Day: September 22, 2021

When working with an application with a global user base, there is usually a need to display text, numbers, currency, date, and time in multiple localized formats. For example, the en-US (English-USA) version of the date

September 22, 2021 

is written as

22  2021 .

when the locale used is ru-RU (Russian-Russia).

In this tutorial, we will learn how to format currency and date in localized formats using java.time.* and java.text.* classes.

At the end of this tutorial, you would have learned:

1. How to format currency based on locale.
2. How to format dates based on locale.

1. Basic Java.

1. A Java IDE.

Before proceeding further, let us discuss an important concept: java.util.Locale.

A Locale object is an encapsulation of data used to specify the language, the country, and/or the variant of a geographic region.

There are 3 Locale constructors:

    public Locale(String language)
    public Locale(String language, String country)
    public Locale(String language, String country, String variant)

When creating a Locale object (the first constructor), you must at least pass in a language code, which must be in the form of an ISO 639 alpha-2 or alpha-3 language code, or a language subtag up to 8 characters in length. For this tutorial, we will only be using the ISO 639-1 alpha-2 language code, which is in the form of lowercase 2 letters abbreviation (i.e, en, es).

For the second constructor, we can pass in a country code as well, which must be in the form of An ISO 3166 alpha-2 country code or a UN M.49 numeric-3 area code. For this tutorial, we will be using the ISO 3166 alpha-2 country code, which is in the form of uppercase 2 letters abbreviation (i.e, US, UK).

We do not concern ourselves with the locale variant in this tutorial.

Besides using constructors, Locale objects can also be created using the convenient constants that the Locale class provides, such as

Locale.UK

or

Locale.CANADA

After retrieving the Locale object, we can then pass it to DateTimeFormatter or NumberFormat instances to localize the data.

Now that we have finished talking about concepts, perform the steps below to set up our project:

1. Create a new Java project.
2. Create a package com.example.
3. Create a Java class called Entry.java. This is where our main() method lives.

First, create a method called localizeDate() that takes a LocalDate argument and a Locale argument. This method will return the formatted String representation of a localized date.

    private static String localizeDate(LocalDate date, Locale locale){ //7
       DateTimeFormatter formatter = DateTimeFormatter //8
               .ofLocalizedDate(FormatStyle.LONG) //9
               .withLocale(locale); //10

       return formatter.format(date); //11
    }

DateTimeFormatter does not have a public constructor, so we have to use the static factory methods to create an instance of DateTimeFormatter. The static factory method used has this signature:

public static DateTimeFormatter ofLocalizedDate(FormatStyle dateStyle)

It requires a FormatStyle enum as an argument. So we pass to it a FormatStyle.LONG constant at line 9. There are 4 constants in total in FormatStyle, SHORT, MEDIUM, LONG, and FULL. You can experiment with passing in different constants to see how the output changes.

On line 10, we use the withLocale() method to return a copy of the previous instance (including FormatStyle choice) with our choice of Locale.

To format the date, we only have to call the format() method at line 11.

Back in main(), create a new array of Locales and one LocalDate object to pass to our localizeDate() method.

    //Pre-made locales
    Locale[] locales = {
           Locale.US,
           Locale.JAPAN,
           Locale.FRANCE,
           Locale.KOREA,
           new Locale("es", "PE")
    }; //1

    LocalDate now = LocalDate.now(); //2

We need an array of Locales because it is interesting to observe how different Locales can produce different output. The first 4 Locale objects in the array were obtained using the convenient constants in Locale. The last Locale object was created using the constructor (which I have explained earlier) using the language and country codes. PE is the ISO 3166-2 country code for Peru and es is the ISO 639 alpha-2 language code for Spanish.

Now loop through the array and call the localizeDate() method against each Locale using the same LocalDate object now.

    //localized date loop
    for (Locale locale : locales){
       System.out.println("Locale: " + locale + ", date: " + localizeDate(now, locale)); //3
    } //4

The code prints:

    Locale: en_US, date: September 22, 2021
    Locale: ja_JP, date: 2021922
    Locale: fr_FR, date: 22 septembre 2021
    Locale: ko_KR, date: 2021 9 22
    Locale: es_PE, date: 22 de setiembre de 2021

As you can see, the ordering of the day of month, the month, and the year have all been automatically switched up depending on the Locale.

Next, we will create a method to localize currency (aka printing money in a specific format based on the Locale).

    private static String localizeCurrency(BigDecimal money, Locale locale){ //12
       return NumberFormat //13
               .getCurrencyInstance(locale) //14
               .format(money); //15
    }

In the localizeCurrency() method above, we use a similar approach to the localizeDate() method, but we have to use a different class to format monetary values, NumberFormat.

