Microsoft has added high impact reliability, library extensibility, consistency, and performance-orientated features to improve the System.Text.Json library. Some of the improvements to the .NET library include:

• Contract customization
• Type hierarchies
• Required members
• JsonSerializerOptions.Default

System.Text.Json Updates

Let’s tackle each of the updates to System.Text.Json one-by-one.

Read: Best Online Courses to Learn C#

Contract Customization in .NET

Contract customization gives developers more control on type serialization and deserialization, user-defined type hierarchies, and support for required members. The System.Text.Json library figures out how a .NET type should be serialized and deserialized by establishing a JSON contract which is derived from the .NET type’s shape. This shape includes the properties and fields, the constructor, and checks the implementation of IEnumerable or IDictionary.

The metadata has always been JsonTypeInfo , but now, in .NET 7, all of its metadata has been exposed to be modifiable, thus allowing programmers to write their own resolution logic for the JSON contracts.

Here is a small code example showing how to define a custom contract resolver in .NET:

var JSONserOptions = new JsonSerializerOptions
{
    TypeInfoResolver = new propertyContractResolver()
};

JsonSerializer.Serialize(new { value = 44 }, JSONserOptions); 

public class propertyContractResolver : DefaultJsonTypeInfoResolver
{
    public override JsonTypeInfo  GetTypeInfo(Type t, JsonSerializerOptions o)
    {
        JsonTypeInfo type = base.GetTypeInfo(t, o);

        if (type.Kind == JsonTypeInfoKind.Object)
        {
            foreach (JsonPropertyInfo prop in type.Properties)
            {
                prop.Name = prop.Name.ToUpperInvariant();
            }
        }

        return type;
    }
}

Type Hierarchies in .NET

Polymorphic serialization and deserialization of user-defined type hierarchies is now supported by System.Text.Json. This can be done with the JsonDerivedTypeAttribute library. A code example follows demonstrating polymorphic serialization and deserialization in .NET:

[JsonDerivedType(typeof(DerivedClass))]
public class Temp
{
    public int i { get; set; }
}

public class DerivedClass : Temp
{
    public int j { get; set; }
}

The above code example enables polymorphic serialization for the Base class:

Base val = new DerivedClass();
JsonSerializer.Serialize(value); 

The run-time type above is DerivedClass.

Required Members in .NET

With C# 11, support has been added for required members. This lets class authors specify properties and fields and the reflection serialization that must be populated when being instantiated. A quick C# code example follows:

using System.Text.Json;
JsonSerializer.Deserialize("""{"StudentCourse": 7}"""); 

public class Student
{
    public required string StudentName { get; set; }
    public int NumberOfSubjects { get; set; }
}

With this, a JSON exception will be thrown because the required parameter (StudentName) was not supplied.

JsonSerializerOptions.Default

A read-only instance of JsonSerializerOptions can now be passed and accessed by developers through the use of the JsonSerializerOptions.Default static property. Here is some example code demonstrating this:

public class Convert : JsonConverter
{
    private readonly static JsonConverter s_default = 
        (JsonConverter)JsonSerializerOptions.Default.GetConverter(typeof(int));

    public override void Write(Utf8JsonWriter w, int val, JsonSerializerOptions o)
    {
        return w.WriteStringValue(val.ToString());
    }

    public override int Read(ref Utf8JsonReader r, Type type, JsonSerializerOptions o)
    {
        return s_default.Read(ref r, t, o);
    }
}

Read more .NET programming tutorials and software development tips.

The post System.Text.Json improvements in .NET 7 appeared first on CodeGuru.

Microsoft’s Release Candidate 2 (the final release candidate) for .NET 7 was released on October 11, 2022. In this programming tutorial, we look at some of the features and updates developers can expect.

Read: Best Online Courses for .NET Developers

C# 11 Updates in .NET 7

New features and updates in C# 11 include the following.

