Loop combinators like map and filter have fallen out of use in performance critical sections of code in favor of for and while loops. This is tragic because not only are loop combinators more expressive than loop cont...
详细信息
ISBN:
(纸本)9781467373098
Loop combinators like map and filter have fallen out of use in performance critical sections of code in favor of for and while loops. This is tragic because not only are loop combinators more expressive than loop control structures but also they are simpler and more error resistant. Using inductive loop combinators, performance can be improved without sacrificing expressiveness. The resulting code is more modular and easier to maintain.
You may have definite ideas about writing code when working alone, but team development requires that everyone use the same approach. With the javascript practices in this bookincluding code style, programming tips, a...
详细信息
ISBN:
(纸本)1449327680;9781449327682
You may have definite ideas about writing code when working alone, but team development requires that everyone use the same approach. With the javascript practices in this bookincluding code style, programming tips, and automationyoull learn how to write maintainable code that other team members can easily understand, adapt, and *** Nicholas Zakas assembled this collection of best practices as a front-end tech leader at Yahoo!, after completing his own journey from solo hacker to team player. He also includes rules recommended by other industry authorities. Use these tips and techniques to help your team set aside individual preferences and function at a higher *** specific code conventions for your team Use tools such as JSLint and JSHint to keep your team on track Adopt style guidelines, such as basic formatting, to help your team produce uniform code Apply several programming practices to solve problems and improve code quality Create an automated javascript build system using a variety of utilities Integrate browser-based javascript testing with tools such as the YUI Test Selenium Driver
The comparison and alignment of runtime traces are essential, e.g., for semantic analysis or debugging. However, naive sequence alignment algorithms cannot address the needs of the modern web: (i) the bytecode generat...
详细信息
ISBN:
(纸本)9781450369879
The comparison and alignment of runtime traces are essential, e.g., for semantic analysis or debugging. However, naive sequence alignment algorithms cannot address the needs of the modern web: (i) the bytecode generation process of V8 is not deterministic;(ii) bytecode traces are large. We present STRAC, a scalable and extensible tool tailored to compare bytecode traces generated by the V8 javascript engine. Given two V8 bytecode traces and a distance function between trace events, STRAC computes and provides the best alignment. The key insight is to split access between memory and disk. STRAC can identify semantically equivalent web pages and is capable of processing huge V8 bytecode traces whose order of magnitude matches today's web like https: //***, which generates approx. 150k of V8 bytecode instructions.
Websites remain popular targets for web-based attacks such as Cross-Site Scripting (XSS). As a remedy, new research is needed to preemptively secure applications with the use of Automated Exploit Generation (AEG), whe...
详细信息
ISBN:
(纸本)9789897585241
Websites remain popular targets for web-based attacks such as Cross-Site Scripting (XSS). As a remedy, new research is needed to preemptively secure applications with the use of Automated Exploit Generation (AEG), whereby probing and patching of system vulnerabilities occurs autonomously. In this paper, we present HIJaX, a novel Natural Language-to-javascript generator prototype, that creates workable XSS exploit code from English sentences using neural machine translation. We train and test the HIJaX model with a variety of datasets containing benign and malicious intents along with differing numbers of baseline code entries to demonstrate how to best create datasets for XSS code generation. We also examine part-of-speech tagging algorithms and automated dataset expansion scripts to aid the dataset creation and code generation processes. Finally, we demonstrate the feasibility of deploying auto-generated XSS attacks against real-world websites.
javascript is one of the most popular programming languages. WeChat Mini-Program is a large ecosystem of javascript applications that runs on the WeChat platform. Millions of Mini-Programs are accessed by WeChat users...
详细信息
ISBN:
(纸本)9781450367684
javascript is one of the most popular programming languages. WeChat Mini-Program is a large ecosystem of javascript applications that runs on the WeChat platform. Millions of Mini-Programs are accessed by WeChat users every week. Consequently, the performance and robustness of Mini-Programs are particularly important. Unfortunately, many Mini-Programs suffer from various defects and performance problems. Dynamic analysis is a useful technique to pinpoint application defects. However, due to the dynamic features of the javascript language and the complexity of the runtime environment, dynamic analysis techniques were rarely used to improve the quality of javascript applications running on industrial platforms such as WeChat Mini-Program previously. In this work, we report our experience of extending Jalangi, a dynamic analysis framework for javascript applications developed by academia, and applying the extended version, named WeJalangi, to diagnose defects in WeChat Mini-Programs. WeJalangi is compatible with existing dynamic analysis tools such as DLint, Smemory, and JITProf. We implemented a null pointer checker on WeJalangi and tested the tool's usability on 152 open-source Mini-Programs. We also conducted a case study in Tencent by applying WeJalangi on six popular commercial Mini-Programs. In the case study, WeJalangi accurately located six null pointer issues and three of them haven't been discovered previously. All of the reported defects have been confirmed by developers and testers.
javascript is a popular language for developing web applications and is increasingly used for both client-side and server-side application logic. The javascript runtime is inherently event-driven and callbacks are a k...