NumberFormat can format more than just currency, but we are not concerned with the other types for now; that is why we used the factory method getCurrencyInstance() at line 14 to get an instance specialized in formatting currencies. We also passed in the Locale object so the NumberFormat instance knows which Locale should the currency format be in.

Back in main(), create a random monetary value:

    BigDecimal money = BigDecimal.valueOf(1_484.2428127233); //5

Since we already declared our Locale array previously, we can just re-use it for our currency loop.

    //localized currency loop
    for (Locale locale : locales){
       System.out.println("Locale: " + locale + ", money: " + localizeCurrency(money, locale)); //6
    } //7

When executed, the code prints:

    Locale: en_US, money: $1,484.24
    Locale: ja_JP, money: 1,484
    Locale: fr_FR, money: 1484,24 
    Locale: ko_KR, money: 1,484
    Locale: es_PE, money: S/ 1,484.24

All of the currency symbols, number formatting, and currency symbols have been automatically added for our convenience. The last currency symbol of S/ is not an error. S/ is the official currency notation for the Peruvian Sol.

    package com.example;

    import java.math.BigDecimal;
    import java.text.NumberFormat;
    import java.time.LocalDate;
    import java.time.format.DateTimeFormatter;
    import java.time.format.FormatStyle;
    import java.util.Locale;

    public class Entry {

       public static void main(String[] args){
           //Pre-made locales
           Locale[] locales = {
                   Locale.US,
                   Locale.JAPAN,
                   Locale.FRANCE,
                   Locale.KOREA,
                   new Locale("es", "PE")
           }; //1

           LocalDate now = LocalDate.now(); //2

           //localized date loop
           for (Locale locale : locales){
               System.out.println("Locale: " + locale + ", date: " + localizeDate(now, locale)); //3
           } //4

           BigDecimal money = BigDecimal.valueOf(1_484.2428127233); //5

           //localized currency loop
           for (Locale locale : locales){
               System.out.println("Locale: " + locale + ", money: " + localizeCurrency(money, locale)); //6
           } //7
       }

       private static String localizeDate(LocalDate date, Locale locale){ //7
           DateTimeFormatter formatter = DateTimeFormatter //8
                   .ofLocalizedDate(FormatStyle.LONG) //9
                   .withLocale(locale); //10

           return formatter.format(date); //11
       }

       private static String localizeCurrency(BigDecimal money, Locale locale){ //12
           return NumberFormat //13
                   .getCurrencyInstance(locale) //14
                   .format(money); //15
       }

    }

We have learned how to localize dates and currency in this tutorial.

Please keep in mind that we have only formatted the representation of the monetary value, and we did not convert the monetary value by exchange rates at all. The number 100 can be represented as $100 USD or 100 YEN, but that does not mean $100 is equal to 100.

The full project code can be found here https://github.com/dmitrilc/DaniwebLocaleCurrency/tree/master

Although not included in the headlines, the release of JDK 17 also added 3 sets of new methods to the class java.lang.Process:

1. inputReader() to read from stdout.
2. inputWriter() to write to stdin.
3. errorReader() to read from stderr.

In this tutorial, we are going to learn how to use Process.inputReader() to read stdout from external processes.

At the end of this tutorial, you would have learned:

1. How to read stdout from an external process.
2. What command injection is.

1. Basic Java.
2. Java IO/NIO.

1. A Java IDE with at least JDK 17 support.

To follow along with this tutorial, perform the steps below:

1. Create a new Java project.

2. Create a package com.example.

3. Create a Java class called Entry.java. This is where our main() method lives.

4. Create a static reference to the current Runtime object like below.

    private static final Runtime runtime = Runtime.getRuntime();

If the security policy allows it, it is possible to execute a script that is not part of the current Java runtime environment.

Executing scripts written in other programming languages or system shells can also be used for illegitimate purposes, such as in a code injection/shell injection attack. After an external script is run, it can potentially evade your Java applications permissions. If you are running a service that is executing arbitrary code from end users(e.g Slack/Discord bots that execute code), then you need to make sure that proper safeguards are in place.

Without further ado, let us create some code that can both create and execute an external python script.

Inside the Entry class, we will create two new methods, createPyScript() and execPyScript(). Copy and paste the code below:

    private static Path createPyScript(Path path, String content){ //1
       //Creates the script if does not exists, else do nothing.
       try {
           Files.writeString(path, content, StandardOpenOption.CREATE); //2
       } catch (IOException e) {
           e.printStackTrace();
       }

       return path; //3
    }

    private static void execPyScript(Path script){ //4
       try {
           Process process = runtime.exec("python " + script); //5

           try (BufferedReader reader = process.inputReader()){ //6
               reader.lines() //7
                       .forEach(System.out::println); //8
           }

       } catch (IOException e) {
           e.printStackTrace();
       }
    }

The first method,createPyScript(), creates the actual script file in the file system. We only need to pass to it the content of the script file and the Path object representing the file location and name. To keep our example simple and not having to perform existence checks/removal, the StandardOpenOption.CREATE enum passed to the method makes sure that a new file is created only if it does not exist (but the file is still subject to the default writing behavior of Files.writeString()).

