What is GWT-RPC ?

Google Web Tool-kit (GWT) provides couple of different ways to communicate with the server using HTTP. GWT-RPC is a framework to make a transparent server-side call where GWT takes care of all other low level details , like , object serialization etc.
When your application running in the browser , it needs to interact with the server using a Remote Procedure Call (RPC).GWT provides an RPC mechanism based on Java Servlets to provide access to server side. GWT uses deferred binding to serialize objects across the network. You can read more on GWT-RPC from here.

The application : User Creation Application

The funny thing is , My application creates User alone. Yes , it doesn’t do anything else other than creating user and storing them to the database. But , the important thing is , it uses GWT-RPC and gives enough scope of learning to build an application using GWT-RPC or GWT. My create user screen look like ,

Create User Screen

Setup details :

• Launch your favorite Java IDE. I have used eclipse which can be downloaded from here. If you are not so comfortable with eclipse , you can learn it from here.
• Configure the GWT plug-in for eclipse. Learn how , here.
• Download the project from here and extract into a folder of your choice.
• Download the MySQL Connector/J and copy the jar to the /war/WEB-INF/lib directory.
• Import the extracted project to your eclipse.

Once the project is imported to eclipse , the project structure should be like following :

Project Directory Structure

Now we are all set to go. GWT-RPC uses servlets to communicate with the server-side. GWT provides a servlet called , RemoteServiceServlet. This is a base servlet class for your RPC service implementations. It helps you to automatically deserializes incoming requests from the client and serializes outgoing responses for client/server RPCs.

You should do the following to set your GWT-RPC interface ,

• Create a service interface – Create an interface for your service that extends RemoteService and lists all RPC methods.
• Create a service implementation – Create a class to implement the server-side logic. The class should extends RemoteServiceServlet and implements the interface you created in the above step.
• Create an asynchronous interface to your service to be called from the client-side code.

Create a service interface :
Our Create User program requires at least two service methods . One is to check if the user is already exist in the database and other one is to Save the User into the databse.

import com.etechguide.project.gwtrpcdb.client.exception.UserException;
import com.google.gwt.user.client.rpc.RemoteService;
import com.google.gwt.user.client.rpc.RemoteServiceRelativePath;

/**
 * The client side stub for the RPC service.
 */
@RemoteServiceRelativePath("user")
public interface UserService extends RemoteService {
	 String createUser(User user) throws UserException;
	 boolean checkUserExist(String userName) throws UserException;

}

I have defined both the methods in my service interface. The service interface is annotated with the annotation , @RemoteServiceRelativePath(”user”). This annotation associates a RemoteService with the relative path(/user). we will use this relative path(/user) in the web.xml file while defining the servlet.

Create a service implementation :
This class should extends RemoteServiceServlet and implements the UserService interface . As this implementation class extends RemoteServiceServlet , it is a servlet class by itself.

/**
 * The server side implementation of the RPC service.
 */
@SuppressWarnings("serial")
public class UserServiceImpl extends RemoteServiceServlet implements
		UserService {

	UserDao userDao = new UserDao();
	@Override
	public String createUser(User user) throws UserException {
		String retVal = "true";
		if (!Validator.isValidName(user.getUserName())) {
			throw new UserException(
					"User name must be at least 5 characters long");
		}
		try {
			userDao.createUser(user);
		} catch (ClassNotFoundException e) {
			retVal = "false";
			throw new UserException(e.getLocalizedMessage());
		} catch (SQLException e) {
			retVal = "false";
			throw new UserException(e.getLocalizedMessage());
		}

		return retVal;
	}

	@Override
	public boolean checkUserExist(String userName) throws UserException {
		return userDao.checkUserExist(userName);
	}
}

The implementation class , UserServiceImpl uses the Data Access Object (DAO) to call the data base related methods. The DAO (UserDao.java) would look like ,

public class UserDao {

	Connection connection = null;
	Statement stmt = null;

	public void createUser(User user) throws ClassNotFoundException,
                     SQLException{
		String query = null;
		StringBuilder queryBuilder = null;
		queryBuilder = new StringBuilder();
		queryBuilder.append("INSERT INTO user(userName,password,");
		queryBuilder.append("emailId,address)");
		queryBuilder.append(" VALUES( ");
		queryBuilder.append("'"+user.getUserName()+"'");
		queryBuilder.append(",");
		queryBuilder.append("'"+user.getPassword()+"'");
		queryBuilder.append(",");
		queryBuilder.append("'"+user.getEmailId()+"'");
		queryBuilder.append(",");
		queryBuilder.append("'"+user.getAddress()+"'");
		queryBuilder.append(" )");

		query = queryBuilder.toString();
		System.out.println("query from createUser = " + query);
		System.out.println("user to be created ... " + user.toString());
		connection = DbConnection.createConnection();
		stmt = connection.createStatement();
		stmt.executeUpdate(query);
		DbConnection.closeConnection(connection, stmt);
	}

	public boolean checkUserExist(String userName) throws UserException {
		boolean isExist = false;
		String query = null;
		StringBuilder queryBuilder = null;
		ResultSet rs = null;
	    int rowCount = -1;
		queryBuilder = new StringBuilder();
		queryBuilder.append("SELECT count(*) FROM user WHERE userName= '");
		queryBuilder.append(userName);
		queryBuilder.append("'");
		query = queryBuilder.toString();
		System.out.println("query from checkUserExist = " + query);
		try {
			connection = DbConnection.createConnection();
			stmt = connection.createStatement();
			rs = stmt.executeQuery(query);
			rs.next();
			rowCount = rs.getInt(1);
			if(rowCount > 0){
				isExist = true;
			}
		} catch (ClassNotFoundException e) {
			throw new UserException(e.getLocalizedMessage());
		} catch (SQLException e) {
			throw new UserException(e.getLocalizedMessage());
		}finally{
			try {
				DbConnection.closeConnection(connection, stmt,rs);
			} catch (SQLException e) {
				throw new UserException(e.getLocalizedMessage());
			}
		}
		return isExist;
	}

}

So , as of now the story is , you have User Service and the Implementation of that. The Implementation is nothing but a servlet. We call all the database related methods from the implementation class. As it is a servlet and we are building a web application , we must declare this servlet in the web.xml file which is the main deployment descriptor file for any web application. The web.xml file is like ,

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app
    PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
    "http://java.sun.com/dtd/web-app_2_3.dtd">

<web-app>

  <!-- Servlets -->
  <servlet>
    <servlet-name>userServlet</servlet-name>
    <servlet-class>
    	com.etechguide.project.gwtrpcdb.server.UserServiceImpl
    </servlet-class>
  </servlet>

  <servlet-mapping>
    <servlet-name>userServlet</servlet-name>
    <url-pattern>/gwtrpcdb/user</url-pattern>
  </servlet-mapping>

  <!-- Default page to serve -->
  <welcome-file-list>
    <welcome-file>GwtRpcDB.html</welcome-file>
  </welcome-file-list>

</web-app>

Look at the url-pattern , it’s the MODULE_NAME/user which we have already specified with RemoteServiceRelativePath in the User Service. Now it is the time to write the asynchronous interface so that the client can use the services created by us.