Generic Attributes in C#

C# 11 introduces a new generic class, which encapsulates operations that are specific to a particular data type. A small example (from Microsoft) follows:

class BaseNode { }
class BaseNodeGeneric { }
// concrete type
class NodeConcrete : BaseNode { }
//closed constructed type
class NodeClosed : BaseNodeGeneric { }
//open constructed type
class NodeOpen : BaseNodeGeneric { }

An example of a generic class with the base class of System.Attribute in .NET follows:

public class GenericAttribute : Attribute { }

Required Members in C#

A Class and Struct type can make use of the required keyword to ensure that properties and fields must be properly initialized. Required members have a few rules:

• The required modifier can be applied to fields and properties in Struct and Class types
• Required members cannot be applied to members of an interface
• Required members must be initialized
• Required members must be visible as their containing type
• Derived classes cannot hide required members that are declared in the base class

Here is a code example showing how to use required members in C#:

public class Course
{
    public required string CourseName { get; init; }
    public required int CourseDuration {get; init; }

    [SetsRequiredMembers]
    public Course(string courseName, int courseDuration)
    {
        this.CourseName = coursetName;
        this.CourseDuration = courseDuration;
    }
    public Course() {}
}

For a more detailed look at some of the new and updated features of C#, please refer to the following link.

Looking to learn C# programming in an online course environment? We have a list of the Best Online Courses for Developers.

.NET Library Updates

.NET libraries keep on improving, and there are always new features being added. In the most recent release, these include:

• Generic Math
• Regular Expression improvements

Generic Math Library in .NET

Generic Math gives .NET developers the ability to use operators on generic types. An example from Microsoft follows:

public static TResult Sum<T, TResult>(IEnumerable values)
    where T : INumber
    where TResult : INumber
{
    TResult result = TResult.Zero;

    foreach (var value in values)
    {
        result += TResult.Create(value);
    }

    return result;
}

public static TResult Average<T, TResult>(IEnumerable values)
    where T : INumber
    where TResult : INumber
{
    TResult sum = Sum<T, TResult>(values);
    return TResult.Create(sum) / TResult.Create(values.Count());
}

public static TResult StandardDeviation<T, TResult>(IEnumerable values)
    where T : INumber
    where TResult : IFloatingPoint
{
    TResult standardDeviation = TResult.Zero;

    if (values.Any())
    {
        TResult average = Average<T, TResult>(values);
        TResult sum = Sum<TResult, TResult>(values.Select((value) => {
            var deviation = TResult.Create(value) - average;
            return deviation * deviation;
        }));
        standardDeviation = TResult.Sqrt(sum / TResult.Create(values.Count() - 1));
    }

    return standardDeviation;
}

More information on Generic Math can be found here and Regular Expression improvements from the latest release can be seen here.

For a complete list of improvements and changes in .NET 7 Candidate Release 2, have a look here.

Read more C# programming tutorials and software development tips.

The post .NET 7 Release Candidate 2 appeared first on CodeGuru.

• Spectrum
• Programming Jobs
• Trending

Let’s break each one of them down.

These categories include the following languages from the highest ranking to the lowest:

Read: Top Online Courses to Learn C# Programming

Top Programming Languages

How are these rankings are judged? Each language’s popularity was measured by 8 metrics. These include:

• Google searches
• Twitter
• Stack Overflow
• Reddit
• IEEE Xplore Digital Library
• IEEE Jobs sites
• CareerBuilder
• GitHub

Let’s explore each of these metrics more closely.

Google Searches

The IEEE makes use of a template known as “X programming” to get the number (which indicates the volume of online resources about each of the respective programming languages) of hits for each programming language.

Twitter

By using the Twitter Search API, the template (X Programming) was used for the months January through August to gather the amount of chatter on social media for each language. This is usually the sharing of news articles, hackathons, and books.

Just a quick note on the Twitter API: The Twitter Development Platform is used to tap into Twitter’s platform from your applications.

There are three different products being counted for:

• Twitter API
• Twitter Ads
• Twitter for Websites

More information about the Twitter API can be found here.

Stack Overflow

Stack Overflow is a programming forum, such as CodeGuru and VB Forums. IEEE measured the number of questions asked that mentioned each programming language. With the help of the Stack Exchange API, the IEEE was able to tabulate the desired measurements.

More information on the Stack Exchange API can be found here.

Reddit

A similar method, like the methods above, was applied to measure the number of posts that mentioned each programming language on Reddit, using the Reddit API.

More information about the Reddit API can be found here.

IEEE Xplore Digital Library

The IEEE Xplore API searched through 3.6 million articles that mention a programming language. More information on the IEEE Xplore API for developers can be found here.

IEEE Jobs sites

The IEEE measured the demand for programming languages in job postings on its IEEE Jobs Site. This contains a huge amount of non-U.S. listings. You can learn more about the IEEE Jobs Site here.

CareerBuilder

The IEEE measured the demand for programming languages in job postings on the CareerBuilder job website to help determine popularity of programming languages based on how many jobs were available for each.

