Untrusted Initialization - VeraCode Scan Issue - c#

I am getting one High veracode scan issue in the below code. What changes do i need to make to resolve it.
private OleDbConnection importFileConnection;
private OleDbConnection ImportFileConnection
{
get
{
if (importFileConnection == null)
{ importFileConnection = new OleDbConnection(this.ConnectionString);
//getting scan issue in this line. }
//importFileConnection.Open();
return importFileConnection;
}
}
private string ConnectionString
{
get { return string.Format(ImportExportData.Default.ConnectionString, this.ServerFileName); }
}

String.format is the issue. declare connection with out connection string, then mention the connection property.

Related

gsapi_init_with_args is made: -100

I'm trying to build a PostScript to PDF Converter using Ghostscript.Net.
The Args that GetArgs return, are the ones I usually use to call gswin32c.exe and they work fine.
But every time i call Process, i get an error Saying "An error occured when call to 'gsapi_init_with_args' is made: -100". Googling that error didn't bring anything up so I thought I might ask here.
Are there differnet arguments to consider when calling the .dll directly with Ghostscript.net? Or did I made a mistake somewhere else?
Here's my class:
public class PdfConverter
{
#region Private Fields
private List<GhostscriptVersionInfo> _Versions = GhostscriptVersionInfo.GetInstalledVersions(GhostscriptLicense.GPL | GhostscriptLicense.AFPL | GhostscriptLicense.Artifex);
#endregion
#region Private Properties
private GhostscriptVersionInfo Version { get; set; }
#endregion
#region Construction
public PdfConverter()
{
Version = GhostscriptVersionInfo.GetLastInstalledVersion();
}
#endregion
#region Public Members
public bool ConvertToPdf(DirectoryInfo dir)
{
var d = dir;
if(!d.Exists)
return false;
var postScriptFiles = d.GetFiles("*.ps");
var pdfFiles = postScriptFiles.Select(psf => new FileInfo(Path.ChangeExtension(psf.FullName, ".pdf")));
foreach(var file in postScriptFiles) {
//ThreadPool.QueueUserWorkItem(new WaitCallback((o) => {
Process(file, new FileInfo(Path.ChangeExtension(file.FullName, ".pdf")));
//}));
}
pdfFiles.ForEach(pdf => pdf?.Refresh());
return pdfFiles.All(pdf => pdf.Exists);
}
#endregion
#region Private Helpers
private void Process(FileInfo inputFile, FileInfo outputFile)
{
Console.WriteLine($"Converting {inputFile} to {outputFile}");
var proc = new GhostscriptProcessor(Version, true);
proc.Process(GetArgs(inputFile, outputFile).ToArray(), new ConsoleStdIO(true, true, true));
}
private IEnumerable<string> GetArgs(FileInfo inputFile, FileInfo outputFile)
{
return new [] {
$"-q ",
$"-sDEVICE=pdfwrite",
$"-dSAFER",
$"-dNOPAUSE",
$"-dBATCH",
$"-sPAPERSIZE=a4",
$"-dEmbedAllFonts=true",
$"-dAutoRotatePages=/None",
$"-sOutputFile=\"{outputFile.FullName}\"",
$"-dCompatibilityLevel#1.4",
$"-c .setpdfwrite",
$"-f \"{inputFile.FullName}\""
};
}
#endregion
}
Edit:
I forgot to mention: To implement it i had to make my own GhostsdcriptStdIO class. I admit that I'm not entirely sure if I did this right. Although it does get instanciated without exceptions, and override StdOut(...) get's called, and the output is written to the console as expected. override void StdError(...) get's called as well. And also written to the console as expeted.
The Output of the error btw is:
"**** Could not open the file "c:\temp\test.pdf""
"**** Unable to open the initial device, quitting."
Here's my ConsoleStdIO class:
public class ConsoleStdIO : Ghostscript.NET.GhostscriptStdIO
{
#region Construction
public ConsoleStdIO(bool handleStdIn, bool handleStdOut, bool handleStdError) : base(handleStdIn, handleStdOut, handleStdError) { }
#endregion
#region Overrides
public override void StdError(string error)
{
var foo = Encoding.Default.GetBytes(error);
