object flow integrity (OFI) augments control-flow integrity (CFI) and software fault isolation (SFI) protections with secure, first-class support for binary object exchange across inter-module trust boundaries. This e...
详细信息
ISBN:
(纸本)9781450349468
object flow integrity (OFI) augments control-flow integrity (CFI) and software fault isolation (SFI) protections with secure, first-class support for binary object exchange across inter-module trust boundaries. This extends both source-aware and source-free CFI and SFI technologies to a large class of previously unsupported software: those containing immutable system modules with large, objectoriented APIs which are particularly common in component-based, event-driven consumer software. It also helps to protect these inter module object exchanges against confused deputy-assisted vtable corruption and counterfeit object-orientedprogramming attacks. A prototype implementation for Microsoft Component object Model demonstrates that OFI is scalable to large interfaces on the order of tens of thousands of methods, and exhibits low overheads of under 1% for some common-case applications. Significant elements of the implementation are synthesized automatically through a principled design inspired by type-based contracts.
Modularity in object-oriented (OO) applications has been a major concern since the early years of OO programming languages. Migrating existing OO applications to Component-Based (CB) ones can contribute to improve mod...
详细信息
ISBN:
(纸本)1891706411
Modularity in object-oriented (OO) applications has been a major concern since the early years of OO programming languages. Migrating existing OO applications to Component-Based (CB) ones can contribute to improve modularity, and therefore maintainability and reuse. In this paper, we propose a method for source code transformation (refactoring) in order to perform this migration. This method enhances decoupling by considering that some dependencies between classes should be set through abstract types (interfaces) like in CB applications. In addition, some anticipated instantiations of these classes "buried" in the source code are extracted and replaced by declarative statements (like connectors in CB applications) which are processed by a dependency injection mechanism. For doing so, a set of "Bad Smells", i.e., modularity-violating symptoms, has been defined. These are first detected in the source code. Then, some refactoring operations are applied for their elimination. An implementation of the method was successfully experimented on a set of open source Java projects. The results of this experimentation are reported in this paper.
The proceedings contain 20 papers. The topics discussed include: ethical issues in data management;programming by examples: applications, algorithms, and ambiguity resolution;environments and the complexity of abstrac...
ISBN:
(纸本)9781450352918
The proceedings contain 20 papers. The topics discussed include: ethical issues in data management;programming by examples: applications, algorithms, and ambiguity resolution;environments and the complexity of abstract machines;conditional narrowing modulo SMT and axioms;attribute grammars with set attributes and global constraints as a unifying framework for planning domain models;shrink fast correctly!;function definitions for compound values in object-oriented languages;verifiable semantic difference languages;theory learning with symmetry breaking;copattern-matchings and first-class observations in OCaml, with a macro;practical evaluation of the lasp programming model at large scale - an experience report;selective unification in constraint logic programming;causally consistent reversible choreographies: a monitors-as-memories approach;machine fusion: merging merges, more or less;alpha-renaming of higher-order meta-expressions;characterization of strong normalizability for a sequent lambda calculus with co-control;defunctionalisation as modular closure conversion;a core calculus for provenance for provenance inspection;and expressive and strongly type-safe code generation.
Modern programming languages, such as Java and C#, typically provide features that handle exceptions. These features separate error-handling code from regular source code and are proven to enhance the practice of soft...
详细信息
ISBN:
(纸本)9781538605356
Modern programming languages, such as Java and C#, typically provide features that handle exceptions. These features separate error-handling code from regular source code and are proven to enhance the practice of software reliability, comprehension, and maintenance. Having acknowledged the advantages of exception handling features, the misuse of them can still cause catastrophic software failures, such as application crash. Prior studies suggested anti-patterns of exception handling;while little knowledge was shared about the prevalence of these anti-patterns. In this paper, we investigate the prevalence of exception-handling anti-patterns. We collected a thorough list of exception anti-patterns from 16 open-source Java and C# libraries and applications using an automated exception flow analysis tool. We found that although exception handling anti-patterns widely exist in all of our subjects, only a few anti-patterns (e.g. Unhandled Exceptions, Catch Generic, Unreachable Handler, Over-catch, and Destructive Wrapping) can be commonly identified. On the other hand, we find that the prevalence of anti-patterns illustrates differences between C# and Java. Our results call for further in-depth analyses on the exception handling practices across different languages.
