检索结果-内蒙古大学图书馆

34th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages

作者： Yu, Dachuan Chander, Ajay Islam, Nayeem Serikov, Igor DoCoMo Communications Laboratories USA Inc.

ISBN: (纸本)9781595935755

It is well recognized that javascript can be exploited to launch browser-based security attacks. We propose to battle such attacks using program instrumentation. Untrusted javascript code goes through a rewriting process which identifies relevant operations, modifies questionable behaviors, and prompts the user (a web page viewer) for decisions on how to proceed when appropriate. Our solution is parametric with respect to the security policy-the policy is implemented separately from the rewriting, and the same rewriting process is carried out regardless of which policy is in use. Besides providing a rigorous account of the correctness of our solution, we also discuss practical issues including policy management and prototype experiments. A useful by-product of our work is an operational semantics of a core subset of javascript, where code embedded in (HTML) documents may generate further document pieces (with new code embedded) at runtime, yielding a form of self-modifying code.

关键词： languages security theory javascript program instrumentation edit automata web browser

来源：评论

学校读者我要写书评

暂无评论

Efficient Static Vulnerability Analysis for javascript with Multiversion Dependency Graphs

引用

PROCEEDINGS OF THE ACM ON PROGRAMMING LANGUAGES-PACMPL 2024年第PLDI期8卷 417-441页

作者： Ferreira, Mafalda Monteiro, Miguel Brito, Tiago Coimbra, Miguel E. Santos, Nuno Jia, Limin Fragoso Santos, Jose Univ Lisbon Inst Super Tecn INESC ID Lisbon Portugal Carnegie Mellon Univ Pittsburgh PA USA

While static analysis tools that rely on Code Property Graphs (CPGs) to detect security vulnerabilities have proven effective, deciding how much information to include in the graphs remains a challenge. Including less information can lead to a more scalable analysis but at the cost of reduced effectiveness in identifying vulnerability patterns, potentially resulting in classification errors. Conversely, more information in the graph allows for a more effective analysis but may affect scalability. For example, scalability issues have been recently highlighted in ODGen, the state-of-the-art CPG-based tool for detecting *** vulnerabilities. This paper examines a new point in the design space of CPGs for javascript vulnerability detection. We introduce the Multiversion Dependency Graph (MDG), a novel graph-based data structure that captures the state evolution of objects and their properties during program execution. Compared to the graphs used by ODGen, MDGs are significantly simpler without losing key information needed for vulnerability detection. We implemented ***, a new MDG-based static vulnerability scanner specialized in analyzing npm packages and detecting taint-style and prototype pollution vulnerabilities. Our evaluation shows that *** outperforms ODGen by significantly reducing both the false negatives and the analysis time. Additionally, we have identified 49 previously undiscovered vulnerabilities in npm packages.

关键词： Static Analysis javascript Vulnerability Detection

来源：评论

学校读者我要写书评

暂无评论

javascript Domain-Driven Design 1

引用

2015年

作者： Philipp Fehre

ISBN: (数字)9781784391140

ISBN: (纸本)1784394327;9781784394325

Speed up your application development by leveraging the patterns of domain-driven design About This BookUnderstand the complexity of your business requirements to develop more productive applicationsCombine modern development techniques with traditional methods and create new applications to suit your needsAcquire practical skills through application designing explained with examplesWho This Book Is ForIf you are an experienced javascript developer who wants to improve the design of his or her applications, or find yourself in a situation to implement an application in an unfamiliar domain, this book is for you. Prior knowledge of javascript is required and prior experience with *** will also be *** You Will LearnMake communication with businesses more productive by identifying your requirementsAnalyze a project to build the right features at the right timeTest the vital parts of your project by implementing test-driven designCreate application prototypes and utilize UML to enhance developer productivityExplore effective means of communicating with non-developers to find out more about their requirementsDiscover how to create manageable applications in javascript from scratchLearn to quickly build advanced javascript applicationsIn Detailjavascript backs some of the most advanced applications. It is time to adapt modern software development practices from javascript to model complex business *** Domain-Driven Design allows you to leverage your javascript skills to create advanced applications. You'll start with learning domain-driven concepts and working with UML diagrams. You'll follow this up with how to set up your projects and utilize the TDD tools. Different objects and prototypes will help you create model for your business process and see how DDD develops common language for developers and domain experts. Context map will help you manage interactions in a system. By the end of the book, you will learn to use other design patterns suc

关键词： design driven domain javascript

来源：评论

学校读者我要写书评

暂无评论

Linear Matching of javascript Regular Expressions

引用

PROCEEDINGS OF THE ACM ON PROGRAMMING LANGUAGES-PACMPL 2024年第PLDI期8卷 1336-1360页

作者： Barriere, Aurele Pit-Claudel, Clement Ecole Polytech Fed Lausanne Lausanne Switzerland

