Table Of ContentЭлектронная библиотека “Либрус” ( http://librus.ru )
Научно-техническая библиотека электронных книг. Первоначально задуманная
как хранилище компьютерной литературы, в настоящий момент библиотека
содержит книжные издания по различным областям знания (медицинские науки,
техника, гуманитарные науки, домашнее хозяйство, учебная литература и т.д.).
Серьезность научно-технических e-book'ов разбавляет раздел развлекательной
литературы (эротика, комиксы, задачи и головоломки).
Основной целью проекта является ознакомление читателей с многообразием
книгопечатной продукции и помощь в выборе действительно стоящей книги для
приобретения у законных издателей, их представителей или в соответствующих
организациях торговли. Для покупки через Internet мы рекомендуем
воспользоваться услугами интернет-магазина “Озон”.
ВНИМАНИЕ!
Данный файл представлен исключительно в ознакомительных целях!
После ознакомления с данной книгой Вы обязаны удалить ее с Вашего компьютера.
В случае несоблюдения данного обязательства, Вы нарушите закон "Об авторском праве
и смежных правах".
Все авторские права сохраняются за правообладателем. По его требованию доступ к
данному электронному документу будет перекрыт. Однако, таким образом, тысячи
потенциальных покупателей так и не узнают о, возможно, нужной и полезной книге.
Авторам и издательствам
Если Вы заинтересованы в рекламе и продвижении Ваших книг на бескрайних
сетевых просторах мы с удовольствием включим их в наш каталог.
Bulletproofing Web Applications
Adam Kolawa,
Wendell Hicken,
and Cynthia Dunlop
Published by
M&T Books
An imprint of Hungry Minds, Inc.
909 Third Avenue
New York, NY 10022
www.hungryminds.com
Copyright © 2002 Hungry Minds, Inc. All rights reserved. No part of this book, including
interior design, cover design, and icons, may be reproduced or transmitted in any form,
by any means (electronic, photocopying, recording, or otherwise) without the prior
written permission of the publisher.
Library of Congress Control Number: 2001092904
ISBN: 0-7645-4866-2
Printed in the United States of America
10 9 8 7 6 5 4 3 2 1
1B/RU/RS/QR/IN
Distributed in the United States by Hungry Minds, Inc.
Distributed by CDG Books Canada Inc. for Canada; by Transworld Publishers Limited
in the United Kingdom; by IDG Norge Books for Norway; by IDG Sweden Books for
Sweden; by IDG Books Australia Publishing Corporation Pty. Ltd. for Australia and New
Zealand; by TransQuest Publishers Pte Ltd. for Singapore, Malaysia, Thailand,
Indonesia, and Hong Kong; by Gotop Information Inc. for Taiwan; by ICG Muse, Inc. for
Japan; by Intersoft for South Africa; by Eyrolles for France; by International Thomson
Publishing for Germany, Austria, and Switzerland; by Distribuidora Cuspide for
Argentina; by LR International for Brazil; by Galileo Libros for Chile; by Ediciones ZETA
S.C.R. Ltda. for Peru; by WS Computer Publishing Corporation, Inc., for the Philippines;
by Contemporanea de Ediciones for Venezuela; by Express Computer Distributors for
the Caribbean and West Indies; by Micronesia Media Distributor, Inc. for Micronesia; by
Chips Computadoras S.A. de C.V. for Mexico; by Editorial Norma de Panama S.A. for
Panama; by American Bookshops for Finland.
For general information on Hungry Minds’ products and services please contact our
Customer Care department within the U.S. at 800-762-2974, outside the U.S. at 317-
572-3993 or fax 317-572-4002.
For sales inquiries and reseller information, including discounts, premium and bulk
quantity sales, and foreign-language translations, please contact our Customer Care
department at 800-434-3422, fax 317-572-4002 or write to Hungry Minds, Inc., Attn:
Customer Care Department, 10475 Crosspoint Boulevard, Indianapolis, IN 46256.
For information on licensing foreign or domestic rights, please contact our Sub-Rights
Customer Care department at 212-884-5000.
For information on using Hungry Minds’ products and services in the classroom or for
ordering examination copies, please contact our Educational Sales department at 800-
434-2086 or fax 317-572-4005.
For press review copies, author interviews, or other publicity information, please contact
our Public Relations department at 317-572-3168 or fax 317-572-4168.
For authorization to photocopy items for corporate, personal, or educational use, please
contact Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, or fax
978-750-4470.
