Security of external jar file in GWT - google-app-engine

I have created a GWT project which is successfully using an external jar file (see GWT - Using external jars / Java Projects by Lars Vogel‎ and Adding external jar in GWT).
When I use a library file like this, what happens when I compile the project and upload it to AppEngine? Does the jar file get uploaded as it is, or does it get compiled into something else first? And if the former, is it at any security risk of being downloaded without my control?

Let's drop the "google-app-engine" part, it doesn't matter here. You use the library in GWT, on client side. App Engine is server side, with no direct connection to GWT (but due to the volume restrictions it is quite useful to utilize some client side execution like GWT).
Everything you use in GWT will be compiled to JavaScript, transferred to the client and executed there. Obviously you have no control over the result and what the client does with it.
But it will be next to unreadable. Plus the client does not get the JAR per se and he does not get everything that is inside the JAR.
So what really matters is if the library's license allows this and if there are secrets in the library code that are only intended to be used on server side.

Actually, his's answer is not quite correct. The "google-app-engine"-part matters a lot here. Technically, GWT compiles and obfuscates all of the Java code it needs. And it strips out everything that it doesn't need. So, from the JavaScript generated by GWT, it should indeed be quite impossible to reconstruct or maybe even recognize the library. But it turns out that if you use the Eclipse plugin to deploy your app, appcfg uploads all sorts of random stuff to the AppEngine servers, sometimes including the entire Java source of the project (client side code included).
To see what exactly it uploads when you do a deploy, check in your system's temp-directory while the upload is running. You will find an AppEngine staging directory there that contains everything to be sent.
For suggestions for ways around this, you can refer to the answers to a question that I asked earlier: Removing unwanted uploads from AppEngine deployment
What I haven't checked is whether all the unwanted uploaded files end up in directories that are actually directly accessible from the internet.

Related

Tesseract.js not working as node package to my ReactJS project

Tesseract initializes fine until it needs to load the language files, and it just stops working. See the attached picture for reference on the error..
The npm package(?) installs fine, I also downloaded offline files (worker and wasm files) and made it work as I have seen that it loads them correctly.. Well, at least until it starts loading the language files and breaks my app..
Worker and wasm files are put in the
/public
folder so it can be read by the jsx. I tried not using the offline files, by removing these lines
workerPath: '/External/tesseractjs_data/js/worker.min.js',
corePath: '/External/tesseractjs_data/js/tesseract-core.wasm.js',
but I am still having the same error. All of the solutions I have seen online that is connected to this problem are almost all in java, and one of the solution needs to install some kind of tesseract software, but what I would want to avoid this as I wanted no installations, why I have picked web programming so the installation would be minimal..
I don't think anyone will need this but here is how I fixed my issue:
Seems like my downloader (IDM) was capturing the language files (traineddata.gz) and then sets a key with 0 value in indexed db on the domain / browser.
Clear browser cache, or just delete the key/value pair thingy in the Indexed DB, which can be found on the developer tools / console thingy, at the "Storage" of the browser
Disable downloader or just remove ".gz" on the file types capturing section of the downloader
It should now work

is GO source code uploaded to google app engine?

I'm wondering if the source code is uploaded or only the binary / compiled version ?
Do GAE engineers have access to my precious source code ?
Yes it uploads the source code and you can also download the source code of a specific version you previously deployed. You can also PERMANENTLY disable such a feature in the admin page.
Don't worry to upload it, besides having strict SLA no one really cares about your code.
The source code appears to be uploaded as well, according to "Downloading source code" in Uploading, Downloading, and Managing a Go App. You could prove it by trying to download the source code yourself.