Create an asynchronous interface :

import com.google.gwt.user.client.rpc.AsyncCallback;

public interface UserServiceAsync {
	void createUser(User user, AsyncCallback<String> callback)
			throws IllegalArgumentException;

	void checkUserExist(String userName, AsyncCallback<Boolean> callback);
}

You should follow certain rules while creating the asynchronous interface.

• The interface name should be the actual service name suffix with the word ‘Async’
• The interface should have the similar methods that the actual service has with some exceptions.
  1. The method should not have any return type other than void.
  2. The methods should have an extra parameter at the end( AsyncCallback<String> callback). Here the <String> is the return type of the method in the actual service(User Service).
• The methods in the async interface are allowed to throw Run-time Exceptions only.

Lets call out services from a client side code. Have a look at the following code.

/**
   * Create a remote service proxy to talk to the server-side User service.
   */
	private final UserServiceAsync userService = GWT
			.create(UserService.class);

userService.createUser(user,
						new AsyncCallback<String>() {
							@Override
							public void onFailure(Throwable caught) {
								// Show the RPC error message to the user
								Window.alert(caught.getLocalizedMessage());

							}
							@Override
							public void onSuccess(String result) {

								if(result.equals("true")){
									Window.alert("User Created Successfully");
								}else{
									Window.alert("User Creation failed");
								}
								clearAll();

							}

						});

nameField.addBlurHandler(new BlurHandler() {
			@Override
			public void onBlur(BlurEvent event) {
				final String userName = nameField.getText();
				if(userName != null
                               && userName.length() >0){
					userService.checkUserExist(userName,
                                                new AsyncCallback<Boolean>() {
						@Override
						public void onFailure(Throwable caught) {
							Window.alert(caught.getLocalizedMessage());

						}
						@Override
						public void onSuccess(Boolean result) {
							if(result.booleanValue()){
								errorLabel.setText("");
								errorLabel.setText(userName+" taken");
								errorLabel.setStyleName("errorLabel");
							}else{
								errorLabel.setText("");
								errorLabel.setText(userName+" available");
								errorLabel.setStyleName("successLabel");
							}
						}
					});
				}
			}
		});

First we create a remote service proxy to talk to the server side user service. Once the proxy is created we give a call to the service methods. We create an anonymous callback class instance and pass to the service methods. AsyncCallback interface has two methods , onSuccess() and inFailure(). Once a request is success and completed , the onSuccess() method gets called. If there is a failure , onFailure() method gets called. One thing to note here , onSuccess() method’s parameter’s type should be same of the service’s called method’s parameter type.

Thats all !! Download the project and start exploring more. Please feel free to write comments if you like it or would like to see any improvement on this post.

Label myLabel = new Label();
myLabel.setText("This is my label");
myLabel.setHtml("This<br>is<br>my<br>label"); // compilation error

To achieve this , you can create your own customized label which extends com.google.gwt.user.client.ui.Widget. Have a look at the following code.

import com.google.gwt.user.client.DOM;
import com.google.gwt.user.client.ui.Widget;

public class HTMLLabel extends Widget {

	public HTMLLabel(){
		this(null);
	}

	public HTMLLabel(String text)
	{
		setElement(DOM.createLabel());
		if(text != null)
			DOM.setInnerText(getElement(), text);
	}

	public String getText()
	{
		return DOM.getInnerText(getElement());
	}

	public void setHTML(String html){
		DOM.setInnerHTML(getElement(), html);
	}

	public String getHTML(){
		return DOM.getInnerHTML(getElement());
	}
}

We have created a class (HtmlLabel) extending the Widget class provided by GWT. At the line 12 ,we created a label by using the DOM class inside the parametrized constructor . Now we should expose a method so that consumer of this class can set a HTML to the created Label element. At the line 22 , we exposed a method where we set the inner HTML of the created label element.

A consumer of the HTMLLabel can create the HTML label in the following way,

HTMLLabel htmlLabel = new HTMLLabel();
htmlLabel.setHTML("This<br>is<br>my<br>label");

The output is a HTML label. As we have extended the Widget class , you can easily associate any event handlers to the HTML label that supported with normal GWT label. You can also create a SPAN element in GWT by following the above methodology of extending Widget class. I will discuss the SPAN element creation in my future post.

In my one of the post I have discussed on setter injection using Spring 2.5(old method). Going through that post will help you to find the difference between these two dependency injection approach. Lets get started.

What is Dependency Injection ? The answer is , It is a Design Pattern. Inversion of control or dependency injection pattern used to resolve component dependencies by injecting an instantiated component to satisfy dependency as opposed to explicitly requesting a component. So components will not be explicitly requested but components are provided as needed with the help of an Inversion of controller containers. Please read the post to know more on it.

Spring has a concept of instantiated component , i.e , bean. Previously , we used to configure bean in the Application Context xml file but with Spring 3.0 , we will be configuring bean and injecting services(dependencies) from our java classes. Lets do it with an example use case.

Have a look at the following class relations

Class Relation

Use Case : OpsClient is a normal Java Class which is registered with two services , i.e , Calculator Service and Print Service. Calculator Service is an interface to different calculation services available , like , addition , multiplication etc. Print Service is another interface to different printing services available , like , printing to a file or printing to console etc. The OpsClient makes use of these different services to perform different calculation and print them on different printing interfaces.

Approach with Spring 3.0 :

CalculatorService and PrintService are two interfaces. AddCalculatorServiceImpl , MultiplyCalculatorServiceImpl are the implementation of CalculatorService interface and ConsolePrintServiceImpl , FilePrintServiceImpl are the implementation of the PrintService interface. Hence , these implementation classes are the beans in Spring. Lets define them one by one.