GitHub

The IEEE made use of GitHub 2.0 to measure the top 50 programming languages used in GitHub repositories. The below table lists the top 50 programming languages being used on GitHub:

You can view the GitHub programming language usage stats here.

The post The Top 20 Programming Languages in 2022 appeared first on CodeGuru.

But this begs the question: are employers looking for programmers?

Because many companies are regularly looking for good people, many technology professionals tend to keep their eyes open to avoid missing a good opportunity for a better position. What makes a position better? It might be pay, but it is just as likely the types of projects a company has, the benefits a company offers, or the opportunity with an organization for advancement. Each person is different as to what drives them, but it is likely opportunities are available that match.

The general question of, “is anyone hiring programmers” is easy. The answer is: of course! Having said that, if you are looking for a technology job, it might not be a “programmer” job you want to be searching for. The reality is that “programmer” jobs are not as common as other, related developer terms. We explore the career and job opportunities available for software developers in this programming tutorial.

Read: Top Online Courses to Learn Linux

What are the Top Technology Positions?

According to Indeed, programmer analysts, systems analysts, and app developers were three of the top five technology positions in demand. Only IT security specialists and network analysts ranked higher.

If you search the web, you will find numerous other lists of the most in-demand positions in technology. These lists included things like AI engineers, web developers, Java developers, and mobile developers in their top five positions. One career site had product managers as their top, in-demand position, based on potential average salary ($99,862), with backend developers, systems engineers, game developers, full stack developers, front end developers, UI/UX designers, and mobile app developers all part of their top 10.

What are the Most In-Demand Programming Languages?

According to the US Bureau of Labor Statistics, software development is expected to grow 22% between 2021 and 2030. Web Development is expected to grow 13%. Growth, of course, means more jobs. Of course, developers tend to focus on programming languages. According to a report from Berkley, the most in demand programming languages are:

• JavaScript
• Python
• HTML
• CSS
• Java
• SQL
• NoSQL
• C#
• Rust
• Perl

Go (also known as Golang) just missed the list at 11th.

The University of Denver posted the eight most used programming languages on their site. These languages are:

• JavaScript
• Python
• SQL and NoSQL
• C#
• HTML and CSS
• Java
• Ruby
• PHP

If programming is in demand, and there are a number of great programming languages people are using, then shouldn’t programmer be a title and role that is in the highest demand?

Read: Top Online Courses to Learn Python

What To Search When Looking for a Tech Job

Recruiters are reaching out to existing technology professionals with open positions. If you are considering a change, you should not simply rely on what they present. Rather, you should also do research to find out what is open, what roles are truly in demand, and what is being offered to entice people to the role.

There are a number of job sites available on the Internet. Many good sites have gone away, but some of the big players still exist. For this article, I pulled up LinkedIn, Indeed, and Dice. I also looked at Monster, but it is harder to get an idea of overall openings. Note, these are three of the most well-known sites for looking for open technology positions. There are a variety of other sites that are more focused (such as targeting start-up open positions) that can also be used as well.

If you enter a few search terms into these sites, you will quickly see how results can vary. Earlier the question was asked, “is anyone hiring programmers”? Look at the number of job listings based on searching for “C++ Programmer” on the three sites mentioned:

• Dice: 94 job listings
• Indeed: 2,326 job listings
• LinkedIn: 294,716 job listings

While this clearly gives an indication of which site is listing more openings for C++ Programmers, that is not our focus. Rather it is that, while these numbers might look good, they are not as good as searching for simply C++, which gives the following numbers for job listings:

• Dice: 4,094 job listings
• Indeed: 73,914 job listings
• LinkedIn: 678,671 job listings

Clearly searching for a shorter phrase (C++ instead of C++ Programmer) would be expected to get more results. The difference in the number of results, however, is notable.

