Generating an Array of Consecutive Intergers in C#

Recently I had to generate an array of consecutive integers from 0 to n-1 for a given number n. I found three ways of doing this in C#, some of which are more elegant and succinct than others. Now I would like to find out which of them is the most efficient and why.

The three methods are:

1. Using a conventional loop
2. Using a clever variant of the LINQ Select query
3. Using the Range method of the Enumerable class

1. The first method uses a plain loop in a straightforward way.

public static int[] PlainLoop(int n)
{
    //create an array of n integers
    var arr = new int[n];
    // in a loop set each element of the array to be equal to its index
    for (int i = 0; i < n; i++) arr[i] = i;
    //return results
    return arr;
}

We instantiate an array of n integers, all elements by default being 0. Then we loop through the array and make each element to be equal to its index in the array. So the element with index 0 is 0, the element with index 1 is 1, and so on until we come to the last element, which has index n-1. So basically the problem is reduced to returning the array of indices of an array of length n!

2. Then I thought, why not implement this idea as a one-liner, using LINQ (Language Integrated Query), and specifically the LINQ Select query with index:

public static int[] LinqSelect(int n)
{
    //create an array of n integers, 
    //then use Linq Select with Index, to get the indexes of the array, 
    //and create an array based on this select query
    return new int[n].Select((x, ind) => ind).ToArray();
}

So again we create an array of n integers, then select the indices of the array into a separate array. This looks pretty nice and quite straightforward.

3. Another method, which I think has been designed specifically for this purpose, is to use the static Range method of the System.Linq.Enumerable class. This gives us a perfect one-liner:

public static int[] EnumerableRange(int n)
{
    //use the Range query of the Enumerable class
    //and create an array based on this select query 
    return Enumerable.Range(0, n).ToArray();
}

The Range method generates a sequence of integers, whereby you can specify the number to start with (in our case 0) and how many numbers you want (in our case n).

So far so good. Now let's look at the performance of these three methods, by executing them in a profiler. I created a unit test that exercises each of these methods with n equal to 1 million:

[TestMethod]
public void GenArrayOfConsInts_PerfTest()
{
    int n = 1000000;
    var arr1 = GenConsecInts.PlainLoop(n);
    var arr2 = GenConsecInts.LinqSelect(n);
    var arr3 = GenConsecInts.EnumerableRange(n);
}

In the Visual Studio Text Explorer, we can run this test through the performance profiler:

Let us examine the call tree trace of the profiler:

We see that the plain loop method is the most efficient one taking only 2.67% of the total processing time. Then comes the Enumerable.Range method with 9.86% (almost 4 times slower), and then comes the LINQ Select method with the staggering 87.44% (about 30 times as slow as the plain loops). We also notice that a select in this method is called 1,000,000 times, for each array element taking quite some time to execute.

So the conclusion is pretty clear, using plain loops in this way is very fast, Enumerable.Range is also OK, and in addition very elegant (!), but LinqSelect is way too slow. The question is of course: why is that?

I will update this post when I figure out the why!

Learning Web App Security with Google Gruyere

I've been developing web applications for almost 10 years now, but I was rarely concerned with application security issues. To be sure, I am a defensive programmer, meaning that I do all kinds of checks on the inputs received by my functions, leaving very little to chance. But although I heard much about cross site scripting (XSS) and SQL injection, I didn't have a very clear understanding of these concepts. I relied on best practices (like parametrized database queries) and inherent ASP.NET features like request validation to take care of malicious inputs, be it form variables or query string parameters.

Yet I always had a gnawing feeling that I should get more understanding of web app vulnerabilities, attacks and defenses. So this month I started to look for way of how I can brush up on this important topic.

I found a couple of books, of which this one seems to collect a lot of praise from readers: The Web Application Hacker's Handbook (WAHH). I started to read the book, but I also wanted something more practical. I came across Open Web Application Security Project (OWASP) with its plenitude of resources and the famous OWASP Top 10 list of web app security flaws.

OWASP members also develop security software such as the security testing tool ZAP and the request intercepter proxy WebScarab. Both I really handy and easy to use.

OWASP has also produced WebGoat, a fictitious web application full of vulnerabilities that you can run and test locally on your PC. WebGoat has a number of lessons to teach about various security flaws that you can try to discover on your own with the help of some hints. Although a great resource, I found WebGoat somewhat lacking in the quality of their materials.

And then I stumbled upon Google Gruyere, which is a very elaborate web security code lab from Google Code University. It is much similar to WebGoat in that it gives you a sandbox to learn about and try to dicover security flaws in a Python web application that you can run either locally or online. It does a great job of explaining various security concepts and provides challenges to explore them in practice as well as guidance on how to guard against them. It is especially good at explaining the various flavors of XSS attacks, but it also provides a good foundation for understanding many other topics such as path traversal, denial of service and code execution. It touches upon but doesn't go into the details of SQL injection.



I've gone through the lab and thoroughly enjoyed the challenges and learned to use the tools like WebScarab and ZAP. I'd recommend it to anyone interested in web application security!