The second method, execPyScript(), receives the Path object representing the file location, and then executes that script:

1. There are two ways to execute shell commands from Java, using a ProcessBuilder or a Runtime object. Line 5 uses the application Runtime object, whose exec() method executes the system command calling the python executable.
2. Line 5 also gives us a reference to the Process object. Runtime.exec() spawns a new subprocess, which we can control via this Process object.
3. On line 6, we declared a BufferedReader object in a try-with-resources block to retrieve sdout from the Python script.
4. On lines 7 and 8, we retrieved a Stream<String> of all the lines printed to process stdout and printed them out in our IDE.

In main(), call the code like below:

    String pyContent = """
               for i in range(1, 6):
                   print(f'Found secret {i}')
               """; //15
    Path path = Path.of(".", "test.py"); //16

    Path script = createPyScript(path, pyContent); //17
    execPyScript(script); //18

On line 15, we create the script file content using the convenient new multiline String syntax. Python code is obviously white-space aware, so it is important to understand how to use the multiline syntax correctly in this case.

The Python code is just a very simple for loop that uses the f-string Literal String Interpolation (PEP 498) syntax to print some text 5 times.

Line 17 is where we call the method to create the script. Line 18 is where we call the method to execute the python script created on line 17.

The code prints:

    Found secret 1
    Found secret 2
    Found secret 3
    Found secret 4
    Found secret 5

Using a very similar approach, it is also possible to read stdout from system commands. Command injections are even easier (for attackers) to perform compared to the previous approach as this does even require write permissions(to create our own script).

Inside the Entry class, create an execSysCommands() method that can execute any number of shell commands.

    private static void execSysCommands(String... commands){ //9
       try {
           for (String command : commands){ //10
               Process process = runtime.exec(command); //11

               try (BufferedReader reader = process.inputReader()){ //12
                   reader.lines() //13
                           .forEach(System.out::println); //14
               }

           }
       } catch (IOException e) {
           e.printStackTrace();
       }
    }

In this scenario, we can pass the command directly to runtime.exec() without having to call an executable such as python.

Python is not pre-installed on Windows like most Linux distributions, so attackers are unlikely to call it if they found out that your server is Windows. Instead, they are going to use some commands that came pre-installed in Windows systems.

In main(), create some commands and call the execSysCommands() method like below:

    String ipconfig = "ipconfig /all";
    String systeminfo = "systeminfo";
    execSysCommands(ipconfig, systeminfo);

And with just two commands, the attacker was able to retrieve some of your networking information.

    package com.example;

    import java.io.BufferedReader;
    import java.io.IOException;
    import java.nio.file.Files;
    import java.nio.file.Path;
    import java.nio.file.StandardOpenOption;

    public class Entry {

       private static final Runtime runtime = Runtime.getRuntime();

       public static void main(String[] args) {
           String pyContent = """
                       for i in range(1, 6):
                           print(f'Found secret {i}')
                       """; //15
           Path path = Path.of(".", "test.py"); //16

           Path script = createPyScript(path, pyContent); //17
           execPyScript(script); //18

           String ipconfig = "ipconfig /all";
           String systeminfo = "systeminfo";
           execSysCommands(ipconfig, systeminfo);
       }

       private static Path createPyScript(Path path, String content){ //1
           //Creates the script if does not exists, else do nothing.
           try {
               Files.writeString(path, content, StandardOpenOption.CREATE); //2
           } catch (IOException e) {
               e.printStackTrace();
           }

           return path; //3
       }

       private static void execPyScript(Path script){ //4
           try {
               Process process = runtime.exec("python " + script); //5

               try (BufferedReader reader = process.inputReader()){ //6
                   reader.lines() //7
                           .forEach(System.out::println); //8
               }

           } catch (IOException e) {
               e.printStackTrace();
           }
       }

       private static void execSysCommands(String... commands){ //9
           try {
               for (String command : commands){ //10
                   Process process = runtime.exec(command); //11

                   try (BufferedReader reader = process.inputReader()){ //12
                       reader.lines() //13
                               .forEach(System.out::println); //14
                   }

               }
           } catch (IOException e) {
               e.printStackTrace();
           }
       }

    }

We have learned how to read stdout from an external process using the brand new inputReader() methods in JDK 17. If your app allows remote code execution(like a cloud IDE), then it is important to look into ways to secure your environment properly.

The full project code can be found here https://github.com/dmitrilc/DaniWebProcessStdout