Look at the number of results for a different search. Instead of C++ Programmer, the following gives the number of job listings when searching for C++ Developer:

• Dice: 1,095 job listings
• Indeed: 21,821 job listings
• LinkedIn: 295,589 job listings

While you might expect the same results for C++ Developer as were given for C++ Programmer, that is absolutely not the case. For Dice and Indeed, the numbers went up substantially. For LinkedIn, the numbers did, however, stay relatively close. However, if the search phrase is changed to C++ Software Engineer, you will again see that there is yet another increase in results from Dice and Indeed:

• Dice: 17,464 job listings
• Indeed: 45,733 job listings
• LinkedIn: 295,228 job listings

Clearly the search term that is used will impact the number of results. If you do the same exercise with Java Programmer, Java Developer, Java, and Java Software Engineer, you will see similar differences from Dice and LinkedIn:

Dice:

• Java Programmer: 181 job openings
• Java Developer: 5,209 job openings
• Java: 13,975 openings
• Java Software Engineer: 22,126 job openings

LinkedIn:

• Java Programmer: 29,243 job openings
• Java Developer: 43,018 job openings
• Java: 755,798 openings
• Java Software Engineer: 35,298 job openings

Indeed:

• Java Programmer: 91,021 job openings
• Java Developer: 87,065 job openings
• Java: 142,850 openings
• Java Software Engineer: 105,094 job openings

Clearly, in order to avoid missing opportunities, if you search for a position, it is critical to use the right search terms. More importantly, you should search for the same thing more than once using different search terms and using different job sites. Granted, the larger number of search results are also likely to include a higher number of irrelevant suggestions.

Read: Top Online Courses to Learn Web Development

So, Is Anyone Hiring Programmers?

The answer to the question of whether anyone is hiring programmers is yes; however, clearly you will not find as many positions for programmers as you will for developers or software engineers. Maybe the question should be changed, because, in this case, you are better off asking if anyone is hiring developers or software engineers!

Disclaimers

Clearly the numbers presented in this article are rough. They are taken at the time the article was written and are subject to change as positions get added and removed. Additionally, it could be argued that some of the results are likely not appropriate or do not fit what a technologist really cares about. While that is true, the point still remains: the search terms you use will change the results, even if they describe the same role. What you will also find is that these titles you are searching for also can impact the salary. But that is a topic for a different article!

The following table has a number of searches that were done on various topics for the three job sites:

Are you looking for a job as a developer, programmer, or IT professional? TechnologyAdvice is hiring! Check out our Careers page for more information and let them know that CodeGuru sent you!

The post Is Anyone Hiring Programmers? appeared first on CodeGuru.

With the latest preview of .NET 7 (preview 4 released in May 2022), comes a lot of exciting new features and changes. We will be discussing some of these important changes and new features in today’s tutorial and .NET preview coverage.

Let us get right into it.

Read: Project Management Software for .NET Developers

What is New in .NET 7?

Below we will discuss some of the new changes that have been announced for .NET 7 in Preview 4. This will include additions to time-based structures, feature enhancements, and a new TAR assembly and API.

Microseconds and Nanoseconds in .NET

Microseconds and nanoseconds have been added to the DateTime, TimeStamp, TimeOnly, and DateTimeOffset structures.

By adding these to the above-mentioned structures, .NET developers can save a lot of time by not having to perform calculations and computations via the Ticks property of the DateTime, TimeStamp, TimeOnly, and DateTimeOffset structures, as a single Tick (with the Ticks property) is only 100 nano seconds. Here is a short code example of how microseconds and nanoseconds work in .NET 7:

namespace System {
    public struct DateTime {
        public DateTime(int year, int month, int day, int hour, int minute, int second, int millisecond, int microsecond);
        public DateTime(int year, int month, int day, int hour, int minute, int second, int millisecond, int microsecond, System.DateTimeKind kind);
        public DateTime(int year, int month, int day, int hour, int minute, int second, int millisecond, int microsecond, System.Globalization.Calendar calendar);
        public int Microsecond { get; }
        public int Nanosecond { get; }
        public DateTime AddMicroseconds(double value);
    }
    public struct DateTimeOffset {
        public DateTimeOffset(int year, int month, int day, int hour, int minute, int second, int millisecond, int microsecond, System.TimeSpan offset);
        public DateTimeOffset(int year, int month, int day, int hour, int minute, int second, int millisecond, int microsecond, System.TimeSpan offset, System.Globalization.Calendar calendar);
        public int Microsecond { get; }
        public int Nanosecond { get; }
        public DateTimeOffset AddMicroseconds(double microseconds);
    }
    public struct TimeSpan {
        public const long TicksPerMicrosecond = 10L;
        public const long NanosecondsPerTick = 100L;
        public TimeSpan(int days, int hours, int minutes, int seconds, int milliseconds, int microseconds);
        public int Microseconds { get; }
        public int Nanoseconds { get; }
        public double TotalMicroseconds { get; }
        public double TotalNanoseconds { get; }
        public static TimeSpan FromMicroseconds(double microseconds);
    }
    public struct TimeOnly {
        public TimeOnly(int hour, int minute, int second, int millisecond, int microsecond);
        public int Microsecond { get; }
        public int Nanosecond { get; }
    }
}