In parallel I did some security testing of the web applications that I've been involved with for the last year or so. I found that ASP.NET does a great job protecting ASP.NET applications from certain types of attacks out of the box. I found some minor flaws that are mostly due to relying too much on client side validation and forgetting to validate user input again on the server. A quite trivial example of this is being able to intercept a request and change the house number to a negative value. But I also discovered a more serious exploit using the same technique, which I will not describe here :)

The main lesson that I've drawn so far is that we should never trust input coming into our applications, be it through a web browser or a web API. Most security flaws in software result from sloppy programming. Web developers should be well aware of these issues and write their code defensively and test it thoroughly not only from the point of view of functionality but also security-wise.

To sum up, these have been very interesting and instructive few weeks. Web application security is a fascinating topic and I look forward to diving even deeper into it!

Happy coding!

Stopwatch Class and Handy Static Methods of Enumerable

It's amazing how much there is to discover about .NET Framework! A couple of days ago I came across a neat little class called System.Diagnostics.Stopwatch, which was introduced in .NET 2.0! This class comes in handy when you want to measure how long certain operations​ take to execute. I used to work with endTime - startTime, which yiels a timespan, which than needs to be converted to milliseconds or something:

startTime = DateTime.Now;
// do the  processing
endTime = DateTime.Now;
long msElapsed  = (endTime - startTime).Milliseconds / TimeSpan.TicksPerMillisecond;

The Stopwatch class makes our life a bit easier:

Stopwatch sw = new Stopwatch();
sw.Start();
// do the processing
sw.Stop();
long msElapsed =  sw.ElapsedMilliseconds;

Another handy little thing to know is that the System.Linq.Enumerable class has 3 very useful static methods:

Enumerable.Empty<T>() returns an empty set of class T
Enumerable.Range(int start, int count) returns a range of count integers starting from start
Enumerable.Repeat(TResult element, int count) returns a sequence of count objects of type TResult

Happy coding!

Software Development without Source Control?

You'd think that every single company that does anything with software development would be using some form of source code control.

Not quite so. Just recently I spent a few days helping a customer that has 3 software developers and many different applications, both web and desktop apps. To my surprise they were not using any source control. I was quite shocked. At the end of each day, I had to upload my code to my web mail, just to be sure it doesn't get lost if my laptop crashes or gets stolen.

They explained that they almost never work on the same application with more than one developer and that their production environment always has the latest code deployed to it. Well, for web applications, because they are using ASP.NET Websites (as opposed to ASP.NET web applications) and they deploy all their source code into production environment, at least they have their source code relatively safe. But for  desktop applications, this is obviously not the case, because a desktop app must first be compiled.

There are of course many advantages to using source code control. To name just a few:

1. Source code (which is one of the main assets of any software project) is safely stored and hopefully regularly backed up, so that it does not get lost.
2. Every developer has access to the latest version of the source code, without having to copy files from one developer to another.
3. Source control systems maintain a history of changes to the source code, so that it's always possible to see who, when and how changed the code. And often, if developers are disciplined enough to comment before checking-in their code, one can even deduce why certain changes were maid.
4. Using source control, source code can be versioned and labeled, so that one can easily see what code is part of what version of the product.
5. There are more advanced source control features that can greatly improve the software development cycle, such as branching and check-in policies.

Delta-N, the company that I work for, specializes in Microsoft TFS (Team Foundation Server), which is an excellent source control system, but is also much much more. We've already made an appointment with this particular customer to see if we can help them set up source control!

Solving web.config conflicts in child ASP.NET web apps in subdirectories

It often happens that we want to host a .NET web app as a (virtual) subdirectory under another existing web application. For example, we have a parent web app at http://mywebapp.com and a child web app at http://mywebapp.com/admin/

Because of the way that configuration settings are inherited in ASP.NET, it can happen that the parent app web.config settings conflict with the child app web.config, leading to configuration errors in the child application. To solve this prolbem, we need to disable web.config inheritance in the web.config file of the parent application. This is done by wrapping the whole <system.web> section into a <location> element with the inheritInChildApplications attribute set to "false", like this:

  <location inheritInChildApplications="false">

    <system.web>
       ...

    </system.web>   

  </location>

Happy coding!

How to combine URLs with relative paths in C#

Many of us are familiar with the wonderful class System.IO.Path. It makes life a lot easier when working with file system paths, for example:

string filePath = System.IO.Path.Combine(@"c:\docs", @"important\", "myfirst.doc");

This results in in this path: c:\docs\important\myfirst.doc
This is handy when you need to combine a (part of the) path coming from a config file or as a parameter and you don't know for sure whether people work with trailing or leading slashes or not. The static methods of the Path class take care of that for us!

Now, I've been wondering for some time if there is a way to do something similar with URLs and relative paths. The easiest way to do this that I found is to use the constructor of the System.Uri class:

string webPath = new Uri(new Uri("http://www.delta-n.nl/"), @"\public\default.aspx").ToString();

This results in http://www.delta-n.nl/public/default.aspx. To be on the safe side, you could even better use the System.Uri.TryCreate(...) static method.

There is also a class called System.Web.VirtualPathUtility. However it works only with the paths from the current web app context and cannot be used for the above scenario.

Happy coding!