检索结果-内蒙古大学图书馆

17th India Compute Conference-COMPUTE-Annual

作者： Shanbhag, Shriram Chimalakonda, Sridhar Indian Inst Technol Tirupati Dept Comp Sci & Engn Res Intelligent Software & Human Analyt RISHA Lab Chindepalle India

ISBN: (纸本)9783031843907;9783031843914

javascript is one of the most preferred programming languages for web development and many novice programmers use it for learning programming through web development. javascript programmers often rely on browser devTools to debug their programs. The error messages in web browsers get logged into the web console, which is a part of the devTools. However, novice programmers often find it difficult to understand and interpret the error messages. Therefore, we propose JestViz, a tool aimed at helping novice web developers through the modification of the error reporting mechanism and visualization of the stack trace from error messages as a function call graph. We conjecture that these improvements provide novice programmers with a better interpretation of program errors, leading to faster debugging. Our evaluation of JestViz with 20 novice programmers involving the task of comprehending and debugging an erroneous javascript program showed that those who used JestViz took 46% lesser time to debug the program and gained an improved understanding of the inputs and nested function calls that produced the errors.

关键词： Error messages Debugging Novice programmers javascript Browser

来源：评论

学校读者我要写书评

暂无评论

Managing security vulnerabilities introduced by dependencies in *** javascript framework

Managing security vulnerabilities introduced by dependencies...

引用

IEEE International Conference on Software Analysis, Evolution and Reengineering - Companion (SANER-C)

作者： Anastasia, Terzi Stamatia, Bibi Univ Western Macedonia Dept Elect & Comp Engn Kozani Greece

ISBN: (纸本)9798350351583;9798350351576

Currently, the reuse of third-party packages is conunon practice when it comes to javascript (JS) application development. While software reuse brings numerous benefits contributing to accelerated development cycles, it also brings challenges associated with the security vulnerabilities introduced by third-party dependencies. These vulnerabilities have been studied mostly in the context of the hosting software ecosystem (i.e. npm package) while their impact on client applications is understudied. We believe that this impact should be carefully assessed by developers to be able to effectively manage the third-party dependency update process. Our primary objective in this study is to (a) investigate the most frequently appearing vulnerabilities introduced by third-party dependencies and their impact on the client application through a set of metrics, (b) examine the availability of patches/fixes released by the third-party packages to resolve the observed vulnerabilities and (c) examine whether the actual updates of third-party dependencies, performed in the client applications, are associated with the impact of the dependencies and the availability of updates. To achieve this, we conducted a case study on 5572 vulnerability reports obtained from React. js. Our results show that the update propagation of third-party dependencies in client applications is significantly associated both with the impact of the vulnerabilities introduced (i. e. severity, distribution, and volume) and with the availability of the fixes/patches. To assist the decision-making process of third-party dependencies updates we propose a model that will help practitioners consider all related evidence.

关键词： Security Vubzerabilities Software Reuse javascript Software evolution Vubzerabilities prioritization

来源：评论

学校读者我要写书评

暂无评论

BoaSpect: An Expressive Instrumentation Platform for javascript 8

BoaSpect: An Expressive Instrumentation Platform for JavaScr...

引用

8th International Conference on the Art, Science, and Engineering of Programming (Programming)

作者： Munsters, Aaron Pupo, Angel Luis Scull Boix, Elisa Gonzalez Vrije Univ Brussel Brussels Belgium

ISBN: (纸本)9798400706349

Instrumentation platforms facilitate the development and deployment of dynamic analyses. The state-of-the-art instrumentation platforms for javascript rely on different weaving approaches for instrumentation, offering different levels of analysis expressiveness. The main issue is that they are unable to observe and reason about abstract operations, i.e. operations that are not exposed as language constructs but are used within the runtime. However, abstract operations are pivotal to understanding javascript's program behaviour. This paper demonstrates the importance of exposing the ToPrimitive abstract operation, which lies at the core of javascript's type coercion. We introduce BoaSpect, an interpreter-based instrumentation platform for javascript, which provides increased expressiveness by exposing the ToPrimitive trap through the instrumentation interface. We demonstrate its potential by implementing a novel analysis in BoaSpect to identify a potential security exploit, and a taint analysis which can track information flows precisely in the presence of implicit type coercions.