Read: 7 Best C# IDEs

System.Text.RegularExpressions Enhancements in .NET

Some notable enhancements included in System.Text.RegularExpressions include:

• Regex.Count(ReadOnlySpan input): Regex.Count searches the provided string for all occurrences of a given regular expression and returns the number of matches in the supplied string.
• Regex.IsMatch(ReadOnlySpan input): Returns True if the regular expression finds a match in the input span, and False when it does not.
• Regex.EnumerateMatches(ReadOnlySpan input): Searches for all occurrences of the provided regular expression and then returns a ValueMatchEnumerator that allows you to iterate through the matches.

Tar APIs in .NET

.NET 7 includes a new Cross-Platform System.Formats.Tar assembly that allows developers to read, write, archive, and extract Tar archives. A short example on how to add a file to an existing Tar archive in .NET follows:

using MemoryStream memStream = new();
using (TarWriter tWriter = new TarWriter(memStream, TarFormat.Pax, leaveOpen: true))
{
    tWriter.WriteEntry(fileName: @"C:Source.txt", entryName: "file.txt");
}

using FileStream stOutput = File.Create(@"C:Destination.tar.gz");
using GZipStream zpOu
tput = new(stOutput, CompressionMode.Compress);
memStream.Seek(0, SeekOrigin.Begin);
memStream.CopyTo(zpOutput);

You can read more about .NET 7 Preview 4 by visiting Microsoft’s official .NET 7 page.

Read: C# Tools for Code Quality

The post Introduction to .NET 7 Preview 4 appeared first on CodeGuru.

Most importantly, we put in the hard work of endless nights of studying, and playing around with the new technology called .NET. It was all new to us, or at least to me. Making the change from Visual Basic 6 and Visual C++ 6 (packaged as Visual Studio 6) was a bit of a challenge. Most programmers, especially in the Visual Basic, world did not want to make the shift to .NET because mostly, Visual Basic 6 did not fully support proper Object Orientation.

Now, 20 odd years on, the Internet is full of information and resources. With a single Google search, you can find any answer to your programming problems. Easy. Too easy, in my opinion. CodeGuru, StackOverflow and CodeProject are full of able developers helping newbies solve problems. MSDN contains videos, tutorials, and full documentation on any method, signature, or implementation.

The trick, however, is to properly understand what you are doing. Coming from a training background, I have seen my fair share of maverick developers trying to immediately create rocket-science projects, games, or something revolutionary without understanding the basics.

Without the basics of programming, developers will never reach the levels they can.

I have worked with many younger developers that only know the latest .NET, Java, or even Python. When tasked with a project making use of older technologies they often struggle as they simply do not possess the “older” skills. The fact still remains that any developer should have a proper understanding of all the basics such as Object Orientation, Data Types’ limits, and programming workflows and techniques.

This is where the .NET coding pack comes in handy.

The .NET Coding Pack can be downloaded from here.

A nice video explaining its uses can be found here.

What is the .NET Coding Pack?

The .NET Coding pack provides handy examples and tutorials and sample programs to play with and learn from. It provides a step-by-step guide on how to do certain things, from the basics up, and why certain .NET language features work the way they do.

The Coding pack also includes Visual Studio Code and extensions for Visual Studio Code.

Figure 1 – Installing the .NET Coding Pack

Go ahead, download the .NET Coding pack, and start learning the fundamentals of .NET programming. Then come back to CodeGuru and learn more!

The post Introducing the .NET Coding Pack appeared first on CodeGuru.

Of course, most developer communities are about far more than receiving – every forum I have ever been a part of has been chock full of helpful folks who like to answer questions and pass on their programming wisdom to the younger (or less experienced) generation of coders. Teaching and helping others is another great way to learn and retain coding skills too – practice makes perfect, as they say. Plus, who doesn’t love a good coding puzzle?

Finally, developer communities are a great place to go for networking. Many a programmer has landed a job through developer forums – whether that be a long term job or just a brief freelance programming gig. And, at the end of the day, forums are not just a place to discuss all-things programming. They are a place to come and unwind, chat with online friends, and build lifelong relationships.

Developer Forums and Programmer Communities

With all of the above in mind, this week we wanted to highlight the fact that TechnologyAdvice (the people who own this – and other – websites) has several developer forums and communities in their portfolio. They cover a broad range of programming topics, including both open source and Microsoft-related.