详细信息
ISBN:
(纸本)9781467378994
javascript is a popular language for developing web applications and is increasingly used for both client-side and server-side application logic. The javascript runtime is inherently event-driven and callbacks are a key language feature. Unfortunately, callbacks induce a non-linear control flow and can be deferred to execute asynchronously, declared anonymously, and may be nested to arbitrary levels. All of these features make callbacks difficult to understand and maintain. We perform an empirical study to characterize javascript callback usage across a representative corpus of 138 javascript programs, with over 5 million lines of javascript code. We find that on average, every 10th function definition takes a callback argument, and that over 43% of all callback-accepting function callsites are anonymous. Furthermore, the majority of callbacks are nested, more than half of all callbacks are asynchronous, and asynchronous callbacks, on average, appear more frequently in client-side code (72%) than server-side (55%). We also study three well-known solutions designed to help with the complexities associated with callbacks, including the error-first callback convention, *** library, and Promises. Our results inform the design of future javascript analysis and code comprehension tools.
Malicious PDF files recently considered one of the most dangerous threats to the system security. The flexible code-bearing vector of the PDF format enables to attacker to carry out malicious code on the computer syst...
详细信息
ISBN:
(纸本)9789811065446;9789811065439
Malicious PDF files recently considered one of the most dangerous threats to the system security. The flexible code-bearing vector of the PDF format enables to attacker to carry out malicious code on the computer system for user exploitation. Many solutions have been developed by security agents for the safety of user's system, but still inadequate. In this paper, we propose a method for malicious PDF file detection via machine learning approach. The proposed method extract features from PDF file structure and embedded javascript code that leverage on advanced parsing mechanism. Instead of looking for the specific attack inside the content of PDF i.e. quite complex procedure, we extract features that are often used for attacks. Moreover, we present the experimental evidence for the choice of learning algorithm to provide the remarkably high accuracy as compared to other existing methods.
javascript is one of the most dominant programming languages. However, despite its popularity, it is a challenging task to correctly understand the behaviors of javascript programs because of their highly dynamic natu...
详细信息
ISBN:
(纸本)9781450394130
javascript is one of the most dominant programming languages. However, despite its popularity, it is a challenging task to correctly understand the behaviors of javascript programs because of their highly dynamic nature. Researchers have developed various static analyzers that strive to conform to ECMA-262, the standard specification of javascript. Unfortunately, all the existing javascript static analyzers require manual updates for new language features. This problem has become more critical since 2015 because the javascript language itself rapidly evolves with a yearly release cadence and open development process. In this paper, we present JSAVER, the first tool that automatically derives javascript static analyzers from language specifications. The main idea of our approach is to extract a definitional interpreter from ECMA-262 and perform a meta-level static analysis with the extracted interpreter. A meta-level static analysis is a novel technique that indirectly analyzes programs by analyzing a definitional interpreter with the programs. We also describe how to indirectly configure abstract domains and analysis sensitivities in a meta-level static analysis. For evaluation, we derived a static analyzer from the latest ECMA-262 (ES12, 2021) using JSAVER. The derived analyzer soundly analyzed all applicable 18,556 official conformance tests with 99.0% of precision in 590 ms on average. In addition, we demonstrate the configurability and adaptability of JSAVER with several case studies.
There are numerous working projects on IoT platforms, and many projects employ javascript as their client-side language. One of the benefits using javascript in IoT platforms is its great portability, which lets an ap...
详细信息
ISBN:
(纸本)9781450351867
There are numerous working projects on IoT platforms, and many projects employ javascript as their client-side language. One of the benefits using javascript in IoT platforms is its great portability, which lets an application to run on any IoT devices that employ a javascript runtime. In this situation, user experiences can be enhanced if the states in the IoT devices can be shared so that a user can seamlessly continue an application's state from one device to another. However, serializing the whole execution state of a running application will be inefficient, since most of the execution state would be the same as the initial state of the app launch time. To reduce this inefficiency, we propose JSDelta, which traverses the javascript objects and save only those objects modified from the initial state to a file called snapshot. We send the snapshot to other IoT device, which launches the original app and apply the snapshot to resume the execution state. We have a promising experimental result, eliminating 94% of the snapshot size on average.
This paper presents a web-based image processing using Java Script and WebCL. We modified the Pixastic library using the WebCL for GPU acceleration and evaluated its performance. As a result, we could achieve 2.4 time...
详细信息
ISBN:
(纸本)9781479912919
This paper presents a web-based image processing using Java Script and WebCL. We modified the Pixastic library using the WebCL for GPU acceleration and evaluated its performance. As a result, we could achieve 2.4 times and 3.3 times on average for Webkit and Fire Fox, respectively. Also, we developed a platform and device selection algorithm for the best performance of the web-based execution on heterogeneous multicore environment.
暂无评论