LIMIT OF LIABILITY/DISCLAIMER OF WARRANTY: THE PUBLISHER AND AUTHOR
HAVE USED THEIR BEST EFFORTS IN PREPARING THIS BOOK. THE PUBLISHER
AND AUTHOR MAKE NO REPRESENTATIONS OR WARRANTIES WITH RESPECT
TO THE ACCURACY OR COMPLETENESS OF THE CONTENTS OF THIS BOOK
AND SPECIFICALLY DISCLAIM ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. THERE ARE
NO WARRANTIES WHICH EXTEND BEYOND THE DESCRIPTIONS CONTAINED IN
THIS PARAGRAPH. NO WARRANTY MAY BE CREATED OR EXTENDED BY SALES
REPRESENTATIVES OR WRITTEN SALES MATERIALS. THE ACCURACY AND
COMPLETENESS OF THE INFORMATION PROVIDED HEREIN AND THE
OPINIONS STATED HEREIN ARE NOT GUARANTEED OR WARRANTED TO
PRODUCE ANY PARTICULAR RESULTS, AND THE ADVICE AND STRATEGIES
CONTAINED HEREIN MAY NOT BE SUITABLE FOR EVERY INDIVIDUAL. NEITHER
THE PUBLISHER NOR AUTHOR SHALL BE LIABLE FOR ANY LOSS OF PROFIT OR
ANY OTHER COMMERCIAL DAMAGES, INCLUDING BUT NOT LIMITED TO
SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR OTHER DAMAGES.
Trademarks: Hungry Minds, the Hungry Minds logo, M&T Books, the M&T Books logo,
and Professional Mindware are trademarks or registered trademarks of Hungry Minds,
Inc. in the United States and other countries and may not be used without written
permission. All other trademarks are the property of their respective owners. Hungry
Minds, Inc., is not associated with any product or vendor mentioned in this book.
Hungry MindsTM is a trademark of Hungry Minds, Inc.
M BooksTM is a trademark of Hungry Minds, Inc.
Credits
Acquisitions Manager:
Chris Webb
Senior Project Editor:
Jodi Jensen
Technical Editors:
Matt Haughey
Matt Hamer:
Development Editors
Kezia Endsley:
Susan Hobbs
Gus Miklos:
Copy Editor:
Kate Talbot
Editorial Manager:
Mary Beth Wakefield
Senior Vice President, Technical Publishing:
Richard Swadley
Vice President and Publisher:
Joseph B. Wikert
Project Coordinator:
Dale White
Graphics and Production Specialists:
Sean Decker, Stephanie Jumper, Gabriele McCann, Laurie Petrone, Jill Piscitelli, Betty
Schulte, Julie Trippetti, Jeremey Unger, Mary Virgin, Erin Zeltner
Quality Control Technicians:
David Faust, Susan Moritz, Carl Pierce
Senior Permissions Editor:
Carmen Krikorian
Media Development Specialist:
Megan Decraene
Proofreading and Indexing:
TECHBOOKS Production Services
Cover Image:
© Noma/Images.com
Special Help:
Sara Shlaer
About the Authors
Adam Kolawa is the CEO of ParaSoft Corporation, a leading provider of software
productivity solutions. Kolawa came to the United States from Poland in 1983 to pursue
a Ph.D. at the California Institute of Technology. In 1987, he and a group of fellow
graduate students founded ParaSoft with the hopes of creating value-added products
that could significantly improve the software development process. Kolawa’s years of
experience with various software development processes has resulted in his unique
insight into the high-tech industry and his uncanny ability to successfully identify
technology trends. As a result, he has orchestrated the development of several
successful commercial software products to meet growing industry needs to improve
software quality — often before the trends have been widely accepted. Kolawa has
been granted seven patents for the technologies behind these innovative tools. In
addition, Kolawa has contributed to and written commentary pieces and technical
articles for various leading publications such as Software Development, Java Report
and SD Times. He has also presented on software quality, trends, and development
issues at industry conferences including JavaOne, Quality Week, Linux Expo, and
Software Development. Kolawa holds a Ph.D. in theoretical physics from the California
Institute of Technology. In 2001, Kolawa was awarded the Los Angeles Ernst &
Young’s Entrepreneur of the Year Award in the software category.
Wendell Hicken is the Vice President of Advanced Research and Development for
ParaSoft Corporation. In his 12 years with the company, he has played a major role in
all facets of product development — from the initial design phase, through
development, and up to final product release. He has been essential to the conception,
implementation, and continued development of products such as WebKing,
RuleWizard, CodeWizard, Insure++, and the technologies that drive them. Hicken is
also heavily involved in the development of many new Web-based innovations. Hicken
holds a BS in Engineering and Applied Science from the California Institute of
Technology.
