34ix.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/ovxxyf899jm6jxqv71dg.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/9g87uy67zzkjcrny2bli.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/5u0fb87a031x6010kh0l.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/5qel9rx84x389r5o109v.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/n9714s781ezvubie0ugj.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/u7jinkstg54jooeb2swy.jpg)
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/dlafhvjdwjduigyjj4gw.jpg)
Targeting with ConfigCat: Releasing feature updates without risking your brand’s reputation 
Tags: featureflags, deployment, targeting
Published: 2019-12-12 09:23:32

### Don’t be a Snapchat, be an Instagram. 

Redesigns can be risky - just ask Snapchat. When their redesign went live in 2018, users were unimpressed. There will always be users averse to change and you cannot please everyone. Staged rollouts, however, can be used to manage and minimise backlash. 

ConfigCat streamlines feature flags, making user targeting and staged rollouts simpler. 

Suppose we have created a new direct message feature for our existing photo app. Using ConfigCat’s management console, we can create a flag to enable and disable this feature. 

![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/izzkrt3mubu8vzb86q3a.jpg)

We can then create a ConfigCat client in our python application. Using the feature flag key generated above, we can get the boolean value and use it in a conditional statement. 

```python
if __name__ == "__name__":
    configcat_client = configcatclient.create_client('<API Key>')
    direct_message_enabled =   configcat_client.get_value("directMessageEnabled"
    	, false)
    if direct_message_enabled:
        PhotoApp().run()
    else:
        PreviousPhotoApp().run()
```

Let’s roll out the update internally, this can be done by filtering on email addresses. 

![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/o09oripwp992nhtp1u3u.jpg)

Once we’re happy, we can release the feature to beta testers. ConfigCat allows us to create custom attributes for users. We can define an attribute ‘user_type’ and set it equal to ‘beta’ to identify beta testers. 

The attribute ‘user_type’ should be included when user objects are instantiated. 

```python
example_user = User('<Some ID>', 'user@example.com', 'Germany',
                     {'user_type': 'beta'})
```

We can then filter in all beta testers. 

![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/9hjgz3l95zumagt28ony.jpg)

Once we are ready to go live, it may be a good idea to release the feature to the public in stages, on the off chance something goes wrong. Sensitive users have been identified as the most at risk, it’s probably best to leave them for last. Let’s exclude sensitive users and target a portion of the remaining user base.

![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/lhv7afuyehymum852vy4.jpg)

Let’s include all the remaining users. 

![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/lvdaski5i5n376f8xvfs.jpg)

And finally, let’s enable the feature for sensitive users 

![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/8g68tkioyurf128of8nw.jpg)

It’s worth noting, ConfigCat also allows for more than just boolean type comparisons. Navigate [here](https://configcat.com/docs/getting-started.html) for more information on the Python SDK and other documentation.
Intro to Webhooks — Discord
Tags: bots, webhooks, discord, notifications
Published: 2020-03-31 03:37:17

---
title: Intro to Webhooks — Discord
published: true
date: 2019-12-12 08:59:43 UTC
tags: bots,webhooks,discord,notifications
canonical_url: https://medium.com/tech-epic/intro-to-webhooks-discord-666494224e61
---

### Intro to Webhooks — Discord

#### Webhooks are a low-effort way to post messages to channels in Discord. They do not require a bot user or authentication to use.

![](https://cdn-images-1.medium.com/max/1024/0*nEmx_NAfEwCOqvuO)<figcaption>Photo by <a href="https://unsplash.com/@corinnekutz?utm_source=medium&amp;utm_medium=referral">Corinne Kutz</a> on <a href="https://unsplash.com?utm_source=medium&amp;utm_medium=referral">Unsplash</a></figcaption>

Discord’s built in Webhooks function as an easy way to get automated messages and data updates sent to a text channel in your server. Think of them as one of those fancy pneumatic tube things you used to love sending money into at a bank and watch disappear, but instead of never seeing your money again, you’re actually sending messages into Discord from another platform.

1. Open your Server Settings Webhook tab:

![](https://cdn-images-1.medium.com/max/1024/1*MdEfnj9v6agLwQS3zeUcKg.png)

2. Click the purple button to create a new webhook!

Then you will get a new Webhook with the URL.

3. How to use Webhook to send message :

> curl -X POST WEBHOOK\_URL -H ‘content-type: application/json’ -d ‘{“content”: “Hello, World!”}’

#### READ MORE

[Discord Developer Portal - API Docs for Bots and Developers](https://discordapp.com/developers/docs/resources/channel#create-message)

* * *
Angular Re-usable Components - (@Input) Decorator
Tags: angular, design
Published: 2019-12-12 08:44:07

##Reusable components with Angular
One of the fundamental concepts that I learned about system design is to have/build reusable components. This approach saves time (building and testing the components) and writing boilerplate code. 
I am learning Angular and I have found how to build re-usable components in Angular. In Angular, re-usable components are built using two approaches depending on the requirement, a good number of times these are combined.

1.	@Input() – decorator (Part of Component API)
2.	Ng-content directive (Content Projection)

In this article, I am going to show how to use the first approach to achieve component re-usability with **@Input() – decorator**. 