My GAE python development datastore is never persisted to a file

I have just started using GAE (Python 2.7 SDK 1.6.4) , I have set up a
simple test project using Pydev (latest version) in eclipse (indigo)
on Windows XP (SP3).
It all works fine, my app can record data in the datastore and the blobstore
and then retrieve it, but when I stop the development server and start
it again the data in the datastore is lost. This is not the case for
the blobstore which is retaining blobs fine and I can see the
blobstore folder that gets created in C:\Temp
I did the sensible thing and look back through old posts and found
that most people who have this problem solve it by changing the
location of the datastore file, so I used the following parameters;
--datastore_path="${workspace_loc}/myproject/datastore"
--blobstore_path="${workspace_loc}/myproject/blobstore"
"${workspace_loc}/myproject/src"
I moved the blobstore at the same time as you can see.
The blobstore still works, and now the blobstore folder is created in
myproject folder as expected. The datastore file is still not created
however, and when I stop and restart the development server the data
is still lost.
The dev server startup logs include the following entry
WARNING 2012-04-20 10:49:04,513 datastore_file_stub.py:513] Could not
read datastore data from C:\myworkspace\myproject\datastore
So I know it is trying to create the datastore in the correct place.
Finally I lifted the whole eclipse workspace folder and copied it to
another computer with exactly the same setup except it is running
Windows 7 instead of Windows XP.
Everything works fine there - both the datastore file and blobstore
folder are now created where I expect them to be.
I have set up eclipse, python, gae, my project and my eclipse launch
file in exactly the same way on two computers, it works on one and
not the other. Maybe XP is something to do with it but to be honest I
think that's unlikely.
The only other clue I have come up with is that a recent change to the
GAE development server stopped writing to the datastore file after
every change and only flushes on exit, this problem may be closely related to mine;
App Engine local datastore content does not persist
However adding the following to my code did not help at all.
from google.appengine.tools import dev_appserver
import atexit
atexit.register(dev_appserver.TearDownStubs)
So it's not down to incorrect termination sequence either as far as I
can tell although it may be that I was just added it in the wrong place (I'm am new to python).
Anyway I am stumped and I would be really grateful for suggestions you
guys can come up with.
It's probably http://code.google.com/p/googleappengine/issues/detail?id=7244 and a bug. Hopefully a fix will be available soon.
did you try:
--storage_path=...
Path at which all local files (such as the Datastore, Blobstore files, Google Cloud Storage Files, logs, etc) will be stored, unless overridden by --datastore_path, --blobstore_path, --logs_path, etc.
found at https://developers.google.com/appengine/docs/python/tools/devserver?csw=1

oracle driver for java web application

Is it okay to place an oracle driver jar within the web application's /lib directory, or is it better practice to place it in tomcat's lib directory?
I'm wondering about this because on my local host, my web app runs fine with the jar in the web app's /lib directory, but when I move the web app to a real development server, I continue to receive null pointer exceptions when trying to close a connection pool object. I thought this issue may be why I'm unable to free the connection.
Thanks.
To answer the initial question, about placement of the .jar file, there are some things to consider:
Are there other apps on the same server that use this? If yes, and you want to ensure all of them use the same version, the placing on the server/lib folder would be better
If you want some flexibility in terms of what version of the .jar each app uses, then webapp/lib is better
If you are packaging your app as an ear or war, and there are size considerations, then the server/lib option has some advantages, given it makes sense considering the two points above.
If you run into classloader issues from dependencies, you may have to consider other jars when deciding on placement.
Whatever you decide, its best to make sure each jar exists only once in each apps classpath.

Uploading a simple web2py app to GAE

I created a web2py app that is extremely light, with the goal of eventually making the app support JSON-RPC calls, and maybe a few other things.
I found some tutorial online that (on winxp) had me get the source code for web2py and extract it on top of the compiled program. At the top level, I edited app.yaml with my program name and used the GAE SDK to upload the program. It looks like that uploaded everything including example applications. I think it's including a whole gluon directory, and other dir's full of py files. Is there a way to setup web2py to only upload my application, and what's minimally required to run it?
The app.yaml that comes with web2py includes a section skip_files and it should contain, among others, this line:
(applications/(admin|examples)/.*)|
You can change it to
(applications/(admin|examples|welcome)/.*)|
So that welcome app is not deployed. You add more apps that you may have and do not want deployed.
At minimum you need:
web2py/gaehandler.py
web2py/gluon/* (and subfolders, this is web2py)
web2py/applications/theoneappyouwanttodeploy/* (and subfolders)

Resources