Applying concerns to JavaScript with Ajax on Dion Almaer's Blog

Mar 06

Applying concerns to JavaScript with Ajax

You tend to see a lot of copy ‘n paste reuse in JavaScript usage. It just seems to be that kind of mentality. One example of this, is asking for ‘permissions’ from the browser that you may do when building a rich application.

For example, Ben and I had to do this for RSSBling (rich javascript RSS viewer with dynamic offline capabilities).

Security Management with Mozilla

Mozilla needs permission to open up the platform (such as reading from disk, writing to disk, talking to different hosts, etc).

This is where you can sign your code.

You need to ask permission to use these features, which can look something like:

try {
if (netscape.security.PrivilegeManager.enablePrivilege) {
netscape.security.PrivilegeManager.enablePrivilege('UniversalBrowserRead');
}
} catch (ex) { // eat it
}

Security Code Duplication

You often see duplication such as:

function getFeeds() {
try {
if (netscape.security.PrivilegeManager.enablePrivilege) {
netscape.security.PrivilegeManager.enablePrivilege('UniversalBrowserRead');
}
} catch (ex) { // eat it
}

var xhr = new XMLHttpRequest();
xhr.open("GET", ((useProxy) ? proxyBaseUrl : "http://") + baseUrl + "/listsubs", true);
xhr.onreadystatechange = function() {
parseFeeds(xhr);
};
xhr.send(null);
}

function buildFeeds(feedXML) {
showLoading();

try {
if (netscape.security.PrivilegeManager.enablePrivilege) {
netscape.security.PrivilegeManager.enablePrivilege('UniversalBrowserRead');
}
} catch (ex) { // eat it
}

var outlines = feedXML.getElementsByTagName('outline');

...
}

etc etc, duplicating the security piece

Security Code Encapsulation

Firstly, we don’t want to have all of those lines of code. You could fall into the trap of coming up with:

function securePrivilege(priv) {
// insert the try/catch code from above, plus anything for the other browsers
}

Then you could make sure that you call securePrivilege('UniversalBrowserRead') before you need it. This will not work at all, as the way that enablePrivilege does its job, is that the privilege that you secure, is only applied in that scope. This means that the priviledge is only even around INSIDE securePrivilege(priv), and is thus useless :)

Security Code Encapsulation with Closures

Luckily, JavaScript has some nice features which allow us to get around this problem. What you can end up doing, instead of calling securePrivilege(..), you call a method which:

Takes the function to call
Sets up the priviledge
Calls the function

This could look something like this:

function applyPriviledge(priviledge, functionCallback) {
// -- enablePriviledge first
try {
if (netscape.security.PrivilegeManager.enablePrivilege) {
netscape.security.PrivilegeManager.enablePrivilege(priviledge);
}
} catch (ex) { // eat it
}

// -- Call the function itself
functionCallback()
}

// -- Helper functions for particular priviledges
function applyReadPriviledge(functionCallback) {
applyPriviledge('UniversalBrowserRead', functionCallback);
}

You would use this with something like:

function getCount() {
applyReadPriviledge(setupXHR);
}

function setupXHR() {

var xhr = new XMLHttpRequest();
xhr.open("GET", "http://sqlaop.com/xhr/counter.jsp", true);
xhr.onreadystatechange = function() {
countCallback(xhr);
}
xhr.send(null);
}

function countCallback(xhr) {
if (xhr.readyState == 4) {
if (xhr.status == 200) {
applyReadPriviledge(function() {
updateCountDom(xhr.responseXML)
});
} else if (xhr.status == 401) {
alert("Username or password incorrect");
} else {
alert("Some kind of HTTP-related glitch occured.");
}
}
}

Encapsulated, but not rid of the cross cutting concern

This is certainly a lot nicer than copying and pasting the lines of code all over, but wouldn’t it be nice if I could say:

Whenever I make a call to XMLHttpRequest, or working with a DOM back from it, or … then please apply the security first

What am I asking for? Well. JavaScript AOP of course! ;)

techno.blog("Dion")

Applying concerns to JavaScript with Ajax

28 Responses to “Applying concerns to JavaScript with Ajax”

Leave a Reply

Support HTML5

Recent Mobile Photo

Activity Stream

Feeds

Links

Categories

Archives

About Me