var lenght = foo.Length;
using (var err = Console.OpenStandardError()) {
if(err.CanWrite)
err.Write(foo, 0, lenght);
}
}
public override void StdIn(out string input, int count)
{
byte[] bytes = new byte[0];
using(var stdInput = Console.OpenStandardInput()) {
stdInput.Read(bytes, 0, count);
}
input = Encoding.Default.GetString(bytes);
}
public override void StdOut(string output)
{
var foo = Encoding.Default.GetBytes(output);
var lenght = foo.Length;
using (var err = Console.OpenStandardError()) {
if(err.CanWrite)
err.Write(foo, 0, lenght);
}
}
#endregion
}
Again: doing the same operation with the exact same files and arguments using gswin32c.exe works fine.
Happy Hacking
Error -100 is gs_error_Fatal, which means 'something catastrophic went wrong'. Its an indication that the program failed to start up properly and we can't tell why. The back channel may contain more information.
And indeed, the back channel tells you what's wrong:
**** Could not open the file "c:\temp\test.pdf
**** Unable to open the initial device, quitting.
Ghostscript is unable to open the output file, which means it can't open the pdfwrite device (because that requires an output file) so it aborts the operation.
There could be a number of reasons why Ghostscript can't open the output file. The first thing I'd do is trim down the number of arguments;
You don't want -q (quiet) when you are trying to debug a problem, you want all the information you can get.
I'd remove -dSAFER at least to start with, because that prevents Ghostscript accessing directories outside the current working directory and certain 'special' ones. It may well prevent you accessing the temp directory.
You don't need to set EmbedAllFonts when its the same value as the default.
You could drop the CompatibilityLevel (and note that you've used a # there instead of an =) switch, and the AutoRotatePages while getting this to work.
The "-c .setpdfwrite -f" string has been pointless for years but people still keep using it. All that does these days is slow down the start of processing, ditch it.
Finally you can try changing the backslash ('\') characters to forward slash ('/') in case your string handling is messing that up, or use double backslashes (I'd use the forward slash myself).
You should also check that c:\test\temp.pdf doesn't exist, or if it does exist is not read-only or already open in a different application.
So I solved the problem...
After taking KenS' advice I could run the application without Ghostscript (not Ghostscript.NET) giving me any errors. But it did not produce an actual PDF File.
So KenS's answer did not quite solve the problem, but since 'less is more' and since he took the time to talk to me on IRC to verify that my args in itself were correct, I'll give the answer points nonetheless.
What actually solved my was the following:
Here my original GetArgs(...)
private IEnumerable<string> GetArgs(FileInfo inputFile, FileInfo outputFile)
{
return new [] {
$"-sDEVICE=pdfwrite",
$"-dNOPAUSE",
$"-dBATCH",
$"-sPAPERSIZE=a4",
#"-sFONTPATH=" + System.Environment.GetFolderPath(System.Environment.SpecialFolder.Fonts),
$"-sOutputFile={outputFile.FullName}",
$"{inputFile.FullName}",
};
}
Someone in #csharp pointed out to me, that in c, the first argument is always the name of the command. So he suggested to just put "gs" as the first argument (as a dummy) and try... And that's what actually solved my problem.
So this is how the working GetArgs(...) looks:
private IEnumerable<string> GetArgs(FileInfo inputFile, FileInfo outputFile)
{
return new [] {
$"gs",
$"-sDEVICE=pdfwrite",
$"-dNOPAUSE",
$"-dBATCH",
$"-sPAPERSIZE=a4",
#"-sFONTPATH=" + System.Environment.GetFolderPath(System.Environment.SpecialFolder.Fonts),
$"-sOutputFile={outputFile.FullName}",
$"{inputFile.FullName}",
};
}

