We present an efficient natural feature tracking pipeline solely implemented in javascript. It is embedded in a web technology-based Augmented Reality system running plugin-free in web browsers. The evaluation shows t...
详细信息
ISBN:
(纸本)9781467312462
We present an efficient natural feature tracking pipeline solely implemented in javascript. It is embedded in a web technology-based Augmented Reality system running plugin-free in web browsers. The evaluation shows that real-time framerates on desktop computers and while on smartphones interactive framerates are achieved.
javascript is widely used to provide client-side functionality in Web applications. To provide services ranging from maps to advertisements, Web applications may incorporate untrusted javascript code from third partie...
详细信息
ISBN:
(纸本)9780769544021
javascript is widely used to provide client-side functionality in Web applications. To provide services ranging from maps to advertisements, Web applications may incorporate untrusted javascript code from third parties. The trusted portion of each application may then expose an API to untrusted code, interposing a reference monitor that mediates access to security-critical resources. However, a javascript reference monitor can only be effective if it cannot be circumvented through programming tricks or programming language idiosyncrasies. In order to verify complete mediation of critical resources for applications of interest, we define the semantics of a restricted version of javascript devised by the ECMA Standards committee for isolation purposes, and develop and test an automated tool that can soundly establish that a given API cannot be circumvented or subverted. Our tool reveals a previously-undiscovered vulnerability in the widely-examined Yahoo! ADsafe filter and verifies confinement of the repaired filter and other examples from the Object-Capability literature.
javascript is a popular programming language that is also error-prone due to its asynchronous, dynamic, and loosely-typed nature. In recent years, numerous techniques have been proposed for analyzing and testing JavaS...
详细信息
ISBN:
(纸本)9781728117362
javascript is a popular programming language that is also error-prone due to its asynchronous, dynamic, and loosely-typed nature. In recent years, numerous techniques have been proposed for analyzing and testing javascript applications. However, our survey of the literature in this area revealed that the proposed techniques are often evaluated on different datasets of programs and bugs. The lack of a commonly used benchmark limits the ability to perform fair and unbiased comparisons for assessing the efficacy of new techniques. To fill this gap, we propose BUGSJS, a benchmark of 453 real, manually validated javascript bugs from 10 popular javascript server-side programs, comprising 444k LOC in total. Each bug is accompanied by its bug report, the test cases that detect it, as well as the patch that fixes it. BUGSJS features a rich interface for accessing the faulty and fixed versions of the programs and executing the corresponding test cases, which facilitates conducting highly-reproducible empirical studies and comparisons of javascript analysis and testing tools.
JSConTest introduced the notions of effect monitoring and dynamic effect inference for javascript. It enables the description of effects with path specifications resembling regular expressions. It is implemented by an...
详细信息
ISBN:
(纸本)9781450324335
JSConTest introduced the notions of effect monitoring and dynamic effect inference for javascript. It enables the description of effects with path specifications resembling regular expressions. It is implemented by an offline source code transformation. To overcome the limitations of the JSConTest implementation, we redesigned and reimplemented effect monitoring by taking advantange of javascript proxies. Our new design avoids all drawbacks of the prior implementation. It guarantees full interposition;it is not restricted to a subset of javascript;it is self-maintaining;and its scalability to large programs is significantly better than with JSConTest. The improved scalability has two sources. First, the reimplementation is significantly faster than the original, transformationbased implementation. Second, the reimplementation relies on the fly-weight pattern and on trace reduction to conserve memory. Only the combination of these techniques enables monitoring and inference for large programs.
We present Dependent javascript (DJS), a statically typed dialect of the imperative, object-oriented, dynamic language. DJS supports the particularly challenging features such as run-time type-tests, higher-order func...
详细信息
ISBN:
(纸本)9781450315616
We present Dependent javascript (DJS), a statically typed dialect of the imperative, object-oriented, dynamic language. DJS supports the particularly challenging features such as run-time type-tests, higher-order functions, extensible objects, prototype inheritance, and arrays through a combination of nested refinement types, strong updates to the heap, and heap unrolling to precisely track prototype hierarchies. With our implementation of DJS, we demonstrate that the type system is expressive enough to reason about a variety of tricky idioms found in small examples drawn from several sources, including the popular book javascript: The Good Parts and the SunSpider benchmark suite.