Listing 1 : CalculatorService.java Interface

package com.company.spring.basic.service;

public interface CalculatorService {

	public long calculate(long x,long y);
	public String getOperationName();

}

Listing 2 : PrintService.java Interface

package com.company.spring.basic.service;

public interface PrintService {

	public void print(String result);
}

Lets define all the implementation (beans) of the services

Listing 3 : AddCalculatorServiceImpl.java

package com.company.spring.basic.service.impl;

import javax.inject.Named;

import com.company.spring.basic.service.CalculatorService;
@Named("AddCalcService")
public class AddCalculatorServiceImpl implements CalculatorService {

	@Override
	public long calculate(long x, long y) {
		return x+y;
	}

	@Override
	public String getOperationName() {
		return " plus ";
	}
}

Listing 4 : MultiplyCalculatorServiceImpl.java

package com.company.spring.basic.service.impl;

import javax.inject.Named;

import com.company.spring.basic.service.CalculatorService;
@Named("MultiplyCalcService")
public class MultiplyCalculatorServiceImpl implements CalculatorService {

	@Override
	public long calculate(long x, long y) {

		return x*y;
	}

	@Override
	public String getOperationName() {

		return " multiplies ";
	}
}

Listing 5 : ConsolePrintServiceImpl.java

package com.company.spring.basic.service.impl;

import javax.inject.Named;

import com.company.spring.basic.service.PrintService;
@Named("ConsolePrintService")
public class ConsolePrintServiceImpl implements PrintService {

	@Override
	public void print(String result) {
		System.out.println(result);

	}
}

Listing 6 : ConsolePrintServiceImpl.java

package com.company.spring.basic.service.impl;

import javax.inject.Named;

import com.company.spring.basic.service.PrintService;

@Named("FilePrintService")
public class FilePrintServiceImpl implements PrintService{

	@Override
	public void print(String result) {
          // Code to write to a file
	}
}

Listing 3 – Listing 6 shows the normal but special implementation of the interfaces. They are special , because they are to support the Spring Framework’s Bean concept. To do that , each of this implementation is annotated with @Named(”SomeName”) annotation. In Spring 3.x you can use JSR 330’s @Named annotation in place of stereotype annotations and they will be automatically detected during component-scanning.
The value of the @Named property will be used as the Bean Name. At this time Spring defaults for bean
scope will be applied when using @Named.

This annotation will be available if if the JSR330 jar is present on the classpath. This jar is not part of the Spring 3.0 download. It is available under SpringSource Enterprise Bundle Repository. This annotation will be available under the com.springsource.javax.inject-1.0.0.jar. You can find the other jars here.

The next task is to build the Application context. Wait , we are not going to build any xml file here. It is going to be a simple Java class annotated with some useful annotations. Have a look at the following code.

Listing 7 : ApplicationConfig.java

package com.company.spring.basic;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import com.company.spring.basic.client.OpsClient;
import com.company.spring.basic.service.CalculatorService;
import com.company.spring.basic.service.PrintService;
import com.company.spring.basic.service.impl.AddCalculatorServiceImpl;
import com.company.spring.basic.service.impl.ConsolePrintServiceImpl;
import com.company.spring.basic.service.impl.FilePrintServiceImpl;
import com.company.spring.basic.service.impl.MultiplyCalculatorServiceImpl;

@Configuration
public class ApplicationConfig {
	@Bean
	public PrintService screnPrint(){
		return new ConsolePrintServiceImpl();
	}
	@Bean
	public PrintService filePrint(){
		return new FilePrintServiceImpl();
	}
	@Bean
	public CalculatorService add(){
		return new AddCalculatorServiceImpl();
	}
	@Bean
	public CalculatorService Multiply(){
		return new MultiplyCalculatorServiceImpl();
	}
	@Bean
	public OpsClient result(){
		return new OpsClient();
	}
}

The class is annotated with @Configuration annotation. Annotating a class with the @Configuration indicates that the class can be used by the Spring IoC container as a source of bean definitions. These classes(@ Configuration annotated) consist principally of @Bean-annotated methods that define instantiation,configuration, and initialization logic for objects to be managed by the Spring IoC container.

To declare the beans , we have created methods and annotated with the @Bean annotation. The @Bean annotation plays the same role as the element.When @Configuration classes are provided as input, the @Configuration class itself is registered as a bean definition, and all declared @Bean methods within the class are also registered as bean definitions.

So we have five beans declared all together. The last bean declared is the OpsClient bean which has two references , i.e , CalculatorService and PrintService(Please refer to the Class Relations diagram above). We will achieve this reference injection with the help of a very special annotation @Inject. Have a look.

Listing 8 : OpsClient.java

package com.company.spring.basic.client;

import javax.inject.Inject;
import javax.inject.Named;
import com.company.spring.basic.service.CalculatorService;
import com.company.spring.basic.service.PrintService;

public class OpsClient {

	@Inject
	@Named("FilePrintService")
	private PrintService printService;

	@Inject
	@Named("MultiplyCalcService")
	private CalculatorService calculatorService;

	public void execute(long op1,long op2)  {
		printService.print("The result of " + op1 +
				calculatorService.getOperationName() + op2 + " is "
	   			+ calculatorService.calculate(op1, op2) + "!");

	}
}

printService and the calculatorCulatorService are the references to the different service implementations which can be injected using the @Inject annotation and @Named annotations. Here @Named annotation work as a mapping of service implementations. The name supplied as a parameter to the @Named annotation should be matched with one of the service implementation annotated with the same @Named annotation.

Like @Named , @Inject annotation can be found under the same package javax.inject.Inject. In the above class we are injecting the multiplication calculator service and the file print service using the annotations. Now the only thing pending is to instantiate the Application Context and call the client. It is explained below ,

Listing 9 : OperationTest.java

public class OperationTest {
	public static void main(String[] args) {
		ApplicationContext ctx = new AnnotationConfigApplicationContext(
				com.company.spring.basic.ApplicationConfig.class);
		OpsClient opsBean = ctx.getBean(OpsClient.class);
		opsBean.execute(2, 3);
	}
}

Once you run the above method , multiplication of the value 2 and 3 will be written in a file.