Build query in Faircom c-Tree Plus

I have a Faircom c-tree database file (.dat & .idx).
I have connected it using ODBC Faircom Driver.
now I want to build queries on that database. actually i have already ready SQL version query but it is not working in c-tree database.
most of functions are not supported(like isnull,isnumeric,dateadd etc.)
help me to come out of this.
There is a developer's guide here for C#, as one of your tags is:.Net Guide
As well as a specific citing of your read example here:
C# Read Example
Citing the example from the above link, your read code would look something like this:
static void Initialize()
{
Console.WriteLine("INIT");
try
{
// This section is only needed for the AppServer DLL model.
bool AppServerModel = true;
if (AppServerModel)
{
// Set c-tree database engine configuration file name.
CTSession.SetConfigurationFile("ctsrvr.cfg");
// Start c-tree database engine.
CTSession.StartDatabaseEngine();
}
// allocate objects
MySession = new CTSession(SESSION_TYPE.CTREE_SESSION);
MyTable = new CTTable(MySession);
MyRecord = new CTRecord(MyTable);
}
catch(CTException E)
{
Handle_Exception(E);
}
try
{
// connect to server
Console.WriteLine("\tLogon to server...");
MySession.Logon("FAIRCOMS", "", "");
}
catch(CTException E)
{
Handle_Exception(E);
}
}
static void Display_Records()
{
bool found;
string custnumb;
string custname;
Console.Write("\tDisplay records...");
try
{
// read first record
found = MyRecord.First();
while (found)
{
custnumb = MyRecord.GetFieldAsString(0);
custname = MyRecord.GetFieldAsString(4);
Console.WriteLine("\n\t\t{0,-8}{1,-20}", custnumb, custname);
// read next record
found = MyRecord.Next();
}
}
catch(CTException E)
{
Handle_Exception(E);
}
}

Can You Use Variables This Way

This is my syntax, but it is not being passed to my connection string, it is being omitted, which of course is causing an error as the database doesn't exist. Is it possible to do this?
namespace bottomsup
{
class onetwothree
{
private static string databaseName = null;
private static string ServerConnectionString = "Data Source=BradJohnson;Initial Catalog=" + databaseName + "DB;User ID = pmartin;Integrated Security=True;MultipleActiveResultSets=True"";
Form1()
{
InitializeComponents();
}
private void ConnectToServerClick()
{
databaseName = textbox1.Text;
using (SqlConnection connection = new SqlConnection(ServerConnectionString))
{
connection.Open();
//more stuff
}
}
}
}
No, if you change the value of databaseName later on, it doesn't automatically change the value of ServerConnectionString.
You have to set the value of ServerConnectionString again yourself.
ServerConnectionString =
string.Format("Data Source=BradJohnson;Initial Catalog={0}DB;User ID = pmartin;Integrated Security=True;MultipleActiveResultSets=True", textbox1.Text);
I'd avoid the static variable, as it can lead to bugs if you try to reuse it, and especially if you overwrite it, in multiple places. One place sets it, then another, and now one or the other is going to grab an incorrect value when it tries to retrieve it.
Perhaps something like this instead, where you always have to pass the database name in:
private static string GetServerConnectionString(string databaseName)
{
return string.Format("Data Source=BradJohnson;Initial Catalog={0}DB;User ID = pmartin;Integrated Security=True;MultipleActiveResultSets=True", databaseName);
}
To use it with your existing code:
using (var connection = new SqlConnection(GetServerConnectionString(textbox1.Text)))
{
connection.Open();
//more stuff
}
I doubt if statics are justified in this case.
Nevertheless, it will not work with variable ServerConnectionString, but you could use a property instead:
private static string ServerConnectionString
{
get
{
return "Data Source=BradJohnson;Initial Catalog=" + databaseName +
"DB;User ID = pmartin;Integrated Security=True;MultipleActiveResultSets=True";
}
}
Often when you try to add a null value to something which has a value, it will fall over. In the DB Name you should use String.Empty as opposed to null.
Also I think you have an extra quote on the end of the string.
When you set the connection string, it is not going to dynamically update if you ever change the other property anyway.

