|
1 | | -## Todolist MVC |
| 1 | +## Java Goof |
2 | 2 |
|
3 | | -Todolist MVC is like [TodoMVC][] but for Java Web Frameworks instead of Javascript Frameworks. |
| 3 | +A vulnerable demo application, initially based on [Ben Hassine](https://github.com/benas/)'s [TodoMVC](https://github.com/benas/todolist-mvc). |
4 | 4 |
|
5 | | -The goal is to implement the same application using different technologies and compare them |
6 | | - in order to help you choose the right framework for your next Java web application. |
| 5 | +The goal of this application is to demonstrate through example how to find, exploit and fix vulnerable Maven packages. |
7 | 6 |
|
8 | | -Two types of frameworks are being compared: |
| 7 | +This repo is still incomplete, a work in progress to support related presentations. |
9 | 8 |
|
10 | | -#### 1. Request/Action based frameworks |
11 | | - |
12 | | -* Servlets/JSPs |
13 | | -* Spring MVC |
14 | | -* Struts |
15 | | -* JSR 371 Java EE 8 MVC 1.0 (WIP) |
16 | | - |
17 | | -#### 2. Component based frameworks |
18 | | - |
19 | | -* Tapestry |
20 | | -* JSF |
21 | | - |
22 | | -Other frameworks will be added progressively (JSR 371, Wicket, Grails, Play, etc..), you are welcome to contribute with any Java web framework you are comfortable with. |
23 | | - |
24 | | -Performance comparison is not addressed here. There are many excellent benchmarks on the web like [TechEmpower's Framework Benchmarks][]. |
25 | | - |
26 | | -The goal is to focus on features set and developer productivity using each framework: |
27 | | - |
28 | | -* Form handling |
29 | | -* Request parameters binding |
30 | | -* Session handling |
31 | | -* Ajax support |
32 | | -* I18N support |
33 | | -* etc |
34 | | - |
35 | | -## About Todolist MVC |
36 | | - |
37 | | -Todolist MVC is the classic CRUD web application to manage todo list online. |
38 | | - |
39 | | -Some features like user and session management go beyond CRUD operations. |
40 | | - The application is small enough to be easy to implement, and big enough to cover most of the features of each framework. |
41 | | - Here is the list of features: |
42 | | - |
43 | | -#### User management |
44 | | - |
45 | | -* Register a new account |
46 | | -* View account details |
47 | | -* Update account |
48 | | -* Delete account |
49 | | - |
50 | | -#### Session management |
51 | | - |
52 | | -* Login |
53 | | -* Logout |
54 | | - |
55 | | -#### Todolist management |
56 | | - |
57 | | -* CRUD operations on todos |
58 | | -* Search todo list |
59 | | - |
60 | | -Todolist MVC uses [Twitter Bootstrap][] for the user interface, here are some screenshots: |
61 | | - |
62 | | - |
63 | | - |
64 | | - |
65 | | - |
66 | | - |
67 | | - |
68 | | - |
69 | | - |
70 | | -## Architecture |
71 | | - |
72 | | -The application's backend is developed using Spring and JPA/Hibernate. Data is persisted in an in-memory HSQL database to make testing/running the application relatively easy. |
73 | | -The module named `todolist-core` is common to all web layers and is a good use case to see how web frameworks integrate with Spring. |
74 | | - |
75 | | -Common web utilities (JSTL tags, Filters, Backing beans, etc) are packaged in a separate common web module named `todolist-web-common`. |
76 | | - |
77 | | -For each web framework, a separate war module is created to implement ONLY the web layer of the application. |
78 | | - |
79 | | -View technology may vary for each framework. Here, JSP views are (re)used for most of current implementations. Thymeleaf is also planned to be used as alternative to JSPs. |
80 | | - |
81 | | -URLs under `/user/*` and `/todos/*` must be accessible to only logged users. |
82 | | -This requirement should be implemented using a servlet filter or equivalent (Struts interceptor, Spring MVC interceptor, etc) |
83 | | - |
84 | | -Note that security is not addressed since not all frameworks provide security support. |
85 | | - |
86 | | -Form validation should be done using Bean Validation API (JSR303). Form backing beans are already defined with validation constraints in the `todolist-web-common` module. |
87 | | -All you have to do is to integrate the validation logic with the framework in use. |
88 | | - |
89 | | -Finally, the static html template located in `src/site/template` can be used as a starting point to implement the application with a new framework. |
90 | 9 |
|
91 | 10 | ## Build and run Todolist MVC |
92 | 11 |
|
| 12 | +(from the original README) |
| 13 | + |
93 | 14 | 1. Check out the project source code from github : `git clone https://github.com/benas/todolist-mvc.git` |
94 | 15 | 2. Open a terminal and run the following command from root directory : `mvn install` |
95 | | -3. Choose a web framework to test and run it. For example : `cd todolist-web-springmvc && mvn tomcat7:run` |
| 16 | +3. Choose a web framework to test and run it. For example : `cd todolist-web-springmvc && mvn tomcat7:run` (note: this example currently only copied the Struts demo) |
96 | 17 | 4. Browse the following URL : `localhost:8080/` |
97 | 18 | 5. You can register a new account or login using the following credentials : foo@bar.org / foobar |
98 | 19 |
|
99 | | -## Contributions |
100 | | - |
101 | | -In order to compare these frameworks objectively, the best implementation should be provided for each framework. |
102 | | - |
103 | | -If you are an expert in some of these technologies, please don't hesitate to fix/improve every single aspect of the current implementation. |
104 | | - |
105 | | -The goal of Todolist MVC is to be community driven, so every single contribution is welcome! |
106 | | - |
107 | | -## Todo |
108 | | - |
109 | | -- [ ] Add Spring boot support |
110 | | -- [ ] Add JSR 371 (Ozark) implementation |
111 | | -- [ ] Add Thymeleaf support |
112 | | -- [ ] Update static resources (Bootstrap, FontAwesome) to last versions |
113 | | -- [ ] Update dependencies to last versions |
114 | | -- [ ] Add comparsion table |
115 | | - |
116 | 20 | ## License |
117 | | -Todolist MVC is released under the [MIT License][]. |
118 | | - |
119 | | -[TodoMVC]: http://todomvc.com/ |
120 | | -[TechEmpower's Framework Benchmarks]: https://github.com/TechEmpower/FrameworkBenchmarks |
121 | | -[Twitter Bootstrap]: http://getbootstrap.com/ |
122 | | -[MIT License]: http://opensource.org/licenses/mit-license.php/ |
| 21 | +This repo is available released under the [MIT License](http://opensource.org/licenses/mit-license.php/). |
0 commit comments