{"id":1371,"date":"2014-03-04T11:18:30","date_gmt":"2014-03-04T09:18:30","guid":{"rendered":"http:\/\/hasselba.ch\/blog\/?p=1371"},"modified":"2014-03-04T12:35:44","modified_gmt":"2014-03-04T10:35:44","slug":"xpages-ssjs-how-you-can-have-fun-at-the-office","status":"publish","type":"post","link":"https:\/\/hasselba.ch\/blog\/?p=1371","title":{"rendered":"XPages: SSJS & How you can have fun at the office"},"content":{"rendered":"
This article is a demonstration of what harmful things you can do when using the SSJS & prototyping wrong (described here by the great Mark Roden<\/a>). Don’t do that! Especially not on a productive server!<\/address>\n
\u00a0<\/address>\n

Wanna have a lot of fun in the office with the other developers? Just overwrite some global SSJS functionality! They will never find out what happend to their applications!<\/h1>\n

 <\/p>\n

This is the application we destroy<\/strong><\/p>\n

Our demonstration application uses a small Java class which has only a single method:<\/p>\n

package ch.hasselba.xpages;\r\n\r\npublic class Demo {\r\n\r\n    public String foo() {\r\n       return \"bar\";\r\n    }\r\n }<\/code><\/pre>\n
This class is used for a label on our XPage and is loaded with the importPackage functionality of SSJS:<\/p>\n
<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<xp:view\r\n\u00a0\u00a0 \u00a0xmlns:xp=\"http:\/\/www.ibm.com\/xsp\/core\">\r\n\r\n\u00a0\u00a0 \u00a0<xp:label\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0id=\"labelDemo\">\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<xp:this.value>\u00a0\u00a0 \u00a0\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<![CDATA[#{javascript:\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0importPackage( ch.hasselba.xpages );\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0return new ch.hasselba.xpages.Demo().foo();}]]>\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<\/xp:this.value>\r\n\u00a0\u00a0 \u00a0<\/xp:label>\r\n\r\n<\/xp:view><\/code><\/pre>\n
When opening the XPage, nothing special happens, the label is filled with the value „bar“:<\/p>\n
\"\"<\/p>\n
Now let’s destroy it!<\/strong><\/p>\n
Add a button on the XPage, containing a single line of SSJS code…<\/p>\n
<xp:button\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0value=\"Click Me\"\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0id=\"button1\">\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<xp:eventHandler\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0event=\"onclick\"\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0submit=\"true\"\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0refreshMode=\"complete\">\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<xp:this.action>\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<![CDATA[#{javascript:prototype.importPackage = null;}]]>\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<\/xp:this.action>\r\n\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0<\/xp:eventHandler>\r\n\u00a0\u00a0 \u00a0<\/xp:button><\/code><\/pre>\n
… and reopen the XPage:<\/p>\n
\"\"<\/p>\n
Question: What will happen if you click the button?<\/strong><\/p>\n
Answer:<\/strong><\/p>\n
\"\"<\/p>\n
Exactly:<\/span>\u00a0The method is destroyed on the whole server! Every XPage which imports a Java package with SSJS will not work anymore. Only a complete server restart helps now. The error message you will receive won’t help you, because it looks like the Java classes could not be found. Now „help“ the other developers with tips like „Maybe a build problem? Have you tried to clean the application?“.<\/p>\n
P.S. You can execute the code on other ways, f.e, with an eval<\/em> statement, or a method binding of your choice.<\/p>\n
Tested on ND 8.5.3 & ND 9.0<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"
This article is a demonstration of what harmful things you can do when using the SSJS & prototyping wrong (described here by the great Mark Roden). Don’t do that! Especially not on a productive server! \u00a0 Wanna have a lot … Weiterlesen →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[76],"tags":[33,47,7,31,5,3],"class_list":["post-1371","post","type-post","status-publish","format-standard","hentry","category-ssjs","tag-8-5-3","tag-9-0","tag-domino","tag-java","tag-ssjs","tag-xpages"],"_links":{"self":[{"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1371","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1371"}],"version-history":[{"count":11,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1371\/revisions"}],"predecessor-version":[{"id":1379,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1371\/revisions\/1379"}],"wp:attachment":[{"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1371"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1371"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hasselba.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1371"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}