Modern regex languages have strayed far from well-understood traditional regular expressions: they include features that fundamentally transform the matching problem. In exchange for these features, modern regex engines at times suffer from exponential complexity blowups, a frequent source of denial-of-service vulnerabilities in javascript applications. Worse, regex semantics differ across languages, and the impact of these divergences on algorithmic design and worst-case matching complexity has seldom been investigated. This paper provides a novel perspective on javascript's regex semantics by identifying a larger-than-previously-understood subset of the language that can be matched with linear time guarantees. In the process, we discover several cases where state-of-the-art algorithms were either wrong (semantically incorrect), inefficient (suffering from superlinear complexity) or excessively restrictive (assuming certain features could not be matched linearly). We introduce novel algorithms to restore correctness and linear complexity. We further advance the state-of-the-art in linear regex matching by presenting the first nonbacktracking algorithms for matching lookarounds in linear time: one supporting captureless lookbehinds in any regex language, and another leveraging a javascript property to support unrestricted lookaheads and lookbehinds. Finally, we describe new time and space complexity tradeoffs for regex engines. All of our algorithms are practical: we validated them in a prototype implementation, and some have also been merged in the V8 javascript implementation used in Chrome and ***.

关键词： Regex Automata javascript

来源：评论

学校读者我要写书评

暂无评论

Fast and Precise Type Checking for javascript

引用

PROCEEDINGS OF THE ACM ON PROGRAMMING LANGUAGES-PACMPL 2017年第OOPSLA期1卷 1–30页

作者： Chaudhuri, Avik Vekris, Panagiotis Goldman, Sam Roch, Marshall Levi, Gabriel Facebook Inc Menlo Pk CA 94025 USA Univ Calif San Diego La Jolla CA 92093 USA

In this paper we present the design and implementation of FLOW, a fast and precise type checker for javascript that is used by thousands of developers on millions of lines of code at FACEBOOK every day. FLOW uses sophisticated type inference to understand common javascript idioms precisely. This helps it find non-trivial bugs in code and provide code intelligence to editors without requiring significant rewriting or annotations from the developer. We formalize an important fragment of Flow's analysis and prove its soundness. Furthermore, FLOW uses aggressive parallelization and incrementalization to deliver near-instantaneous response times. This helps it avoid introducing any latency in the usual edit-refresh cycle of rapid javascript development. We describe the algorithms and systems infrastructure that we built to scale FLow's analysis.

关键词： Type Systems Type Inference javascript

来源：评论

学校读者我要写书评

暂无评论

Clone Detection Techniques for javascript and Language Independence: Review

引用

INTERNATIONAL JOURNAL OF ADVANCED COMPUTER SCIENCE AND APPLICATIONS 2020年第4期11卷 787-795页

作者： Alfageh, Danyah Alhakami, Hosam Baz, Abdullah Alanazi, Eisa Alsubait, Tahani Umm Al Qura Univ Coll Comp & Informat Syst Mecca Saudi Arabia

Code clone detection is an active field of study in computer science. Despite its rich history, it lacks focus on web scripting languages. Due to the expansion of web applications and web development amongst developers of varying education and experience levels, they inevitably resort to cloning through out the web. The spread of code clones is further increased by websites like StackOverflow and GitHub. In this paper, we will be focusing on clone detection research done to target clones in javascript code and discuss its areas of concern. Also, we will summarize language independent research done and possibility of its application on javascript and web applications.

关键词： Clone detection code clones javascript language independent clone detection web applications

来源：评论

学校读者我要写书评

暂无评论

javascript Application Design: A Build First Approach 1

引用

2015年

作者： Nicolas Bevacqua

ISBN: (纸本)9781617291951

Choosing the right libraries and frameworks for large-scale javascript applications isn't enough. Successful web development requires a more disciplined approach to application architecture and development. The Build First philosophy of designing clean, well-structured, and testable applications before writing a single line of code ensures that developers start right and end up with applications that are easy to maintain, scale, and *** Application Design: A Build First approach introduces developers to techniques that will improve the quality of their software as well as web development workflow. It shows how to establish build processes appropriate for javascript-driven development, and it looks at best practices for productive day-to-day development, like running tasks when code changes, deploying applications with a single command, and monitoring the state of an application once it's in production. Along the way, it gives insights into designing well-rounded architectures for applications running on the *** *** of the print book includes a free eBook in PDF, Kindle, and ePub formats from Manning Publications