Reasoning about object-orientedapplications requires developers to answer contextual questions about their domain objects. Tailored development tools can support developers in this activity by providing relevant doma...
详细信息
ISBN:
(纸本)9781450344371
Reasoning about object-orientedapplications requires developers to answer contextual questions about their domain objects. Tailored development tools can support developers in this activity by providing relevant domain-specific information. Nonetheless, a high effort for extending development tools to handle domain-specific objects, together with diverging mechanisms for creating, sharing and discovering extensions, discourage developers to adapt their tools. To address this, we propose to enable contextual behavior in development tools by allowing domain objects to decide how they are handled in development tools. We show that combining this idea with mechanisms for specifying extensions using internal DSLs can significantly reduce the cost of tailoring development tools to specific domains.
The interoperability of applications depends on a successful mapping between their domain models. Nowadays, common file formats serve as a mediator between the different domain models but cause friction losses during ...
详细信息
ISBN:
(纸本)9781450344371
The interoperability of applications depends on a successful mapping between their domain models. Nowadays, common file formats serve as a mediator between the different domain models but cause friction losses during the conversion of data. These loses could be mitigated whenever the models are already working on the same concepts but are only using different representations for them. We propose the concept of deducing classes which interpret existing object structures and detect instances of themselves in this existing data. Further, we introduce a planning algorithm which combines deducing classes to allow unanticipated interactions between applications. We discuss some of the implications of this approach and illustrate upcoming research challenges.
The proceedings contain 60 papers. The topics discussed include: efficient modular glass box software model checking;an experiment about static and dynamic type systems: doubts about the positive impact of static type...
ISBN:
(纸本)9781450302036
The proceedings contain 60 papers. The topics discussed include: efficient modular glass box software model checking;an experiment about static and dynamic type systems: doubts about the positive impact of static type systems on development time;a simple inductive synthesis methodology and its applications;a domain-specific approach to architecturing error handling in pervasive computing;G-finder: routing programming questions closer to the experts;agility in context;an input-centric paradigm for program dynamic optimizations;composable specifications for structured shared-memory communication;scalable and systematic detection of buggy inconsistencies in source code;cross-language, type-safe, and transparent object sharing for co-located managed runtimes;instrumentation and sampling strategies for cooperative concurrency bug isolation;what can the GC compute efficiently? a language for heap assertions at GC time;and monitor optimization via stutter-equivalent loop transformation.
Modern object-orientedprogramming languages greatly alleviate the memory management for programmers. Despite the efficiency of garbage collection and Just-In-Time program analyzes, memory still remains prone to be wa...
详细信息
The majority of modern programming languages provide concurrency and object-orientation in some form. However, object-oriented concurrency remains cumbersome in many situations. We introduce the language OrcO, Orc wit...
详细信息
Perpetrators might employ computer programs (software) to perform their offenses or to cover their wrongdoings. Program's source code, in particular variables and their values diverge in their scope and duration i...
详细信息
ISBN:
(纸本)9781538637319
Perpetrators might employ computer programs (software) to perform their offenses or to cover their wrongdoings. Program's source code, in particular variables and their values diverge in their scope and duration in RAM. objectoriented languages encapsulate variables and operations in classes and allow for objects to be instantiated, which simplify software design but add to the complexity of its execution behavior and its data and control flow. This paper explores execution behaviors and information left by program execution in support for legal actions against perpetrators in the court of law. Our investigation model assumes no information is provided by the operating system;only raw RAM dumps. Our methodology employs information from the presumed program source code and its objectoriented design. It explores various execution states and scenarios to uncover the evidence of potential software usage. These scenarios are designed to show that scope, access modifiers, and storage information of various source code variables can be used to identify program's activities. Results show that investigators have good chances locating various variables' values that are uniquely corresponded to the presumed software and its execution states. In some cases, values are successfully identified in memory dumps even after the process is stopped.
暂无评论