You would need to add the following jar files to the class-path ,
- cglib-nodep-2.1_3.jar
- classworlds-1.1-alpha-2.jar
- com.springsource.javax.inject-1.0.0.jar
- com.springsource.javax.inject-sources-1.0.0.jar
- jcl-over-slf4j-1.5.10.jar
- log4j-1.2.15.jar
- slf4j-api-1.5.10.jar
- slf4j-log4j12-1.5.10.jar
- spring-aop-3.0.0.RELEASE.jar
- spring-asm-3.0.0.RELEASE.jar
- spring-beans-3.0.0.RELEASE.jar
- spring-context-3.0.0.RELEASE.jar
- spring-core-3.0.0.RELEASE.jar
- spring-expression-3.0.0.RELEASE.jar
- spring-jdbc-3.0.0.RELEASE.jar
- spring-tx-3.0.0.RELEASE.jar

Most of the above jars can be downloaded as part of Spring 3.x download. Other jars can be found here.

A Path Traversal attack targets the files and directories which are saved outside the root folder. An attacker aims for a files path stored in the web server. An attacker use the combination of dot-dot-slash(../) to browse to arbitrary directories and files. The dot-dot-slash sequence helps an attacker to move up in any directory location. The attacker not only can access any arbitrary files/directories from your web server , it is possible to upload some malicious files to some location in your web server , if the proper care is not taken.

The attack can be made in several different ways. An attacker might not use the dot-dot-slash patter directly in the url , rather can use the Encoding and double encoding value of dot(.) and slash(/).
..%2f represents ../
..%255c represents ..\
%2e%2e\ represents ..\ and so on.
Hence an attacker can use the following type of urls to play with your web server files and directories,
http://web_site.com/toGetFiles?file=../../../../dir/file
http://web_site.com/toGetFiles?file=…%255cdir/file
depending on your operating systems.

How to protect the web application from this attack ?

Anything from an web application can be accessed using a request to the application. Hence we need a strict sanity check for all the possible dot-dot-slash patterns on each request coming to the web application.
The check should be performed well before a request reaches in a state to have response for it. It means , a web application pre-filter should be written to achieve this.

You need to do modification in the web.xml of your web application. Add the following tag in your web application :

Listing 1 : Add filter tag to web.xml file

<filter>
    <filter-name>PTA</filter-name>
        <display-name>PTA</display-name>
        <description>This is a Pre-filter for PTA Prevention</description>
    <filter-class>com.etechGuide.fw.filter.PathTraversalFilter</filter-class>
</filter>
<filter-mapping>
         <filter-name> PTA</filter-name>
         <url-pattern>/*</url-pattern>
</filter-mapping>

As we are looking for filtering all the request and we would like to pass all the request through the filter. Hence we will be writing a Request Wrapper to code our filter logic. Look at the following filter definition.

Listing 2 : The PathTraversalFilter code

public class PathTraversalFilter implements Filter {
	private FilterConfig filterConfig;
	public void init(FilterConfig filterConfig)
                              throws ServletException {
		this.filterConfig = filterConfig;
	}

	public void destroy() {
		this.filterConfig = null;
	}

	public void doFilter(ServletRequest request,
                 ServletResponse response,FilterChain chain)
                           throws IOException, ServletException {

		chain.doFilter(new RequestWrapper((HttpServletRequest) request),
				response);

	}
}

At the line number 16 we wrap the request to filter out all the malicious attacks for Path Traversals. have a look at the RequestWrapper.java file where the actual filtering bypass takes place.

Listing 3 : The RequestWrapper code

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

public final class RequestWrapper extends HttpServletRequestWrapper {

	public RequestWrapper(HttpServletRequest servletRequest) {
		super(servletRequest);
	}

	public String[] getParameterValues(String parameter) {

	  String[] values = super.getParameterValues(parameter);
	  if (values==null)  {
                  return null;
          }
	  int count = values.length;
	  String[] encodedValues = new String[count];
	  for (int i = 0; i < count; i++) {
                 encodedValues[i] = cleanPTA(values[i]);
	   }
	  return encodedValues;
	}

	public String getParameter(String parameter) {
		  String value = super.getParameter(parameter);
		  if (value == null) {
		         return null;
                  }
		  return cleanPTA(value);
	}

	public String getHeader(String name) {
	    String value = super.getHeader(name);
	    if (value == null)
	        return null;
	    return cleanPTA(value);

	}

	private String cleanPTA(String value) {
		// Bypassing all possible dot-dot-slash
                value = value.replaceAll("%2e", "");
		value = value.replaceAll("%2f", "");
		value = value.replaceAll("%5c", "");
		value = value.replaceAll("%25u002e", "");
		value = value.replaceAll("%25u002f", "");
		value = value.replaceAll("%25u005c", "");
		value = value.replaceAll("%c0", "");
		value = value.replaceAll("%ae", "");
		value = value.replaceAll("%af", "");
		value = value.replaceAll("%c1", "");
		value = value.replaceAll("%9c", "");
		value = value.replaceAll("%e0", "");
		value = value.replaceAll("%80", "");
		value = value.replaceAll("%f0", "");
		value = value.replaceAll("%81", "");
		value = value.replaceAll("%f8", "");
		value = value.replaceAll("%fc", "");
		value = value.replaceAll("%25uff3C", "");
		value = value.replaceAll("%25u002E", "");
		value = value.replaceAll("%5C", "");
		value = value.replaceAll("%2F", "");
		value = value.replaceAll("%25uff0E", "");
		value = value.replaceAll("%25uff0F", "");
		value = value.replaceAll("%25ufe68", "");
		value = value.replaceAll("%00", "");
		value = value.replaceAll("%2A", "");
		value = value.replaceAll("%25", "");
		value = value.replaceAll("\\|", ""); 

                /* File.separator is different from one OS to another.
                    Hence the additional check is done below
                */
		String sFileName = value
				.substring(value.lastIndexOf(File.separator) + 1);

		if (sFileName.indexOf("..") >= 0) {
			sFileName = value.substring(value.lastIndexOf("..") + 2);
		}
		if (sFileName.indexOf("\\") >= 0) {
			sFileName = value.substring(value.lastIndexOf("\\") + 1);
		} if (sFileName.indexOf("/") >= 0) {
			sFileName = value.substring(value.lastIndexOf("/") + 1);
		}
		return sFileName;
	}
}

cleanPTA(String value) method of above class does all the bypassing. This method is open for modification to the reader of this post. The logic can be changed as per the need but the basic by passing is all about what is done above.

