11 Auditing and Monitoring Java Projects

Audit rules are static, qualitative, analyses of code.

In an auditing profile, individual rules can be enabled and configured by setting their properties. When a code construct does not satisfy a rule, a rule violation is reported. Some rules define automatic fixes that you can choose to apply.

The rules contain the properties shown in Table 11-1.

You can use auditing tools to view audit reports and to investigate and correct rule violations and over-threshold measurements. A new tab will be created in the Log window when auditing starts, and the audit report will be displayed in it.

Auditing is the static analysis of code for adherence to rules and metrics that define programming standards. Auditing finds defects that make code difficult to improve and maintain. The JDeveloper auditing tools help you find and fix such defects. Code can be audited even when it is not compilable or executable.

An audit report is a set of rule violations and metrics measurements presented as a tree organized into constructs. A construct is a method, class, package, file, project, or workspace. If the audit profile includes rules, the table will have a Severity column that shows the designated severity of the constructs. If the audit profile includes metrics, the table will have an additional column for each metric showing the measurements for the constructs.

To sort the report by the contents of a column, click the column header. To reverse the sort order, click again.

1. Create an Audit Profile that specifies the rules, code assists, and metrics used to analyze Java programs. In an Audit Profile, individual rules and metrics can be enabled and configured by setting their properties. When a code construct does not satisfy a rule, a rule violation is reported. For more information, see Working with Audit Profile.
2. Run the Audit Report.

   • From the main menu, choose Build > Audit <project>. For more information, see How to Run Audit to Generate an Audit Report.

   • You can also audit Java code from the command line by invoking ojaudit.exe, which is included in your JDeveloper installation. For more information, see Auditing Java Code from the Command Line.

3. Inspect the completed Audit Report for rule violation. For more information, see Viewing an Audit Report.

   An Audit Report displays rule violations and measurements organized as a tree. A row of the tree corresponds to either a construct or a violation, and includes any measured values for the construct or theoretical violation. A construct is a method, class, file, project, or workspace.

4. Fix an audit rule violation manually by editing the source, or for some rules, by selecting an automated fix. For more information, see How to Fix an Audit Rule Violation..
5. If you want to run the audit again, you can modify an audit profile by enabling or disabling rules, code assists, and metrics, or by changing their configuration. For more information, see Working with Audit Profile.

1. From the main menu, choose Tools >Preferences.

   The Preferences dialog opens.

2. Choose Audit and click Manage Profiles on the Audit page.
3. From the Profile drop-down list, choose a custom profile to be deleted.
4. From the More Actions drop-down list, choose Delete.

   The profile is removed from the Profile box. Note that the predefined profiles provided by the IDE are grayed out and cannot be deleted.

5. Click OK.

1. In the Tools menu, select Preferences to open the Preferences dialog.
2. Choose Audit and click Manage Profiles on the Audit page.
3. From the More Actions drop-down list, choose Import or Export, and select the profile you want to import or export.

1. In the Applications window, select one or more applications, projects, or Java source files.

   The Audit command also works for selections from other views, such as editors and the Structure window

2. From the main menu choose Build > Audit <target>, for example, Build > Audit helloWorld.java.
3. In the Audit <target> dialog, choose a profile to use in one of the two following ways:

   • From the Profile drop-down list choose a profile to use.

   • Click Edit to create or modify a profile.

4. Click Run.

   An audit report appears in the Log window, and the audit begins. If you wish to stop the audit, click the stop icon in the log's toolbar.

1. From the main menu, choose Tools > Preferences > Audit > Manage Profiles.
2. Click the Rules tab and expand the nodes, Java SE > Java > Serialization.
3. Check Non-Serializable Field in Serializable Class.

   A description of the rule is shown in right panel. You can set the default fix for the violation, the severity level of the violation, and the style of warning.

4. Click OK.

1. From the main menu, choose Tools > Preferences > Audit > Manage Profiles.
2. Click the Rules tab and expand the nodes, Java SE > Java > Serialization.
3. Check Missing Serialization UID.

   A description of the rule is shown in right panel. You can set the default fix for the violation, the severity level of the violation, and the style of warning.

4. Click OK.

JDeveloper generates a report of all audit rule violations. Use the audit report to investigate and correct rule violations and over-threshold measurements. As shown in Figure 11-2, audit reports are displayed as tabbed panes of the Log window. In this window, you can choose a fix for a rule violation from a drop-down menu. For an individual rule violation, choose among the fixes defined for that violation's type.

Figure 11-2 Audit Report

Use refresh to rerun an audit using the same profile. You may wish to perform a refresh after you have made changes and fixes to your code.

