Mill Basic Building Blocks

July 15, 2024

Lets explore the Mill building blocks. We start with a hello world:

import mill._
import scalalib._

def buildGreetings = T{ // T stands for Target ;)
  val greeting = "Hello Mill!"
  val outFile = T.dest / "greeting.txt" // Note, we use T.dest as our output directory
  os.write(outFile, greeting)
  println(s"File is in $outFile")

Then we build it:

$ ./mill buildGreetings
[1/1] buildGreetings
File is in /home/roman/dev/private-dev/mill-demo/out/buildGreetings.dest/greeting.txt
$ cat /home/roman/dev/private-dev/mill-demo/out/buildGreetings.dest/greeting.txt
Hello Mill!

That works. Note that we used T.dest to give each target its own directory to write to disk without trampling over other targets. The location in the 'out' directory is always the task names with a .dest suffix.

Continue reading →

Whirlwind Tour of Mill Build

June 10, 2024

Lets start a whirlwind tour. Last time we stopped at a basic Java app. Yes, Mill does of course support building Scala projects as well, but Mill works well for other builds as well.

class HelloWorld{
    public static void main(String[] args){
        System.out.println("I'm built with Mill")
Continue reading →

Intro to Mill Build: Pleasant Complex Builds

May 22, 2024

I’ve experienced a few build tools over time: Apache Ant, Apache Maven, Gradle, SBT, MSBuild, make and probably some more I’ve forgotten about. Recently I’ve experimented with the Mill build tool and it is one of the best ones I’ve worked so far.

TLDR: In the Java eco system, I recommend to use Apache Maven when your app/library fits with its defaults. If Maven starts to be painful, consider Mill build and this blog series is for you ;).

Continue reading →

JQuery: Always use dataType for $.ajax

February 4, 2024

I recently investigated a XSS vulnerability reported via Bugcrowd. I could reproduce the issue, I just didn’t understand it. The vulnerability looked like this:

  1. Attacker uploads a JavaScript file onto Confluence as attachment

  2. Manipulate a Confluence macro via REST API to have invalid parameters.

  3. Now, when the macro is edited/used, the code in the uploaded JavaScript is executed.

  4. The code snipped looked something like this:

// AJS is the Atlassian JavaScript library entry point. AJS.$ refers to the included JQuery library
    url: 'url-manipulated-by-attacker-to-downloads-the-attachment-file',
    type: 'GET',
    success: function (response) {
        // some basic processing
Continue reading →

One Billion Row Challenge: Learned So Far

January 12, 2024

Last Update 2024-02-04, see below

I participate in the One Billion Row Challenge by Gunnar Morling: Parse one billion rows of CSV, in plain Java, and be fast at it. It is a friendly completion and learning experience.

I had three goals:

Run Duke
Figure 1. Run Duke, Run!
Continue reading →