Once a request reaches your web application , it has to go through the filter. The filter uses a wrapper on each request and filter out all the malicious attacks.

A temporary file is a normal file that is created to hold the data temporarily. Efficient memory management is one of the important aspect of any normal application. Creation of temporary files and effective use of them help an application to free the memory in need for other purpose.

A temporary file can be created depending on certain condition and can be closed and deleted depending on some condition. For an example, lets assume we can upload and install a plug-in(a file) on an application. This file can be uploaded as a temporary file in a system defined temporary directory and can be installed from there. On a successful installation completion the temp file can be deleted permanently from the temporary directory.

Lets have a look at the following example ,

Listing 1 : Creating the Temporary file

package com.etechGuide.java.features;

import java.io.File;
import java.io.IOException;

public class TempCreation {
	public static void main(String[] args) {
		try {
			File tempFile = File.createTempFile("mailTogoa", ".ddd");
			System.out.print("Created temporary file with name ");
			System.out.println(tempFile.getAbsolutePath());
			tempFile.deleteOnExit();
		} catch (IOException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		}
	}
}

The Line number 9 creates a temporary file. Java IO provides an API like ,
createTempFile(String prefix, String suffix) ;
-Creates an empty file in the default temporary-file directory, using the given prefix and suffix to generate its name.
In the above programming example , we have used the API to create a temporary file whose prefix is mailTogoa and suffix is .ddd. This file will be created under the system defined temporary directory.
Java IO provides another API to create a temporary file . With the help of this API , you can create a temporary file in user defined location. The method look like this ,
createTempFile(String prefix, String suffix, File directory)
-Creates a new empty file in the specified directory, using the given prefix and suffix strings to generate its name.
Both the above methods are public static method in the java.io.File class.

Line number 12 we call the deleteOnExit() method so that the temporary file can be deleted on JVM exit.

Last thing to be mentioned is , how to get the temporary file location pragmatically. Have a look at the following code list

Listing 2 : Detect the Temporary Directory

package com.etechGuide.java.features;

public class DetectTempDirectory {

	private static final String SYSTEM_PROPERTY_TEMP_FOLDER = "java.io.tmpdir";

	public static void main(String[] args) {
		String sTempFolder = System.getProperty(SYSTEM_PROPERTY_TEMP_FOLDER);
		System.out.println(sTempFolder);
	}
}

java.io.tmpdir property has the operating system specific temporary directory location. In the above example , we have read the property and printed on console.

Spring framework has a full-fledge support for the Database Access Objects(DAO). Spring’s support of DAO is not limited with the relational database like MySQL , Oracle , etc . It has support for Object Relational Databases like , HSQL , JDO etc. Whan I talk about suppot it means a lot of things.

Before going into the details , let us ask a question to ourselves .What is the real problem in coding a JDBC without a framework support ?

All of us , who are JDBC programmers know these clearly :

• DBC is redundant .
• Lots of Coding to be done .
• Lots of Coding to be repeated (Yes , even after following all the OO academic theories !!).
• Extra headache of Opening a connection and Closing a connection .
• Maintaining a Connection Pool .
• You find yourself doing the same things over and over again .
• Yes , you must have to propagate the exception and handle it .
• You have to handle transactions .
• You have to write statements .
• You have to execute the statements .
• You have to get the results after executing the statement and iterate through it.

Waoh !! So many things to take care. Isn’t it ? What do the framework like Spring do then ? How does it help ?
Here is the list of what it does (We will see the HOW shortly) :

• Define connection parameters .
• Open the connection .
• Specify the statement . – Work of an Application Developer.
  
• Prepare and execute the statement .
• Set up the loop to iterate through the results (if any) .
• Do the work for each iteration . - Work of an Application Developer.
• Process any exception .
• Handle transactions .
• Close the connection .

In the above list , Except specifying the statement and writing the business logic for each iteration , all other services are taken care by the SPRING Framework. Isn’t it cool ? You don’t have to worry about many things that would have taken most of your development time otherwise.

Know the Spring DAO Module :

Packages

The Spring Framework’s JDBC abstraction framework consists of four different packages, namely core, datasource, object, and support. Spring community documentation helps you with number of options for selecting an approach to form the basis for your JDBC database access.

• JdbcTemplate – this is the classic Spring JDBC approach and the most widely used. Works well in a JDK 1.4 and higher environment.
• NamedParameterJdbcTemplate – wraps a JdbcTemplate to provide more convenient usage with named parameters instead of the traditional JDBC “?” place holders. This provides better documentation and ease of use when you have multiple parameters for an SQL statement. Works with JDK 1.4 and up.

• SimpleJdbcTemplate – this class combines the most frequently used features of both JdbcTemplate and NamedParameterJdbcTemplate plus it adds additional convenience by taking advantage of some Java 5 features like varargs, autoboxing and generics to provide an easier to use API. Requires JDK 5 or higher.
• SimpleJdbcInsert and SimpleJdbcCall – designed to take advantage of database metadata to limit the amount of configuration needed. This will simplify the coding to a point where you only need to provide the name of the table or procedure and provide a Map of parameters matching the column names. Designed to work together with the SimpleJdbcTemplate. Requires JDK 5 or higher and a database that provides adequate metadata.
• RDBMS Objects including MappingSqlQuery, SqlUpdate and StoredProcedure – an approach where you create reusable and thread safe objects during initialization of your data access layer. This approach is modeled after JDO Query where you define your query string, declare parameters and compile the query. Once that is done any execute methods can be called multiple times with various parameter values passed in. Works with JDK 1.4 and higher.

Lets see one example to learn and understand Spring-jdbc configuration. We will use jdbcTemplate style of JDBC approach. Reader of this post is expected to try other approaches as well.

Setup Details

DataBase used : MySQL 5
IDE Used : Eclipse 3.3.1
Jar files needed : Please inclusde the followings jar into project classpath.

1. commons-dbcp.jar – For DataSource Support.
2. commons-pool.jar – For Connection Pool Support.
3. mysql-connector-java-5.1.5.jar – Java Connector for MYSQL.
4. ojdbc14.jar – Query Support
5. spring.jar – The core framework library

All the above jar files should be found under lib/ and dist/ directory of the Spring Distribution with Dependencies.