CodeGuru Microsoft-Related Developer Forum

The first forum is CodeGuru Forums, which features 69 forum categories. While primarily focused on .NET programming topics, this community for coders also covers open source programming topics as well. The categories covered on this site include, but are not limited to, the following programming topics:

• ASP.NET forum
• C# Forum
• C++ Forum
• .NET Forum
• VB.NET Forum
• Network Programming Forum
• Java Programming Forum
• Python Programming Forum

You can register for CodeGuru Forums and view a complete list of programming topics by visiting: CodeGuru Forums Registration.

VBForums Programmer Forum

Despite its name, VBForums is about much more than VB.NET and Visual Basic programming. Programming languages and technologies ranging from Python to JavaScript are discussed here, alongside video gaming, and hardware-related topics. There are 60+ coding topics, including, but not not limited to:

• Java Community
• Visual Basic and VB.NET Community
• HTML, CSS, and JavaScript Community
• .NET Community
• PHP Community
• Internet of Things (IoT) Community
• Game Development Community

You can register at VBForums and see a full list of coding topics by visiting: VBForums Registration.

The post CodeGuru and VBForums Developer Forums and Community appeared first on CodeGuru.

What is OWASP?

As businesses move their operations online, the number of potential web application security risks increases. While many of these risks can be mitigated through proper security measures, some remain unavoidable. The Open Web Application Security Project (OWASP) has prepared a list of the top 10 web application security risks to assist enterprises in understanding and mitigating these threats.

OWASP is a non-profit foundation whose goal is to improve the overall security of software, regardless of its application or use. There are hundreds of local chapters across the globe with tens of thousands of developer and security members. They offer educational and training conferences, tools and resources to combat security risks in applications, and are a great source for community building and networking. They have been in existence and practicing their mission statement for nearly two decades and are widely respected by programmers, system administrators, and the IT community at large.

Security breaches are becoming more and more common. In fact, according to the 2016 Verizon Data Breach Report, one in every four hacking-related breaches that happened in 2016 was found on a small business. What’s worse is that there are 10 different vulnerabilities hackers commonly use to get your data. These vulnerabilities are presented by the OWASP Top 10. It is important to know what these vulnerabilities mean, how to prevent them, and how to stay secure. The sections below present a discussion on OWASP and its top 10 vulnerabilities.

Read: The Security of the Internet of Things (IoT)

What are the OWASP Top 10 Security Vulnerabilities?

Vulnerabilities in an application are defects or flaws that may be exploited to threaten the availability, confidentiality, and integrity of the application. The OWASP Top 10 comprises a collection of the most significant security vulnerabilities often encountered in web applications. Developers may build secure apps that protect their customers’ sensitive data from attackers by developing code and thorough testing while keeping these risks in mind.

Figure 1: The OWASP Top 10 Vulnerabilities

The OWASP Top 10 Vulnerabilities are:

• • Broken Access Control
  • Cryptographic Failures
  • Injection
  • Insecure Design
  • Security Misconfiguration
  • Vulnerable and Outdated Components
  • Identification and Authentication Failures
  • Software and Data Integrity Failures
  • Security Logging and Monitoring Failures
  • Server-Side Request Forgery

Read: OWASP Names a New Top 10 Vulnerability

Broken Access Control

Access control, often known as authorization, is the process by which an application allows access to certain users while denying access to others. Broken access control implies the lack of access control for a given resource and is the most common issue found in web applications. It is also known as Invalid Access Control. This can occur due to a lack of policies and procedures, or the failure to enforce access control once it is in place. Hackers can exploit this flaw to cause financial loss or identify confidential data. A hacker can gain access to a system by exploiting this issue.

Cryptographic Failures

Cryptographic failures often occur in data encryption and decryption used to secure sensitive information such as passwords, credit card numbers, and personal health records. There are three basic types of cryptographic failures: ciphertext disclosure, key management, and algorithm weaknesses.

Injection

An injection is a process that refers to incorporating insecure code into an application’s source code. Injection attacks can help gain access to secure areas and confidential information. Using injection attacks, intruders may get access to sensitive data and confidential information by posing as trustworthy users.

SQL injections, CRLF injections, and LDAP injections are examples of injections. Application security testing is a method that can detect injection vulnerabilities and provide mitigation measures such as using parameterized queries or eliminating special characters from the user input.