To refresh an audit report:

1. In the audit report, select the construct you want to view.
2. Right-click and choose Go to Source, or double-click the construct.

   An editor for the source file opens with the cursor positioned at the location of the rule violation or the code element measured

3. Right-click on a violation or anomaly, and select About violation Rule to learn more about the rule that has been violated. A dialog describing the rules displays, as shown in Figure 11-3.

Figure 11-3 About Rule Dialog

You can rearrange the audit report columns into left or right positions.

To organize audit report columns:

• Drag the column headers left or right to your preferred position.

1. Click the Group By icon in the Log window toolbar.
2. Select the constructs you want to see.
3. Click OK.
4. Click a column header to sort rows by that column.

   To reverse the sort order, click again.

You specify filters to prune the set of Java classes whose violations are shown. You can filter by package names, class names, or both. A filter consists of one or more patterns separated by commas.

A pattern can contain the following special characters:

• * matches any number of characters

• ? matches any single character

• ! at the beginning of a pattern denotes an exclusion pattern

The set of classes that passes a filter is determined by considering the patterns in order. A non-exclusion pattern adds all classes that match the pattern to the set, an exclusion pattern removes all classes that match the pattern from the set. Table 11-7 contains the filters you can specify

1. In the audit report, select the rule violation (a leaf node in the Constructs tree).
2. Right-click, and choose an Apply <Rule> Fix menu item, if any.

   or

   Click in the Log window toolbar, and choose one of Apply <Rule> Fix menu items.

1. In the audit report, select the construct (a container node in the Constructs tree).
2. You can apply default fixes in one of the two following ways:

   • Right-click, and choose Apply Default Fixes.

   • Click in the Log window toolbar, and choose Apply Default Values.

1. In the audit report, right-click to open the context menu.
2. Choose Show Hidden Issues.

   All of the previously hidden rule violations are restored to the audit report.

When you open the HTTP Analyzer from the Tools menu, the HTTP Analyzer Log window opens, illustrated in Figure 11-4. By default its position is at the bottom center of JDeveloper, alongside the other log windows.

Figure 11-4 HTTP Analyzer Log Window

When HTTP Analyzer runs, it outputs request/response messages to the HTTP Analyzer log window. You can group and reorder the messages:

• To reorder the messages, select the Sequence tab, then sort using the column headers (click on the header to sort, double-click to secondary sort).

• To group messages, click the Correlation tab.

• To change the order of columns, grab the column header and drag it to its new position.

An empty HTTP Analyzer test window appears when you click the Create New Request button in the HTTP Analyzer Log window. A test window showing details of the request/response opens when you choose Test Web Service from the context menu of a web service container in the Applications window, or when you double-click a line in the HTTP Analyzer Log Window, illustrated in Figure 11-5. By default, its position is in the center of JDeveloper, in the same place that the source editor appears.

Figure 11-5 HTTP Analyzer Test Window

The test window allows you examine the headers and parameters of a message. You can test the service by entering a parameter that is appropriate and clicking Send Request.

The tabs along the bottom of the test window allow you choose how you see the content of the message. You can choose to see the message as:

• The SOAP structure, illustrated in Figure 11-5.

• The HTTP code, for example:

  <?xml version="1.0" encoding="UTF-8"?>
  <env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://annotation/">
      <env:Header/>
      <env:Body>
          <ns1:getDeptInfo>
              <arg0/>
          </ns1:getDeptInfo>
      </env:Body>
  </env:Envelope>
  

• The hex content of the message, for example:

  [000..015] 3C 3F 78 6D 6C 20 ... 3D 22 31    <?xml version="1
  [016..031] 2E 30 22 20 65 6E ... 22 55 54    .0" encoding="UT
  [032..047] 46 2D 38 22 3F 3E ... 6E 76 65    F-8"?> <env:Enve
  [048..063] 6C 6F 70 65 20 78 ... 76 3D 22    lope xmlns:env="
  

• The raw message, for example:

  POST http://localhost:7101/WebService-Annotation-context-root/MyCompanyPort HTTP/1.1
  SOAPAction: ""
  Content-Type: text/xml; charset=UTF-8
  Host: localhost:7101
  Content-Length: 277
   
  <?xml version="1.0" encoding="UTF-8"?>
  <env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://annotation/">
      <env:Header/>
      <env:Body>
          <ns1:getDeptInfo>
              <arg0/>
          </ns1:getDeptInfo>
      </env:Body>
  </env:Envelope>
  

When you open the HTTP Analyzer from the Tools menu, the HTTP Analyzer Instances window appears. By default, its position is at the bottom center of JDeveloper, as a tab alongside the HTTP Analyzer log window. This window provides information about the instances of the HTTP Analyzer that are currently running, or that were running and have been stopped. The instance is identified by the host and port, and any rules are identified. You can start and stop the instance from this window.