Lsts take an example of a table called User which is created under the data base called demo. The description of the demo.User table is as follows,

describe table

Let us create a domain class called User which is a POJO(Plain old java object) class having the properties and setter / getters for the properties. A User.java look like ,

Listing 1 : User.java

public class User {

          private Integer uid;
          private String userName;
          private String password;

          public User() {

          }
          public User(Integer uid, String userName, String password) {
                  this.uid = uid;
                  this.userName = userName;
                  this.password = password;
          }
          public Integer getUid() {
                  return uid;
          }
          public void setUid(Integer uid) {
              this.uid = uid;
          }
          public String getUserName() {
             return userName;
          }
          public void setUserName(String userName) {
            this.userName = userName;
          }
          public String getPassword() {
              return password;
          }
          public void setPassword(String password) {
                   this.password = password;
          }

         public String toString(){
              StringBuilder sb = new StringBuilder();
              sb.append("User ID :"+getUid()+"\n");
              sb.append("User Name :"+getUserName());
              return sb.toString();
         }

    }

As the design pattern teaches us, we should do all the programming to interfaces and not to implementation . let us create an interface called UserDAO which will declare all the methods to be implemented for a User database operation.

Listing 2 : UserDAO.java

public interface UserDAO {
    public boolean insertUser(User userRecord);
    public boolean updateUser(User userRecord);
    public boolean deleteUser(int uid);
    public User selectUser(int uid);
}

Before going to the implementation of UserDAO interface , we should know the following :
– Spring Framework will provide a mechanism to inject TransactionManager and DataSource instance to our implementation class.
– A Datasource can contain information like, driverClassName,url,username,password etc and all this information (parameters) will be injected by container to the implementation class.
We will achieve these by coding our ApplicationContext.xml . Here it is .

Listing 3 : ApplicationContext.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
      http://www.springframework.org/schema/beans/spring-beans-2.0.xsd">

    <bean id="dataSource"
         class="org.apache.commons.dbcp.BasicDataSource"
           destroy-method="close">
        <property name="driverClassName" value="com.mysql.jdbc.Driver"/>
        <property name="url" value="jdbc:mysql://localhost:3306/demo"/>
        <property name="username" value="root"/>
        <property name="password" value="abcdef"/>
        <property name="maxActive" value="10"></property>
        <property name="maxIdle" value="5"></property>
        <property name="minIdle" value="1"></property>
        <property name="poolPreparedStatements" value="true"></property>
        <property name="initialSize" value="1"></property>
    </bean>

    <bean id="transactionManager"
class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
 <property name="dataSource" ref="dataSource"></property>
    </bean>

    <bean id="userDao" class="user.DAO.Impl.UserDaoImpl">
   <property name="transactionManager"ref="transactionManager"></property>
    </bean>

</beans>

Look at the last bean , userDao. This bean instantiate UserDaoImpl which is an implementation os UserDAO interface. As per the setter injection logic , UserDaoImpl.java should have a setter method for the reference property transactionManager. Now , have a look at the transactionManager bean. This is a type of (say , instance of) class org.springframework.jdbc.datasource.DataSourceTransactionManager . This is a class provided by the Spring Framework to the application developer. This class has a public setDataSource(DataSource dataSource) method. Hence you have the scope to inject dataSource object as a refrence to the transactionManager bean.

The dataSource bean is of type org.apache.commons.dbcp.BasicDataSource which has setter for all the properties defined under the bean. Additionaly , the bean described theat close() method will be called as a destroy-method to close the connection.

The Sequence is like this ,
- Get a TransactionManager instance,
- Get a DataSource from TransactionManager.
- Form a jdbcTemplate from the Datasource instance.
- Specify the Query.

All the above steps are taken care in the UserDaoImpl.java class. Have a look.

Listing 4 : UserDaoImpl.java

import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Types;

import javax.sql.DataSource;

import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.jdbc.core.RowCallbackHandler;
import org.springframework.jdbc.datasource.DataSourceTransactionManager;

import user.DAO.UserDao;
import user.Domain.User;

public class UserDaoImpl implements UserDao {

    private JdbcTemplate jdbcTemplate;

    // Setter Injection happens here
    public void setTransactionManager(
            DataSourceTransactionManager transactionManager) {
        DataSource dataSource= transactionManager.getDataSource();
        jdbcTemplate = new JdbcTemplate(dataSource);
    }

    @Override
    public boolean deleteUser(int uid) {
        String sql = "delete from demo.user where UID=?";
        Object[] params = new Object[]{uid};
        int deleted = jdbcTemplate.update(sql,params);
        if(deleted > 0){
            return true;
        }else{
            return false;
        }
    }

    @Override
    public boolean insertUser(User userRecord) {

		String sql = "insert into demo.user(UID,USERNAME,PASSWORD)"
				+ " values(?,?,?)";
		Object[] params = new Object[] { userRecord.getUid(),
				userRecord.getUserName(), userRecord.getPassword() };
		int[] types = new int[] { Types.INTEGER, Types.VARCHAR,
                            Types.VARCHAR };
		int inserted = jdbcTemplate.update(sql, params, types);
		if (inserted > 0)
			return true;
		else
			return false;
    }

    @Override
    public User selectUser(int uid) {
        String sql = "select UID,USERNAME from demo.user where UID=?";
        Object[] params = new Object[]{uid};
        final User user = new User();

        jdbcTemplate.query(sql,params,new RowCallbackHandler(){

            @Override
            public void processRow(ResultSet rs) throws SQLException {
                user.setUid(new Integer(rs.getInt("UID")));
                user.setUserName(rs.getString("USERNAME"));
            }
        });
        return user;
    }

    @Override
    public boolean updateUser(User userRecord) {
        // You Implement
        return false;
    }

}

Inspect the public void setTransactionManager(DataSourceTransactionManager transactionManager) method . The Dependency Injection takes place here. TransactionManager instance will be injected by Spring IOC container using the setter injection methodology. Once the TransactionManager is populated , a datasource instance can be created as ,
DataSource dataSource= transactionManager.getDataSource();
and a jdbcTemplate can be created as,
jdbcTemplate = new JdbcTemplate(dataSource);

This jdbcTemplate should be used for all type of query execution. To understand different types of query execution , please refer to the Spring Source Doc on JDO (from section 11.2) after running the above program successfully.