**@Input() – decorator** - allows you to pass data from parent component to child component. You will not be able to pass HTML. I have taken Bootstrap Card component for this example, and I intend to use this component in multiple places on my site but with different/dynamic headings. Instead of having multiple Cards with different headings, I am going to have one Card. This card is designed in such a way that the consumer/user of the component/card can pass in the heading at the time of calling the component.


```
import { Component, OnInit, Input } from '@angular/core';
@Component({
  selector: 'app-re-usable-card',
  templateUrl: './re-usable-card.component.html',
  styleUrls: ['./re-usable-card.component.css']
})
export class ReUsableCardComponent implements OnInit {
  @Input() heading: string;
  constructor() { }
  ngOnInit() {
  }
}
```
`  @Input() heading: string; ` This line uses **@Input()** decorator to mark the property *heading* as one that can be passed on dynamically, making *ReUsableCardComponent* re-usable. Do not forget to import **Input**. Now the template for our re-usable component looks like below:

```
<div class="card">
    <div class="card-header">
        {{heading}}
    </div>
    <div class="card-body">
        <h5 class="card-title">Special title treatment</h5>
        <p class="card-text">With supporting text below as a natural lead-in to additional content.</p>
        <a href="#" class="btn btn-primary">Go somewhere</a>
    </div>
</div>

```

` {{heading}} ` - binds the property heading of our component through string interpolation. Whatever that is passed from parent component targeting heading will be rendered inside this div


 ```
<div class="card-header">
        //will be put here!
    </div>
``` 

The below code shows how we pass data from the parent component to our child component. 

```
<div class="container">
    <div class="row">
        <app-re-usable-card [heading]="'Heading 1'"></app-re-usable-card>
        <app-re-usable-card heading='Heading 2'></app-re-usable-card>
    </div>
</div>

```

Did you notice that in the `card-body div` of our component there is HTML content? Is there a way of dynamically injecting/putting that content for re-usability? Yes, that is the job of **ng-content**, I will look into that in the next article. Thank you for reading, I appreciate comments!
Will I find the javascript type errors? Advent of Code 2019 - Day 2
Tags: challenge, adventofcode, javascript, video
Published: 2019-12-12 08:27:09

---
title: Will I find the javascript type errors? Advent of Code 2019 - Day 2
published: true
description: JavaScript walkthrough of Advent of Code 2019 (day 2)
tags: challenge, AdventOfCode, javascript, video
series: Advent of Code 2019 in Javascript
---

{% youtube 9NuNlLENNL0 %}
Advent of Code 2019 Solution Megathread - Day 12: The N-Body Problem
Tags: adventofcode, challenge, adventofcode2019, spoilers
Published: 2019-12-12 08:19:09

---
title: Advent of Code 2019 Solution Megathread - Day 12: The N-Body Problem
published: True
description: To correctly simulate the universe, we must start by creating an apple pie.
tags: adventofcode,challenge, adventofcode2019, spoilers
series: Advent of Code 2019 Solutions
cover_image: https://i.imgur.com/duG5hOg.png
---

We've got to mind our moons! So let's tighten our belts and drop into the orbit of Day 12.

### [Day 12 - The Problem](https://adventofcode.com/2019/day/12)
Fresh from our run-in with the police, we are more safety minded than usual. It's bad enough to be driving while distracted by giant red dots, but Jupiter's moons are swirling about willy-nilly. We need to get tracking!

Part 1 has us simulating four moons as they pull on each other with gravity. Somehow, I don't think that this is how moons normally orbit Jupiter, but whatever!

Part 2 is all about optimization. We need to simulate until it loops! This is a _really_ big number, so we're going to need to cheat to win.

### Ongoing Meta

#### Dev.to List of Leaderboards

* `120635-5c140b9a` - provided by [Linda Thompson](https://dev.to/lindakatcodes) 

 If you were part of [Ryan Palo](https://dev.to/rpalo)'s leaderboard last year, you're still a member of that! 

If you want me to add your leaderboard code to this page, reply to one of these posts and/or send me a DM containing your  code and any theming or notes you’d like me to add. (You can find your private leaderboard code on your "[Private Leaderboard](https://adventofcode.com/2019/leaderboard/private)" page.)

I'll edit in any leaderboards that people want to post, along with any description for the kinds of people you want to have on it. (My leaderboard is being used as my office's leaderboard.) And if I get something wrong, please call me out or message me and I’ll fix it ASAP.

There's no limit to the number of leaderboards you can join, so there's no problem belonging to a "Beginner" *and* a language specific one if you want.

#### Neat Statistics

I'm planning on adding some statistics, but other than "what languages did we see yesterday" does anyone have any ideas?

##### Languages Seen On Day 09
> Under construction
What new grads need to prepare for after graduating
Published: 2019-12-12 07:59:56

Being a recent grad we all expect to land that great paying job in tech. Have a smooth and easy journey when it comes to landing that job but nothing really prepares you for the horrors that follow...

So heres my quick tips to new grads:
1._master your programming language of choice_
We learn quite alot of programming languages during our varsity life over short periods of time,meaning we dont get to master the skills very well. We work on projects that contribute to some of our knowledge but does this really prepare you for work life. My guess is after graduating work on mastering atleast 2 programming languages from understanding basic syntax to knowing what data structures to use and which will immensely help you when it comes to those horrifying online coding assessments you have to do before any interview.
2. _Online Presence and work on a Project_
Create a github account,linkedin and a dev.to profile. A good project to start working on is your web based portfolio. This will help showcase your web developer skills as well as let recruiters know more about you.

3._do online courses_
This is another form of upskilling yourself and learning new things and get awarded a certificate thats proof that your the shiz niz🤣😊

Lastly dont be afraid to ask questions and seek help when you get stuck. Thats how you will learn to be the best developer by learning and working to fix your mistakes.
tags: 
#save_lives
#help_a_new_grad
---
Day 12 of the Visual Studio Tips Advent Calendar is now live
Tags: visualstudio
Published: 2019-12-12 07:59:28

Day 12 of the Visual Studio Tips Advent Calendar is now live. Enjoy! 

What will it be today I wonder?

https://visualstudiotips.co.uk/calendar/

#VisualStudio #DevDecember #VsTipsAdvent #Advent