Obfuscation and Velocity

[Carfield Yim <ca...@netdimensions.com>]

Have searched the mailing list before, but all links are broken:

http://www.mail-archive.com/cgi-bin/htsearch?config=velocity-user_jakarta_apache_org&restrict=&exclude=&words=obfuscation

Thus... could anyone know a better way to run velocity with Obfuscation.
Do I possible to pre-compile velocity template?



---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org

Re: Obfuscation and Velocity

[Christoph Reck <ap...@recks.org>]

Look at the sources, there is no javadoc on doing this. As Shinobu
pointed out, the template compiler was never implemented, since
the parser is quite fast and template caching does the rest.

Your itch is a special case, which might be of interest to some
others. In any case, if you really need it, probably it is the best
to do it yourself as noted. Be warned, it won't be an easy task.

If you find trouble with searializing the velocity classes, you
might try to fix it and send patches or seek advice in the
velocity-dev list.

Carfield Yim wrote:
> Christoph Reck wrote:
> 
>> Hi Yim,
>[snip]
>>
>> You seem to want to obfuscate the template... maybe you should
>> check if the AST-node representation of templates can be
>> serialized and use your own resource loader taking the
>> serialized version instead of the text template...
>>
>>
> Yeah... this should be what I looking for, would you recommend pointer 
> of velecity javadoc of doing that?

http://svn.apache.org/viewcvs.cgi/jakarta/velocity/trunk/src/java/org/apache/velocity/runtime/parser/node/SimpleNode.java?view=auto

But ugh! it does not implement Searializable... Well that is the
first obstacle to overcome or workaround...


Cheers
Christoph

---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org

Re: Obfuscation and Velocity

[Carfield Yim <ca...@netdimensions.com>]

Christoph Reck wrote:
> Hi Yim,
> 
> to my knowledge, you can tell the obfuscator to not touch
> specific classes/classNames/methods, which are part of
> the external API.
> 
> Velicity uses java objects placed in the context under a
> specific keyName, which are then accessed in the template
> with the $keyName as a reference. $keyName alone would
> insert the output of the toString() method (of the Object
> class, which may have been overriden by any subclass).
> 
> You may also reference any method of a context object, or
> implicetely bean getter methods; aka. $keyName.getMyValue()
> is the same as $keyName.myValue through the velocity
> reflection implementation. Also Collection methods (iterator)
> are implicetely used in the #foreach directive.
> 
> So when you use an obfuscator, you have to clearly define
> the API between your context classes and the template
> designer. These method names need to be left untouched.
> 
> IMHO, this should be clear to anyone using an obfuscator
> and knowing the java reflect API.
> 

Thx, but in practice the interface between velocity and the API of my 
project is not that statics, due to various refactoring, I wish to 
improve the build time check as much as possible.

I have also think about adding unittest for this. However, it is hard to 
run unittest base on obfuscated build. And it is hard to tell which 
method have error in unittest of obfuscated build

> 
> Aha, here you are adressing something else as java class obfuscation.
> 
> You seem to want to obfuscate the template... maybe you should
> check if the AST-node representation of templates can be
> serialized and use your own resource loader taking the
> serialized version instead of the text template...
> 
> 
Yeah... this should be what I looking for, would you recommend pointer 
of velecity javadoc of doing that?


---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org

Re: Obfuscation and Velocity

[Christoph Reck <ap...@recks.org>]

Hi Yim,

to my knowledge, you can tell the obfuscator to not touch
specific classes/classNames/methods, which are part of
the external API.

Velicity uses java objects placed in the context under a
specific keyName, which are then accessed in the template
with the $keyName as a reference. $keyName alone would
insert the output of the toString() method (of the Object
class, which may have been overriden by any subclass).

You may also reference any method of a context object, or
implicetely bean getter methods; aka. $keyName.getMyValue()
is the same as $keyName.myValue through the velocity
reflection implementation. Also Collection methods (iterator)
are implicetely used in the #foreach directive.

So when you use an obfuscator, you have to clearly define
the API between your context classes and the template
designer. These method names need to be left untouched.

IMHO, this should be clear to anyone using an obfuscator
and knowing the java reflect API.

Carfield Yim wrote:
> Have searched the mailing list before, but all links are broken:
> 
> http://www.mail-archive.com/cgi-bin/htsearch?config=velocity-user_jakarta_apache_org&restrict=&exclude=&words=obfuscation
> 
> Thus... could anyone know a better way to run velocity with Obfuscation.
> Do I possible to pre-compile velocity template?

Aha, here you are adressing something else as java class obfuscation.

You seem to want to obfuscate the template... maybe you should
check if the AST-node representation of templates can be
serialized and use your own resource loader taking the
serialized version instead of the text template...


Hope this points you onto the right direction...

Cheers,
Christoph


---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org