Figure 11-6 HTTP Analyzer Instances Window

You create a new instance in the HTTP Analyzer page of the Preferences dialog, which opens when you click .

When you start the HTTP Analyzer, all Java processes and application server activity with JDeveloper will send their traffic via the HTTP Analyzer, using the proxy settings in the HTTP Analyzer page of the Preferences dialog, which opens when you click the Start HTTP Analyzer button in the Instance or Log window. By default, the HTTP Analyzer uses a single proxy on an analyzer instance (the default is 8099), but you can add additional proxies of your own if you need to.

Each analyzer instance can have a set of rules to determine behavior, for example, to redirect requests to a different host/URL, or to emulate a web service.

1. Open the HTTP Analyzer preferences dialog by doing one of the following:

   • Click the Start HTTP Analyzer button in the HTTP Analyzer Instances window or Log window.

   • Choose Tools > Preferences to open the Preferences dialog, and navigating to the HTTP Analyzer page.

   For more information at any time, press F1 or click Help from the HTTP Analyzer preferences dialog.

2. Make the changes you want to the HTTP Analyzer instance. For example, to use a different host and port number, open the Proxy Settings dialog by clicking Configure Proxy.

1. Open the HTTP Analyzer preferences dialog by doing one of the following:

   • Click the Analyzer Preferences button in the HTTP Analyzer Instances window or Log window.

   • Choose Tools > Preferences to open the Preferences dialog, and navigating to the HTTP Analyzer page.

   For more information at any time, press F1 or click Help from the HTTP Analyzer preferences dialog.

2. To create a new HTTP Analyzer instance, that is a new listener, click Add. The new listener is listed and selected by default for you to change any of the values.

1. First you create a new Firefox profile. By default, starting Firefox from the command line opens a window on your currently open instance of Firefox, so you need to use -no-remote to create a separately configured instance Run the following from the command line

   firefox -no-remote -CreateProfile Debugging
   

2. Start Firefox using this profile

   firefox -no-remote -P Debugging
   

3. Next you configure JDeveloper to start this version of Firefox. From the main menu, choose Tools > Preferences.
4. In the Preferences dialog, select the Web Browser and Proxy node. For more information, press F1 or click Help from within the dialog page.
5. In the Browser Command Line, enter or browse to the correct location, and enter firefox -no-remote -P Debugging. JDeveloper underlines this in red, and when you close the dialog you will see a Command Line Validation Error warning which you can safely ignore.
6. Click OK. When you start the HTTP Analyzer and run an HTML or JSP or JSF page from within JDeveloper, a new instance of Firefox using the Debugger profile is started.

You can use the HTTP Analyzer with secured services or applications, for example, web services secured by policies. JDeveloper comes with a set of preconfigured credentials, HTTPS Credential, which is always present. You cannot delete or edit HTTPS Credential, but you can copy it to create a new credential of the same type.

When you run the service or application the analyzer uses the supplied credentials for perform the appropriate action.

The HTTP Analyzer can use the following types of credential:

HTTPS Keystore

HTTPS encrypts an HTTP message prior to transmission and decrypts it upon arrival. It uses a public key certificate signed by a trusted certificate authority. When the integrated application server is first started, it generates a DemoIdentity that is unique to your machine, and the key in it is used to set up the HTTPS channel.

The client keystore identity is used for configuring HTTPS. The server keystore identity is used when the HTTP Analyzer is acting as a server; it is not used when connecting to a remote server.

For more information about keystores and keystore providers, see Oracle Fusion Middleware Understanding Security for Oracle WebLogic Server. When the default credential HTTPS Keystore is selected, you need to specify the keystores that JDeveloper and the HTTP Analyzer should use when handling HTTPS traffic. Two keystores are required to run the HTTP Analyzer:

• The client keystore, containing the certificates of all the hosts to be trusted by JDeveloper and the Analyzer (client trust) when it makes onward connections.

• The server keystore, containing a key that the Analyzer can use to authenticate itself to calling clients (server keystore).

The client keystore is only required when mutual authentication is required.

You can create extra HTTPS keystores in addition to the default one provided by JDeveloper.

Username Token

Username token is a way of carrying basic authentication information. You supply a username/password to provide authentication.

X509 Certificates

X509 is a PKI standard for single sign-on, where certificates are used to provide identity, and to sign and encrypt messages. You enter details of an X509 certificate. When you supply a valid keystore and the password for the keystore, the client key aliases are populated.

If JDeveloper has any problems finding and opening the keystore, error messages will be displayed.

