CodeSOD: Under the Sheets

Many years ago, Sam was obeying Remy’s Law of Requirements Gathering (“No matter what your requirements actually say, what your users want is Excel”) and was working on a web-based spreadsheet and form application.

The code is not good, and involves a great deal of reinvented wheels. It is, for example, Java based, but instead of using any of the standard Java web containers for hosting their code, they wrote their own. It’s like Java Servlets, but also is utterly unlike them in important and surprising ways. It supports JSP for views, but also has just enough surprises that it breaks new developers.

But let’s just look at how it handles form data:

// form field information
String[] MM_fields = null, MM_columns = null;

// …snip…

String MM_fieldsStr = “phone|value|organization|value|last_name|value|first_name|value|password|value|email_opt_in|value”;
String MM_columnsStr = “phone|’,none,”|organization|’,none,”|last_name|’,none,”|first_name|’,none,”|password|’,none,”|email_opt_in|none,1,0″;

// create the MM_fields and MM_columns arrays
java.util.StringTokenizer tokens =
new java.util.StringTokenizer( MM_fieldsStr, “|” );
MM_fields = new String[ tokens.countTokens() ];
for (int i=0; tokens.hasMoreTokens(); i++)
MM_fields[i] = tokens.nextToken();

tokens = new java.util.StringTokenizer( MM_columnsStr, “|” );
MM_columns = new String[ tokens.countTokens() ];
for (int i=0; tokens.hasMoreTokens(); i++)
MM_columns[i] = tokens.nextToken();

Who doesn’t love hard-coded lists of strings with characters separating them, which then need to be parsed so that you can convert that into an array?

The MM_fieldsStr seems to imply the input data will be “key|value” pairs, and the MM_columnsStr seems to imply a specific default value, I think- but look at those quotes and commas. This is generating strings which will be injected into JavaScript. And who knows what’s happening on that side- I certainly don’t want to.

Also, what even is the MM_ prefix on our variables? It looks like Hungarian notation, but conveys no information- maybe it’s RÄ“kohu notation?

As you can imagine, this whole solution was incredibly fragile and didn’t work well.

Source: Read More