关键词： first approach build design application javascript

来源：评论

学校读者我要写书评

暂无评论

Finding Broken Promises in Asynchronous javascript Programs

引用

PROCEEDINGS OF THE ACM ON PROGRAMMING LANGUAGES-PACMPL 2018年第OOPSLA期2卷 1–26页

作者： Alimadadi, Saba Zhong, Di Madsen, Magnus Tip, Frank Northeastern Univ Boston MA 02115 USA Aarhus Univ Aarhus Denmark

Recently, promises were added to ECMAScript 6, the javascript standard, in order to provide better support for the asynchrony that arises in user interfaces, network communication, and non-blocking I/O. Using promises, programmers can avoid common pitfalls of event-driven programming such as event races and the deeply nested counterintuitive control flow referred to as "callback hell". Unfortunately, promises have complex semantics and the intricate control- and data-flow present in promise-based code hinders program comprehension and can easily lead to bugs. The promise graph was proposed as a graphical aid for understanding and debugging promise-based code. However, it did not cover all promise-related features in ECMAScript 6, and did not present or evaluate any technique for constructing the promise graphs. In this paper, we extend the notion of promise graphs to include all promise-related features in ECMAScript 6, including default reactions, exceptions, and the synchronization operations race and all. Furthermore, we report on the construction and evaluation of PROMISEKEEPER, which performs a dynamic analysis to create promise graphs and infer common promise anti-patterns. We evaluate PROMISEKEEPER by applying it to 12 open source promise-based *** applications. Our results suggest that the promise graphs constructed by PROMISEKEEPER can provide developers with valuable information about occurrences of common anti-patterns in their promise-based code, and that promise graphs can be constructed with acceptable run-time overhead.

关键词： javascript Promises Promise Graph Dynamic Analysis PromiseKeeper

来源：评论

学校读者我要写书评

暂无评论

Information-flow security for javascript and its APIs

引用

JOURNAL OF COMPUTER SECURITY 2016年第2期24卷 181-234页

作者： Hedin, Daniel Bello, Luciano Sabelfeld, Andrei Chalmers Univ Technol Dept Comp Sci & Engn Rannvagen 6B S-41296 Gothenburg Sweden Malardalen Univ Sch Innovat Design & Engn Box 883 S-72123 Vasteras Sweden

javascript drives the evolution of the web into a powerful application platform. Increasingly, web applications combine services from different providers. The script inclusion mechanism routinely turns barebone web pages into full-fledged services built up from third-party code. Script inclusion poses a challenge of ensuring that the integrated third-party code respects security and privacy. This paper presents a dynamic mechanism for securing script executions by tracking information flow in javascript and its APIs. On the formal side, the paper identifies language constructs that constitute a core of javascript: dynamic objects, higher-order functions, exceptions, and dynamic code evaluation. It develops a dynamic type system that guarantees information-flow security for this language. Based on this formal model, the paper presents JSFlow, a practical security-enhanced interpreter for fine-grained tracking of information flow in full javascript and its APIs. Our experiments with JSFlow deployed as a browser extension provide in-depth understanding of information manipulation by third-party scripts. We find that different sites intended to provide similar services effectuate rather different security policies for the user's sensitive information: some ensure it does not leave the browser, others share it with the originating server, while yet others freely propagate it to third parties.

关键词： Web application security javascript information flow reference monitoring noninterference

来源：评论

学校读者我要写书评

暂无评论

javascript &DHTML Cookbook 1st

引用

2003年

作者： Danny Goodman

ISBN: (纸本)9780596004675

On numerous online forums for javascript and DHTML, the majority of questions begin with "How do I...?" This new Cookbook provides the answers. After reading thousands of forum threads over the years, author and scripting pioneer Danny Goodman has compiled a list of problems that frequently vex scripters of various experience levels. He has now applied state-of-the-art ECMA and W3C DOM standards and used best practices to create this extensive collection of practical recipes that can bring your web pages to *** javascript & DHTML Cookbook is all about adding value to the content of a web page. The book focuses on practical and sensible applications of scripting, rather than flying images and gratuitous color changes. For every problem Goodman addresses, there's a solution or "recipe"--a focused piece of code that web developers can insert directly into their applications. Yet, rather than just cut-and-paste code, you also get explanations of how and why the code works, so you can learn to adapt the problem-solving techniques to your *** recipes range from simple tasks, such as manipulating strings and validating dates in javascript, to entire libraries that demonstrate complex tasks, such as cross-browser positioning of HTML elements and sorting tables. This book contains over 150 recipes on the following topics:Working with interactive forms and style sheets Presenting user-friendly page navigation Creating dynamic content Producing visual effects for stationary content Positioning HTML elements Managing browser windows and multiple frames This book is the ideal companion to O'Reilly's javascript: The Definitive Guide and Dynamic HTML: The Definitive Reference. If you own either of these books, the javascript & DHTML Cookbook is a must

关键词： cookbook dhtml javascript

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：