Entity set connection timeout

How can I set the value of connectionTimeout (not commandTimeout) of context by coding (not in connection string) ?
This is readonly:
DbContext.Database.Connection.ConnectionTimeout = 10;
Thanks
Udpate:
My probleme is to test if my context is available quickly and the default time is to long ?
I tried this :
int? oldTimeOut = RepositoryDbContext.Database.CommandTimeout;
try
{
RepositoryDbContext.Database.Connection.ConnectionTimeout = 10; //readonly
RepositoryDbContext.Database.CommandTimeout = 10; // doesn't work, the value stay the same
RepositoryDbContext.Database.Connection.Open();
RepositoryDbContext.Database.Connection.Close();
return true;
}
catch
{
return false;
}
finally
{
RepositoryDbContext.Database.CommandTimeout = oldTimeOut;
}
But I can't change the connectionTimeout is readOnly and the commandTimeout doesn't set the value...
I'm not aware of any option to change the connection timeout via the EF API. You can however change the connection string at runtime. You could parse the configured connection string and change the timeout parameter, or add one if it does not exist.
If you are working with SQL Server only, I would suggest using SqlConnectionStringBuilder. Use the constructor that takes an existing connection string, change the ConnectTimeout, get the modified connection string, and use that connection string when constructing your DbContext.
Depending on what you are actually trying to solve, one alternative might be to use SlowCheetah to easily generate the web.config, with different configuration strings, for different build types.
http://visualstudiogallery.msdn.microsoft.com/69023d00-a4f9-4a34-a6cd-7e854ba318b5
UPDATE
Based on your comment...
Try something like
string normalConnectionString = RepositoryDbContext.Database.Connection.ConnectionString;
var connectionBuilder = new SqlConnectionStringBuilder(normalConnectionString);
connectionBuilder.ConnectTimeout = 10;
string testConnectionString = connectionBuilder.ConnectionString;
using (var testRepositoryDbContext = new RepositoryDbContextType(testConnectionString))
{
try
{
testRepositoryDbContext.Database.Connection.Open();
testRepositoryDbContext.Database.Connection.Close();
return true;
}
catch
{
return false;
}
}

Class function to return different objects

In short I am writing a class handler to handle to database integration of some software I am writing for myself, however as there is not always a connection to the remote database I thought I would use SQLCE to create a local database buffer so when a connection is made the changes can be synchronized.
So far it is going well except for the parameters. The function I am looking to call is shown below however this function is complaining about invalid arguments.
public Object run(string query, List<Object> dbparams = null)
{
if (MyDB.isConnected())
{
return MyDB.run(query, dbparams);
}
else
{
SqlCeCommand sql = _OfflineConnection.CreateCommand();
sql.CommandText = query;
if (dbparams.Count > 0)
{
sql.Parameters.AddRange(dbparams.ToArray());
}
return sql;
}
}
MyDB.run is the exact same code as in the else statement except for mysql, the line that it is moaning about is the return mydb.run as the mydb class is expecting the dbparams list to be of mysqlparameters.
Does anyone know how I can achieve this? I attempted to use LINQ to do a convert but that failed miserably.
EDIT
At present I have the following working but I am sure there is a cleaner solution
public Object run(string query, List<Object> dbparams = null)
{
if (MyDB.isConnected())
{
List<MySqlParameter> mydbparams = null;
for (int i = 0; i < dbparams.Count; i++)
{
mydbparams.Add((MySqlParameter)dbparams[i]);
}
return MyDB.run(query, mydbparams);
}
else
{
SqlCeCommand sql = _OfflineConnection.CreateCommand();
sql.CommandText = query;
if (dbparams.Count > 0)
{
sql.Parameters.AddRange(dbparams.ToArray());
}
return sql;
}
}
A bit cleaner solution would be
mydbparams = dbparams.Cast<MySqlParameters>().ToList();
Also, you should check for and handle the null condition of dbparams.

Categories

Resources