Cynthia Dunlop is a Senior Technical Author for ParaSoft Corporation. Since 1998,
Dunlop has been responsible for crafting ParaSoft product manuals and technical
papers. Dunlop can also be credited with authoring numerous technical articles about
issues related to software development. Prior to joining ParaSoft, Dunlop worked as a
writing instructor at Washington State University. Dunlop holds an MA in English from
Washington State University and a BA in English from UCLA.
Foreword
Testing and QA always get the short end of the stick — but they don’t have to.
On a typical project (if such a thing exists), the software development lifecycle is
expanded at the beginning and compressed at the end. Business requirements take
longer to gather than anyone expects as developers, customers, and end users
struggle to define their expectations. Planners underestimate the time necessary to
translate those requirements into application models.
When the programmers finally begin coding, the project is already behind schedule.
From the outset, the programmers rush through their work, under pressure from
managers and customers to deliver the software according to the original schedule.
Through Herculean effort, the programmers accomplish their task; but under constant
pressure, they’re prone to cut corners. The one place this is most likely to happen is in
the debugging process. When they hand over the project to a quality assurance (QA)
team, shortcuts often happen there as well: Although it’s rarely stated overtly, QA’s job
is to approve the code — not find fault with it, especially nontrivial design flaws that
might require significant reworking of the application and delay its deployment.
This debugging/testing reality is especially true of server-side Web apps. Few
developers understand how to test or troubleshoot Web apps effectively, and under the
constant pressure to deliver, deliver, deliver, they don’t have time to learn how to
leverage this new paradigm. After all, the top brass says, the important job is to make
the application live so that we can engage in competitive e-business — you can swat
the bugs and improve performance later, right?
Wrong, and that’s where Bulletproofing Web Applications offers a service to the
software development community by providing techniques and best practices for
integrating testing and QA into the complete Web development lifecycle — where they
belong.
Alan Zeichick
Editor-in-Chief
BZ Media’s SD Times
Preface
This book discusses strategies for bulletproofing Web applications. By Web application,
we mean an enterprise system running on a server, accessed by a client that is
typically a Web browser. These kinds of applications are usually associated with the
HTTP protocol and use HTML for at least part of their interface. By bulletproofing, we
mean making sure your application is robust, scalable, efficient, and reliable.
Many people viewed Web development as child’s play during the early days of small
static Web sites. It’s now obvious, however, that Web development is as complex as
traditional software development — if not more so. As a result of this complexity, it’s
almost impossible to produce a completely reliable Web application unless you
implement (and continue to follow) a well-defined development process that
incorporates a set of vital bulletproofing practices. That’s where this book comes in.
We, the authors, have spent many years at ParaSoft Corporation working on
technologies that help companies improve the reliability of their software. During this
time, we have had the opportunity to observe many different companies’ software
development processes and gain a good understanding of what practices can be used
to increase the reliability of many types of software products. Based on our extensive
experience working with Web applications at several levels, we have developed what
we feel is a useful approach to the challenge of developing bulletproof Web
applications. This book describes that approach and suggests ways that you can apply
it to your own development process and projects.
Intended Audience
This book is intended for people who are already familiar with Web applications, from
developers to Quality Assurance testers to managers of Web development projects.
Although we review the basic ideas, we don’t show you everything you need to know to
create Web applications. We do show you development and testing practices that you
can apply to your application, and we give you ideas for improving the processes you
use during development, including some tips on how to ensure that team members
leverage one another’s work (rather than step on each others’ toes).
What You’ll Learn
We describe and demonstrate a variety of bulletproofing practices that will help you
predict and prevent potential problems, detect and remove existing problems, and
construct your application in such a way that it can recover if an error occurs.
Many of these practices are based on practices that have proven successful for
traditional software development and were extended to meet the unique needs and
challenges of Web development. Although there is no “silver bullet” for reliable Web
applications, there are a number of techniques and tools that can significantly improve
application reliability.
Each time we introduce a general practice, we show you a variety of ways to perform
that practice (including manual solutions, scripting solutions, and automatic tools). We
emphasize automating your procedures whenever possible. We stress automation so
strongly because we’ve seen how it can improve both reliability and efficiency, enabling
team members to spend their time improving the application instead of putting out fires
and performing tedious tasks. To keep our discussions concrete, we refer to specific
languages and tools. Where we claim that you can write scripts to automate certain
tasks, we usually give examples that you can actually run yourself. This is not intended
to limit you to the scripts or tools we show but to provide illustrations of ideas we hope
you can apply to improve your own application.