Injection flaws occur when malicious code is sent to your application in an unsafe manner. This can happen in two ways:

• • • • A user enters the malicious code into a form field, and it gets interpreted as code by the application.
      • Malicious code entered a URL is executed on the server, intercepting, and manipulating requests before they reach your application.

The injection flaw occurs when input from a user is not sanitized before being sent to a web application. This can happen when accepting user input in form fields, such as email addresses or passwords, on a web page. An attacker can then craft a malicious script that sends the user’s input to the application and injects malicious commands such as SQL, PHP, or script commands.

Read: Mitigate the OWASP Top 10 Web App Security Risks

Insecure Design

Insecure design is a general term that describes how developers design websites. It can mean anything from loosely securing sensitive information to failing to implement access control. Some common design flaws that lead to security issues include failure to consider all factors when designing a website, inability to properly validate data received from users, and failure to use a secure design process.

Security Misconfiguration

This flaw occurs when the security configuration of a web application is incorrect. It can happen when developers ignore, overlook, or misunderstand the security configuration. It commonly leads to users being able to view sensitive information, such as usernames and passwords, when it should be hidden from view. This can occur when the webserver incorrectly maps an HTTP request from a browser to a file on the server.

Vulnerable and Outdated Components

This flaw results when an application contains components that have known limitations or are known to be exploitable. That is, the application was designed with known security issues in mind. Known components include software libraries, protocols, programming languages, operating systems, and web browsers.

For example, a web application written in PHP and Apache could contain known vulnerabilities if the software libraries were outdated. The application could also include known assumptions on the user’s computer, such as the operating system being Windows XP. Hackers can exploit these components to cause security issues that could lead to the loss of sensitive information or security breach.

Identification and Authentication Failures

If authentication is not implemented correctly, it might pose a severe security risk. Authentication flaws may enable attackers to gain access to user accounts and perhaps the power to compromise a whole system. Attackers may readily exploit these flaws to steal legitimate users’ identities.

One means of avoiding broken authentication is multifactor authentication. Additionally, before releasing the application to the production environment, you can take advantage of DAST, and SCA scans to identify and remove privacy concerns. Additionally, session management should be implemented securely with regular checks for validity and expiration after a certain length of time with no activity.

You must have additional security measures in place to safeguard your organization’s intellectual property, such as, using SSL/TLS for data that would be transferred over the wire and implementing security measures like encryption at rest or in transit. Protecting sensitive information may be as simple as implementing data encryption, tokenization, and effective key management.

Read: 10 Top Open Source Penetration Testing Tools

Software and Data Integrity Failures

This flaw occurs when the application contains software or data known to be faulty. For example, a web application written in PHP could include erroneous data from the database. The application could also contain incorrect code from jQuery, where the programmer missed a security check. This could allow unauthorized access to sensitive information.

Security Logging and Monitoring Failures

This flaw occurs when the application fails to log or monitor user activity. It commonly leads to an attacker gaining unauthorized access to sensitive information, such as usernames and passwords. When the application fails to create log files that accurately detail user activity, it can occur. It can also happen when the application fails to monitor activity and take corrective actions if something is wrong.

Server-Side Request Forgery

This flaw occurs when the server accepts an incoming request but does not verify its authenticity or validity. For example, an application could obtain the login credentials from someone but not ensure that it was from the expected user. In this case, the server would accept login credentials from anyone. A hacker could then forge a user’s credentials and send the malicious request to the server. The server would then authenticate the malicious script and execute it, allowing the hacker to access the system.

Summary of OWASP Vulnerabilities Developers Should Know

Web application security risks are a serious concern for businesses of all sizes. Any organization that does business via the internet is vulnerable to a security breach. The OWASP Top 10 is a list of the most prevalent web application vulnerabilities. These vulnerabilities are graded from one to ten, with one being the most critical and ten least critical. This list is updated periodically to include new vulnerabilities as they are discovered.

Read: Top Web Application Firewall (WAF) Solutions

The post An Introduction to OWASP Top 10 Vulnerabilities appeared first on CodeGuru.

With Visual Studio 2022 17.1 being available, a lot of C# features have been added. Here are a few highlights, including list patterns, slice patterns, parameter null checking, and interpolated strings.

What are C# List Patterns and Slice Patterns?

