TIFF image support in HTML5

Question:

I am working on a requirement to display multi-page tiff image in a web application. We have been exploring the new canvas feature of html5 but find that handling multiple pages in the tiff image using canvas a bit of challenge. Please share some ideas in resolving this which would be a great help. You may direct me to javascript or such other resources that might help addressing this. Thanks in advance.

By: Nilima Jain

Answer: 

Though most browsers support the canvas feature of HTML5, the tiff format is not supported by all browsers, though IE supports it. So, first ensure you have an agreement on the supported browsers for which you are building this feature, or else you would need a plugin / control for handling tiff images. If you are taking the plugin or activex or applet route, then you have the liberty to make use of some of the client libraries and expose methods to interact with javascript calls from the browser and you are done.

Just in case you are fine with the browser support and are looking for using canvas for handling tiff, then try exploring the tiff.js library. Google also has a code library called tiffus. But I have not personally explored these libaries and you may spend some time trying out these whether these are of any help.

The other approach could be to try out the following approach:

Have a server side component with service APIs to be able to split the pages in the tiff image into multiple jpg images of the same resolution. This service API when queried without any specific page number would load the tiff image and have the pages parsed as individual images and would return the binary of the first page as jpg format. Similarly, the API, when queried with a specific page, it would ensure returning the specific page. The challenge with this approach would be that there would be more hits between the client and server. This can however be optimized by handling this process in-memory and thus minimizing the disk i/o on the server. This approach is likely to work with all browsers and the canvas feature can be leveraged as well.

However, if you have a specific browser to work with, for instance Internet Explorer, the best and easy approach would be to build an ActiveX control and wrapping the tiff image handling within it. In this case, the native windows imaging components might just suffice and no need for a third party library to handle the multi-page tiff image. This ActiveX component should expose necessary APIs, which can be invoked by javascript in response to various events at the client side.

There are quite a few third party commercial libraries to meet this need too.

Web Application - Vulnerability Testing

Question:

I am a software tester with 11 months experience. I want to explore security testing area and would like to know more about vulnerability testing more specifically about SQL injection attack. Also guide me as to how these testing can be performed manually.

By: Saran Satyan

Answer:

Vulnerability Testing is a practice area for security professionals. There is no simple or one solution that will work in all cases. One has to go through a structured approach to accomplish this testing. The high level steps include scoping, information gathering, tool selection, and then performing the scanning. Most of the vulnerabilities require in-depth knowledge on the internals of the web application like its design and architecture in addition to the tools and technology used in its build. Manual methods or techniques may not help in identifying most of the vulnerabilities.

As we all know, SQL query language is used to retrieve data from the databases and a technique to exploit the the query language to fetch unintentional data by injecting unexpected input data is referred to as SQL Injection attack. As an example, typical where clause in a query used to authenticate a user would be like where userid = <user_id> and password = <password>. The user id and password as entered by the user would be substituted in this where clause in run time before execution. Programmers adopt different techniques to dynamically bind the input variables to build the needed where clause. One such simple method of dynamically building the where clause is by concatenating the input data like "... where userid = " + user_id + " and password = " + password = ";" In this case for instance, if the user inputs the password with something followed by "or 1=1" then the where clause of the final query will look like where userid = user_id and password = password = password or 1=1; As we all know, this query when executed will retrieve all the rows in the user table because of the condition or 1=1.

Here is an article worth referring to know more about SQL injection attacks.You may also check out the following links to know more about vulnerability testing:

Web Application Security Testing Cheat Sheet
The world's most advanced Open Source vulnerability scanner and manager
Web application security: Testing for vulnerabilities

Hope you will find this response useful.