Beginning with Chapter 4, we develop a sample e-commerce site (“The Online
Grocer”) so that we can provide concrete examples in the discussions throughout the
book. The primary version is developed using Java servlets and the Apache Web
server. Additional versions using JSP, WML, XML, and other technologies are
introduced in Part III. The implementation, however, is not the key point; the focus
is on the methods for building and testing the application. Most of the ideas we discuss
apply equally to applications developed using various technologies. Even the specific
Java-centered approaches have analogous practices for other languages.
How This Book Is Organized
This book has been divided into three parts. If you are in a rush to find out more about a
specific topic, jump right in to the chapter that seems most applicable. You can always
go back to the introductory section later when you have more time.
Part I: Getting Started
Part I provides an overview of the development process and introduces the Online
Grocer Web application that we refer to throughout the rest of the book. If you want to
grasp the fundamental development strategies and issues we frequently touch on, we
recommend that you read Chapters 1 through 3 before diving into the rest of the book.
For details about the Online Grocer application, you can read Chapters 4 through 6.
These details are particularly useful if you’re having trouble following the examples
mentioned in later chapters.
Part II: Bulletproofing Practices
Part II provides detailed information about challenges and practices relevant to most
Web applications. It includes discussions of strategies such as defensive programming,
coding standards, unit testing, functionality testing, content verification, and load
testing. Generally speaking, these topics are introduced in the order in which you would
encounter them during the development of your application. For the most part, these
chapters can be read in any order, although they occasionally reference one another.
Part III: Other Technologies
Part III discusses “specialty” bulletproofing practices that are primarily applicable to
applications using the relevant technology. We start by covering issues related to using
databases in Web applications, move to XML and the related technologies of SOAP
and Web services, and conclude by discussing components such as EJBs and server-
side scripting technologies such as JSP.
Appendixes
In the appendixes, you’ll find a summary of the key points from our sample programs,
procedures, and tools, along with a list of additional resources. Some of these
resources provide more information on topics we discuss in depth, whereas others offer
a starting point for learning about topics that we touch on but don’t cover in detail.
CD-ROM
The CD-ROM that accompanies this book includes the sample files referenced in the
book — often with more detail than you’ll find in the chapters. We encourage you to use
these examples to see our practices in action and to experiment with ways of bringing
these practices into your own development process. The CD also contains evaluation
versions of many of ParaSoft’s tools, as well as versions of freely available Web
development tools.
Conventions
Throughout the book we use simple conventions common to most technical books.
Code examples, or text you would type are entered in a fixed font as follows:
sample code
We use italic type to indicate a new term that we’re defining, and we use shaded
sidebars when we want to provide more detail about concepts mentioned in the text.
Icons Used in This Book
Icons appear in the text to indicate important or especially helpful items. Here’s a list of
the icons and their functions:
Note Notes provide additional or critical information and technical
data on the current topic.
X-Ref Cross-Reference icons point you to someplace else in the book
where you can find more information on a particular topic.
Tip The Tip icon points you to useful techniques and helpful
hints.
Caution The Caution icon is your warning of a potential problem or
pitfall.
On the The On the CD-ROM icon points out a related sample file or
CD additional information that you can find on the CD
accompanying this book.
Feedback
We welcome your feedback on any aspect of this book. You can send e-mail to us at
[email protected]. We’ve also set up a Web page at
www.parasoft.com/bulletproof where you can find any errata, along with
additional examples.
Acknowledgments
This book is the product of many people’s effort and help. We would like to thank the
following people for their direct contributions:
Sierra Roberts, for making this project a reality and managing the entire process.
Jim Clune, for writing Chapters 17 and 18 and reviewing numerous other sections.
Marek Kucharski, for writing Chapters 16 and 20.
Dr. Roman Salvador, for writing Chapter 19 and contributing to Chapters 7, 8, and 9.
Arthur Hicken, for contributing to Chapter 16.
Alan Zeichick, for writing the Foreword.
Everyone at Hungry Minds who helped us mold our ideas into a presentable book,
including Chris Webb for helping us get this book published, Jodi Jensen, for getting
this project on track and coordinating its many facets; Susan Hobbs, Kate Talbot, Gus
Miklos, Matthew Haughey, Matthew Hamer, and Kezia Endsley for their suggestions
and editorial improvements; Carmen Krikorian for obtaining the necessary permissions
for the CD; Megan Decraene for her work building and testing the CD; and the graphics
and production staffs.
We also want to extend a special thanks to everyone at ParaSoft who has played a
“behind the scenes” role in the development and quality of this book and the programs
on the CD. This includes everyone in our development, quality assurance, marketing,
sales, and corporate departments — especially Jenny Ahn, our invaluable Vice
President. Last, but certainly not least, we would like to thank our customers for
providing the feedback that has shaped our ideas and products.