These factors decides which component of the Spring can be used with the J2EE-based web application. If you are using Spring-MVC for your web application , Spring provides a front-controller in form of DispatcherServlet which does loading of of application context , instantiating your beans etc.

But , there might be a situation where Spring-MVC is not your need , rather you would like to take advantage of Spring-DAO module along with normal servlets and jsps. In this scenario , DispatchServlet(the front-controller) is not at all there in picture. But the challenge remain the same. Your application context must be loaded and all the beans should be instantiated.

This post talks on integrating the Spring framework with a J2EE-based web application which has normal servlets and jsps.

Two areas of your web application should be modified to integrate with Spring framework.

• web.xml file – Where you need to specify the path of the Spring’s application context file and register some listeners.
• Your servlet – where you need make changes to get the instance of your bean to call bean’s methods.

Lets assume , we have an application context which declares the beans for configuring and connecting to the Database. The application context file will look like this ,

Listing 1 : Application Context Xml – databaseAppConfig.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-2.0.xsd">

	<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource">
        <property name="driverClassName" value="com.mysql.jdbc.Driver"/>
        <property name="url" value="jdbc:mysql://localhost:3306/library"/>
        <property name="username" value="root"/>
        <property name="password" value="novell"/>
	</bean>
	<bean id="jdbcTemplate" class="org.springframework.jdbc.core.JdbcTemplate">
		<property name="dataSource" ref="dataSource"></property>
	</bean>
	<bean id="bookDao" class="com.etechguide.library.client.dao.BookDaoImpl">
		<property name="jdbcTemplate" ref="jdbcTemplate"></property>
	</bean>

</beans>

Next , add these tags to the top of web.xml

A context-param tag with the param-name contextConfigLocation and it’s value. contextConfigLocation is the location of Spring’s application context file. you can define multiple application context files and declare them in space separated manner.

<!-- context-param -->
<context-param>
   <param-name>contextConfigLocation</param-name>
   <param-value>/WEB-INF/databaseAppConfig.xml</param-value>
</context-param>

A listener which would load all these context files and pass it to Spring framework for instantiating the beans defined in the application conext xml file.

<!-- listener -->
  <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener
  </listener-class>
</listener>

Once you are done with this step , use your servlet to get the instance of the bean created for you. If you look closely to the databaseAppConfig.xml file in the Listing 1 , you have a bean named bookDao which is the bean for the class file , com.etechguide.library.client.dao.BookDaoImpl. Lets assume , BookDaoImpl implements the interface BookDao.java and has definition of the methods like getBookDetails(), updateBook() deleteBook() etc. Hence you have to get the instance of BookDaoImpl if you would like to call the methods.

Have look at the following code ,

public class BookDetailsSrvlet extends
      javax.servlet.http.HttpServlet implements
		javax.servlet.Servlet {

	private ServletConfig servletConfig = null;
	private ServletContext servletContext = null;
	private String state = null;
	private BookDao bookDao = null;

	protected ApplicationContext applicationContext;

	@Override
	public void init(ServletConfig config) throws ServletException {

		super.init(config);
		this.servletConfig = config;
		servletContext = this.servletConfig.getServletContext();
		if (applicationContext == null) {
			applicationContext = WebApplicationContextUtils
					.getWebApplicationContext(servletContext);
		}
		bookDao = (BookDao) applicationContext.getBean("bookDao");
	}
 .....
 .....
 // Other codes
 .....
 .....
}

The above code is from a servlet which makes use of the servletContext to get the ApplicationContext object and then called the getBean() method passing the bean name to get the instance of BookDaoImpl which is a type of BookDao interface.

Dependency can be injected using the setter method of a class. If a class is dependent on another class or primitive variables then the dependency should be declared as a state(variable) of the class and the class should have a setter method for it.

For an example , lets say Employee class is dependent on Address class , Employee class should have a state variable and a setter method , like ,

Listing 1 : Class with a setter method

private Address address;
public void setAddress(Address address) {
        this.address = address;
}

The Spring IOC container should inject the address dependency using the setter method of Address. Whole dependency Injection is push method where a dependency value will be pushed and a client class should not bother about pulling the dependency back from anywhere. Lets learn to set setter dependency injection with following example.

Lets assume , we have a class relation like the following ,

Listing 2 : Class Relations

Employee has an Address and a Project

Look at the above class relations. Employee has an Address and Employee has a Project. Employee is dependent on both Address and Project classes directly. Using Spring IOC controller we can inject the dependency values to Employee class . Lets do it.

Spring IOC container needs a bean to be defined for all kind of classes whose object should be created for your application. For the above application we need instance of an Address class , Project Class and at last Employee class to get the employee data. Hence we need three beans to be declared. Beans should be declared in the application context xml file. The

 <bean> 

tag should define a bean with it’s properties and tag should contain multiple beans in it.

Address class has three properties , i.e , street , city and pincode. Hence the bean for the Address class is defined as follows ,

Listing 3 : Address Bean

<bean id="addressBean"
class="com.company.spring.injection.setter.model.Address">
        <property name="street">
            <value>Bagmane Tech park</value>
        </property>
        <property name="city">
            <value>Bangalore</value>
        </property>
        <property name="pincode">
            <value>566093</value>
        </property>
</bean>

Intention is to instantiate the Address class and populate it’s properties with respective values. Similar way , a bean definition for Project class could be as,

Listing 4 : Project Bean

<bean id="projectBean"
class="com.company.spring.injection.setter.model.Project">
        <property name="projectName">
            <value>iManager</value>
        </property>
        <property name="department">
            <value>ISM</value>
        </property>
        <property name="teamMemberCount">
            <value>10</value>
        </property>
        <property name="deliveryDate">
            <ref bean="dateBean"/>
        </property>
</bean>

Point to notice is that the bean id is a logical name which can be any user friendly and non-objectionable name. Look at these bean definition closely. Each bean has property and each property is populated with some value. But thing is different for deliveryDate bean in projectBean. There is a

<ref>

tag instead of

<value>

. Because deliveryDate property is of type java.util.Date in Project class so we need a java.util.Date reference to set it’s value. So we need another bean for date.

Listing 5 : Date Bean

<bean id="dateBean"
class="java.util.Date"/>

Now , lets have a look at the bean for the Employee class.