A List pattern allows you to match an array of lists with a sequence of patterns. A slice pattern can only be used once and only in a list patterns clause. A list pattern is compatible with any type that is countable as well as indexable. This is because a list pattern has an accessible indexer. A slice pattern with a sub pattern is compatible with any type that is countable as well as sliceable. A small code example on its structure follows:

list_pattern_clause
  : '[' (pattern (',' pattern)* ','?)? ']'
  ;

list_pattern
  : list_pattern_clause simple_designation?
  ;

slice_pattern
  : '..' pattern?
  ;

primary_pattern
  : list_pattern
  | slice_pattern
  | 
  ;

For more information on list patterns, have a look here.

Here is some example code showing how to use list pattens in C#. The pattern [51, 52, .., 60] matches all of the following:

int[] arr1 = { 51, 52, 60 };
int[] arr1 = { 51, 52, 55, 60 };
int[] arr1 = { 51, 52, 55, 56,57, 58, 59, 60 };

Read: How to Use Dictionary Objects in C#

Parameter Null-checking in C#

C# developers are used to testing if method arguments are null in the following way:

public static void Method(string Arg)
{
    if (Arg is null)
    {
        throw new ArgumentNullException(nameof(Arg));
    }
}

With this preview feature of C# 11, the same can be accomplished by the following code:

public static void Method(string Arg!!)
{
    //Method Body
}

C# code will automatically be generated to perform the null tests. This code will execute before any of the code in the method body. In Constructors, the generated code will be performed before any field initialization.

You can also look into Nullable Reference Types (NRT) for more information.

Read: Best IDEs for .NET Developers

Interpolated Strings in C#

As C# programmers probably know, C# supports two types of interpolated strings. They are as follows.

Non-verbatim &@””

Non-verbatim interpolated strings cannot contain newlines and must always be used with escape characters such as \r and \n.

Verbatim $””

Verbatim interpolated strings are able to contain newlines and do not need to escape any characters within them.

The next code example demonstrates what would have resulted in an exception in C# 10, but not in C# 11:

var vCount = $"Count strTemp: { Something()
             Something.Else(1 + 2)[That.Can.Wrap()] }.";

There are a lot more changes expected in C# 11, so let’s see what Microsoft can come up with next!

Read more C# programming tutorials and guides.

The post C# 11 Updates: List and Slice Patterns, More appeared first on CodeGuru.

Improvements to Visual Studio 2022 Extensions

Some improvements of Extensions in Visual Studio include the following:

• VSExtensibility repository on GitHub
• Language Server Protocol (LSP)
• Visual Studio Community Toolkit
• Out-of-Proc Extensibility Model

Let’s have a closer look at each.

VSExtensibility repository on GitHub

Microsoft created a public GitHub repository, to host all the new Extensibility developments. This repo also serves as a destination for any extension-related code samples, announcements, documentation, and preview features.

The public GitHub repository can be found here.

Language Server Protocol (LSP)

The Language Server Protocol defines a set of JSON-RPC (Remote Procedure Call Protocol encoded in JSON) request, response, and notification messages. These functionalities let developers leverage capabilities specific to Visual Studio and servers.

The NuGet package can be downloaded here.

Some more documentation on the Language Server Protocol can be found here.

Visual Studio Community Toolkit

Writing a Visual Studio extension has always been tough because of numerous such as hard-to-discover, dated APIs, inconsistent, inaccurate documentation, and lack of best extensibility practices. Because of this, Microsoft created the Visual Studio Community Toolkit.

The Visual Studio Community Toolkit is a set of project templates, API wrappers, as well as productivity tools driven by the community.

To get started have a look at the VSIX Cookbook. Here you can pick your starting point (based on your experience level).

To install the extensibility workload, have a look here.

Out-of-Proc Extensibility Model

With the new Out-of-Proc Extensibility Model you can write securer and more reliable extensions. With the older Extension model, extensions crashing Visual Studio, security, incomplete and inconsistent documentation, restarting Visual Studio were common problems.

The new extensibility model loads extensions out-of-process which allows for more reliability when it comes to Visual Studio crashing or hanging. It makes extensions easier to write with more cohesive APIs and documentation.

Another benefit is that the installation of out-of-proc extensions does not need a restart of Visual Studio.

This new Out-of-Proc extensibility model is, according to Microsoft, a long, ongoing project. This means that it won’t be available at full feature parity and general consumption by the end of VS 2022’s release cycle.

To get started with Out-of-Proc Visual Studio Extensions, have a look here.

The post Extension changes in Visual Studio 2022 appeared first on CodeGuru.