Virtual worlds and avatar-based interactive computer games are a hype among consumers and researchers for many years now. In recent years, such games on mobile devices also became increasingly important. However, most...
详细信息
ISBN:
(纸本)9789897582325
Virtual worlds and avatar-based interactive computer games are a hype among consumers and researchers for many years now. In recent years, such games on mobile devices also became increasingly important. However, most virtual worlds require the use of proprietary clients and authoring environments and lack portability, which limits their usefulness for targeting wider audiences like e.g. in consumer marketing or sales. Using mobile devices and client-side web technologies like i.e. javascript in combination with a more automatic generation of customer-specific virtual worlds could help to overcome these limitations. Here, model-driven software development (MDD) provides a promising approach for automating the creation of user interface (UI) components for games on mobile devices. Therefore, in this paper an approach is proposed for the model-driven generation of UI components for virtual worlds using javascript and the upcoming *** framework. The feasibilty of the approach is evaluated by implementing a proof-of-concept scenario.
Static flow analyses compute a safe approximation of a program's dataflow without executing it. Dynamic flow analyses compute a similar safe approximation by running the program on test data such that it achieves ...
详细信息
ISBN:
(纸本)9783030148058;9783030148041
Static flow analyses compute a safe approximation of a program's dataflow without executing it. Dynamic flow analyses compute a similar safe approximation by running the program on test data such that it achieves sufficient coverage. We design and implement a dynamic flow analysis for javascript. Our formalization and implementation observe a program's execution in a training run and generate flow constraints from the observations. We show that a solution of the constraints yields a safe approximation to the program's dataflow if each path in every function is executed at least once in the training run. As a by-product, we can reconstruct types for javascript functions from the results of the flow analysis. Our implementation shows that dynamic flow analysis is feasible for javascript. While our formalization concentrates on a core language, the implementation covers full javascript. We evaluated the implementation using the SunSpider benchmark.
javascript is one of the most popular programming languages. However, understanding the dynamic behaviour of javascript apps is challenging in practice. There are many factors that hinder javascript comprehension, suc...
详细信息
ISBN:
(纸本)9781450342186
javascript is one of the most popular programming languages. However, understanding the dynamic behaviour of javascript apps is challenging in practice. There are many factors that hinder javascript comprehension, such as its dynamic, asynchronous, and event-driven nature, the dynamic interplay between javascript and the Document Object Model, and the asynchronous communication between client and server. In this research work, we have already proposed methods for understanding event-based and asynchronous javascript behaviour. To enhance the scalability of our methods, we propose a new technique that adopts bio-informatics algorithms to extract sequences of actions from execution traces that form higher-level patterns.
Support for regular expressions in symbolic execution-based tools for test generation and bug finding is insufficient. Common aspects of mainstream regular expression engines, such as backreferences or greedy matching...
详细信息
ISBN:
(纸本)9781450367127
Support for regular expressions in symbolic execution-based tools for test generation and bug finding is insufficient. Common aspects of mainstream regular expression engines, such as backreferences or greedy matching, are ignored or imprecisely approximated, leading to poor test coverage or missed bugs. In this paper, we present a model for the complete regular expression language of ECMAScript 2015 (ES6), which is sound for dynamic symbolic execution of the test and exec functions. We model regular expression operations using string constraints and classical regular expressions and use a refinement scheme to address the problem of matching precedence and greediness. We implemented our model in ExpoSE, a dynamic symbolic execution engine for javascript, and evaluated it on over 1,000 *** packages containing regular expressions, demonstrating that the strategy is effective and can significantly increase the number of successful regular expression queries and therefore boost coverage.
In 2013, the Qt Project announced a move away from Google's V8 javascript engine to their own internal V4 javascript engine. Despite this, even today Qt still contains a V8 interpretation layer and V8 code in othe...
详细信息
ISBN:
(纸本)9781728125305
In 2013, the Qt Project announced a move away from Google's V8 javascript engine to their own internal V4 javascript engine. Despite this, even today Qt still contains a V8 interpretation layer and V8 code in other parts of Qt. This paper aims to investigate why the decision to change interpreters was made and also to evaluate the aspects of Qt interpreted by V4 and what is interpreted by V8. With this defined, differences in secure coding techniques between these systems is examined and highlighted and why these techniques are important in the Qt environment.
暂无评论