STS Configuration

A Secure Token Service (STS) is a web service that issues and manages security tokens over HTTPS. You enter the Security Token Server provider URL and optionally a policy URL.

Note:

The client truststore must contain the server public key, otherwise when the HTTP Analyzer requests the SAML token it will fail.

OAuth Details

OAuth is an open authentication protocol that allows users to approve application to act on their behalf without sharing their password. You can test resources protected by OAuth protocol security using a valid OAuth credential, for example, to test resources that use Twitter feeds.

Note:

To access resources owned by users with a service provider you must first register with the service provider.

Import from JPS Config

Use to test JRF web services. jps-config.xml contains the security information that the HTTP Analyzer needs to access the service.

You can import of data from jps-config.xml into a credential record. You provide the location of jps-config.xml and enter the name of a CSF key and JDeveloper creates a credential record with the necessary data read from jps-config.xml and from the underlying wallet file.

Data imported from jps-config.xml is populated in the X509 Certificates tab and in the Username Token tab.

Once saved, the credential record can be used repeatedly in the HTTP Analyzer and during web service proxy generation as the source for the keystore, keys and other required data.

1. Open the HTTP Analyzer by choosing Tools > HTTP Analyzer. The HTTP Analyzer docked window opens.
2. Start the HTTP Analyzer by clicking the Start HTTP Analyzer button. By default, this starts the listener on your localhost's hostname on port 8098. You can add new listeners, and use different hosts and ports, configure HTTPS, or set up rules to determine how the analyzer works.
3. Run the class, application, web service and so on that you want to analyze in the usual way.

   Each request and response packet is listed in the HTTP Analyzer Log window, and detailed in the HTTP Analyzer Test Window.

1. Configure a browser to route messages through the HTTP Analyzer so that you can see the traffic between the web browser and client.
2. Start the HTTP Analyzer running.
3. Run the class, application, or Web page that you want to analyze in the usual way.

   Each request and response packet is listed in the HTTP Analyzer Log window, and detailed in the HTTP Analyzer Test Window.

1. In the Request pane of the HTTP Analyzer Test window, click Copy Request. This opens a new test window, where you can enter a new parameter to send.

   Alternatively, you can open a new test window by double-clicking a line in the HTTP Analyzer Log window.

You can set rules so that the HTTP Analyzer runs using behavior determined by those rules. You can set more than one rule in an HTTP Analyzer instance. If a service's URL matches a rule, the rule is applied. If not, the next rule in the list is checked. If the service does not match any of the rules the client returns an error. For this reason, you should always use a Pass Through rule with a blank filter (which just passes the request through) as the last rule in a list to catch any messages not caught by the preceding rules.

The types of rule available are:

• Pass Through Rule

• Forward Rule

• URL Substitution Rule

• Tape Rule

1. Open the HTTP Analyzer by choosing Tools > HTTP Analyzer. The HTTP Analyzer docked window opens.

   Alternatively, the HTT Analyzer automatically opens when you choose Test Web Service from the context menu of a web service container in the Applications window.

2. Click the Analyzer Preferences button to open the HTTP Analyzer preferences dialog, in which you can specify a new listener port, or change the default proxy.

   Alternatively, choose Tools > Preferences, and then navigate to the HTTP Analyzer page.

3. Click Configure Rules to open the Rule Settings dialog in which you define rules to determine the actions the HTTP Analyzer should take. For more help at any time, press F1 or click Help in the Rule Settings dialog.
4. In the Rule Settings dialog, enter the URL of the reference service you want to test against as the Reference URL. This will help you when you start creating rules, as you will be able to see if and how the rule will be applied.
5. Define one or more rules for the service to run the client against. To add a new rule, click the down arrow next to Add, and choose the type of rule from the list. The fields in the dialog depend on the type of rule that is currently selected.
6. The rules are applied in order from top to bottom. Reorder them using the up and down reorder buttons. It is important that the last rule is a blank Pass Through rule.

This section contains information about using the HTTP Analyzer with web services developed in JDeveloper. In general, you can use HTTP Analyzer to examine the content of web services in the same way as using it to examine any packets across HTTP.

The HTTP Analyzer will pass unsecured WebSockets requests via a proxy.

The content of the request response stream will be available in the HTTP Analyzer after you close and reopen the message. The WebSockets messages are those with a response code of 101.

The HTTP Analyzer works with Fast Info set, but it will default to sending soap/xml instead unless you override the Content-Type in the HTTP headers.

• SOAP 1.1 Change the Content-Type to application/fastinfoset.

• SOAP 1.2 Include the action name, for example

  application/soap+fastinfoset;action="http://project1/HelloWorldSOAP12/helloRequest