Listing 6 : Employee Bean

<bean id="employeeBean"
class="com.company.spring.injection.setter.model.Employee">
        <property name="name" value="Tapas Adhikary"></property>
        <property name="empId" value="88699"></property>
        <property name="address" ref="addressBean"></property>
        <property name="project" ref="projectBean"></property>
</bean>

See the last two properties of the employeeBean bean. We have injected the addressBean and projectBean as a reference to the properties names address and project respectively. So your client code ( Where we have decided to create and instance of Employee and call it’s getter methods) should not worry about setting all this values. Employee’s dependencies will be pushed by the Spring IOC container.

The client code should be like this ,

Listing 7 : Setter Injection Java file

public class SetterInjection {
  public static void main(String[] args) {
    ApplicationContext context = new ClassPathXmlApplicationContext(
          "resources/applicationContext.xml");
    BeanFactory factory = (BeanFactory) context;
    Employee employee = (Employee) factory.getBean("employeeBean");
    Address address = employee.getAddress();
    Project project = employee.getProject();
    System.out.println(employee.getName());
    System.out.println(employee.getEmpId());
    System.out.println(address.getCity());
    System.out.println(address.getStreet());
    System.out.println(address.getPincode());
    System.out.println(project.getProjectName());
    System.out.println(project.getDepartment());
    System.out.println(project.getTeamMemberCount());
    System.out.println(project.getDeliveryDate().toString());
   }
}

Lets assume the application context file name is applicationContext.xml and it’s under a folder called resources. An ApplicationContext object should be formed with the help of the xml file. The context object is type of the Bean Factory which uses the Factory Design Pattern concept to create the object. Once you get the factory , you need to query the bean using the bean name , i.e , employeeBean. Thats it. Your Employee class is instantiated. Now you can get all the Employee properties including Address and Project properties injected using the xml file and the setter method of Address , Person and Employee.

The attached source code has the full version of the xml and all java source files. Download the code and import into your favorite IDE.

I would like to conclude this post with one rule. A property name of a bean in the xml file should be equal to the setter method name of the attribute of the class without the word set at the beginning . Say if the property name of a bean in the application context xml file is departmentName then the corresponding class should have a setter method called

 public void setDepartmentName(String departMent){
     // Set the value
   }

Note : ‘D’ is in capital in the setter method after the word ’set’.

Say a class FetchUserDataFromDB depends on a class called DataBaseAccess, so it is obvious that , one would try to make a coupling by creating an instance of DataBaseAccess class in FetchUserDataFromDB class and call it’s methods. Here , we introduce a tight coupling and a strong dependency.

Look at the following scenarios :

Scenario 1 : Tight Coupling

Tight Coupling

Step 1 : Get me a database connection object from the pool.
Step 2 : Take the database connection object conn.
Step 3 : Thanks you , get me the User’s data whose id is 007.
Step 4 : Here it is , His name is James Bond .
Step 5 : Enough , Don’t want the conn anymore. Close it.
Step 6 : Ok , closed and conn is taken back to pool.

Scenario 2 : Loose Coupling

Loose Coupling

Step 1 : Oh , you need a connection ? Injecting a connection conn from the Connection Pool.
Step 2 : Fine , you need the user’s Information whose id is 007 ? Injecting the information ; He is James Bond.
Step 3 : Look like you are not using the conn anymore. Injecting a service to close the connection and get the conn back to the pool.

Now the million dollar question is , which of these scenarios you would like to see in your code/project. Undoubtedly the scenario 2 where you do not have the burden of keeping a reference to the databaseaccess object and your client class is no more tightly coupled .
Scenario 2 is the depiction of the Dependency Injection. Where the container injects the dependencies to the client classes and takes care of a full life cycle.

There are several advantages of dependency injection.

• Your code is modular.
• Classes are not having any strong reference to another class.
• You are able to test your code independently.

The container which supports this dependency injection concept is called the IOC (Inversion of control) Container. Spring uses the concept of IOC and dependency injection to locate and inject services for you. Spring allows you to write your classes without having any dependency code .

There are three different ways dependencies can be injected.

• Constructor Injection (CI) - Dependencies (say , other class references) can be injected as a parameter to the constructor of a class. Hence no hard code object creation of the Dependent class is needed.
• Setter Injection (SI) - Inject the dependency as a setter method of the class
• Interface Injection (II) – interface injection, in which the exported module provides an interface that its users must implement in order to get the dependencies at runtime.

A design based on independent classes / components increases the re-usability and possibility to test the software. For example if a class A expects a Dao (Data Access object) for receiving the data from a database you can easily create another test object which mocks the database connection and inject this object into A to test A without having an actual database connection.

Have look at the Bean dependency in detail Here .

But , how do you execute a thread successfully ? Take an example of the class below. This is a thread for installation purpose.

Listing 1 : Install Thread

public class InstallThread extends Thread {

	public InstallThread(String threadName){
		super(threadName);
	}

	@Override
	public void run() {
		super.run();
		System.out.println("installing......");
	}

}

The above class does not install anything but gives you an impression of how to create a basic thread. You must have to give an implementation of the run() method.

Have a look at the following class where the instance of the install thread will be created and started.

Listing 2 : Start the Install Thread

public class InstallThreadTest {

	public static void main(String[] args) {
		InstallThread installThread = new InstallThread("Install Thread;");
		installThread.start();
		System.out.println("Installed.");
	}
}

We have started the thread using the start() method of the Thread class rather using the public run() method of the thread we have created.Why it’s only proper to call the start() method to start the thread instead of calling the run() method directly?

Because the run() method is not an ordinary class method. It should only be called by the Java Virtual Machine(JVM). We write threads because we want multi-threading in most of the cases. Writing thread classes is not about a single sequential thread, it’s about the use of multiple threads running at the same time and performing different tasks in a single program.

The JVM needs to work closely with the underneath operating system for the actual implementation of concurrent operations. Improvement in the performance can be achieved by doing so.

You should not invoke the run() method directly. If you call the run() method directly, it will simply execute in the caller’s thread instead of as its own thread. Instead, you need to call the start() method, which schedules the thread with the JVM. The JVM will call the corresponding run() method when the resources and CPU is ready.

Here is a twist. Don’t expect your run method to be executed for all the treads in the same order of start() method execution. The JVM is not guaranteed to call the run() method right way when the start() method is called, or in the order that the start() methods are called.

The JVM must implement a scheduling mechanism that shares the processor among all running threads. This is why when you call the start() methods from more than one thread, the sequence of execution of the corresponding run() methods is random, controlled only by the JVM.