关键词： javascript dynamic analysis instrumentation platform expressiveness

来源：评论

学校读者我要写书评

暂无评论

Keep Me Updated: An Empirical Study on Embedded javascript Engines in Android Apps 21

Keep Me Updated: An Empirical Study on Embedded JavaScript E...

引用

IEEE/ACM 21st International Conference on Mining Software Repositories (MSR)

作者： Wen, Elliott Zhou, Jiaxiang Luo, Xiapu Russello, Giovanni Dietrich, Jens Univ Auckland Auckland New Zealand Hong Kong Polytech Univ Hong Kong Peoples R China Victoria Univ Wellington Wellington New Zealand

ISBN: (纸本)9798350363982;9798400705878

Although javascript (JS) has been widely used in mobile development, little is known about the security implications of utilizing JS engines shipped as native app libraries. In this paper, we conduct an empirical study by designing a JS-Inspector pipeline to identify the embedded JS engines in Android apps and assess their security. We investigate over 65,000 Android apps released between Jan 2018 and July 2023. The results show that many popular apps use embedded JS engines, and their engines remain outdated for extended periods. Moreover, approximately 85% of apps have not received updates since their initial release. As such, over 70% of the identified embedded engines are vulnerable to known exploits. We further present case studies of popular apps catering to millions of users. By exploiting their unpatched JS engines through various strategies, such as man-in-the-middle attacks, intent abuse, and malicious mini-apps, we can easily seize control of the targeted apps and execute arbitrary code. This work highlights critical security concerns associated with embedded JS engines. It emphasizes the urgency for timely updates and enhanced security measures during app development.

关键词： Android Hybrid javascript Vulnerabilities

来源：评论

学校读者我要写书评

暂无评论

Ancient Brain: A javascript coding platform for education with 3D graphics, Websockets, AI and support for teachers 24

Ancient Brain: A JavaScript coding platform for education wi...

引用

8th International Conference on Digital Technology in Education

作者： Humphrys, Mark Dublin City Univ Sch Comp Dublin Ireland

ISBN: (纸本)9798400717574

This paper introduces a javascript coding site called "Ancient Brain" (at https://***/), which is designed for education with support for students and teachers. It has an extensive list of features to support coding almost anything that can be coded in javascript, including HTML-based pages, 2D graphics worlds, 3D graphics worlds, Internet-enabled Websockets apps, and AI apps. All are coded and run on the site in the browser with no install. Support for teaching includes "teacher" and "student" accounts where student code is hidden from other students but not from the teacher, who can run and even edit the code written by all their students. This site has been tested with several years of undergraduate and taught postgraduate students, though not written up in a paper until now. At time of writing there are 9,323 javascript creations on the site. We survey some of the extraordinary range of programs on the site, written by, at last count, 2,150 coders. The next step is to take the site into secondary schools. We will discuss how this could be done, with examples.

关键词： Coding sites Education javascript WebGL Websockets AI in education

来源：评论

学校读者我要写书评

暂无评论

Syntest-javascript: Automated Unit-Level Test Case Generation for javascript 17

Syntest-JavaScript: Automated Unit-Level Test Case Generatio...

引用

17th IEEE/ACM International Workshop on Search-Based and Fuzz Testing (SBFT)

作者： Olsthoorn, Mitchell Stallenberg, Dimitri Panichella, Annibale Delft Univ Technol Delft Netherlands

ISBN: (纸本)9798400705625

Over the last decades, various tools (e.g., AUSTIN and EvoSuite) have been developed to automate the process of unit-level test case generation. Most of these tools are designed for statically-typed languages, such as C and Java. However, as is shown in recent Stack Overflow developer surveys, the popularity of dynamically-typed languages, such as javascript and Python, has been increasing and is dominating the charts. Only recently, tools for automated test case generation of dynamically-typed languages have started to emerge ( e.g., Pynguin for Python). However, to the best of our knowledge, there is no tool that focuses on automated test case generation for server-side javascript. To this aim, we introduce SynTest-javascript, a user-friendly tool for automated unit-level test case generation for (server-side) javascript. To showcase the effectiveness of SynTest-javascript, we empirically evaluate it on five large open-source javascript projects and one artificial one.

关键词： software testing search-based software testing test case generation fuzzing javascript syntest

来源：评论

学校读者我要写书评

暂无评论

Green Evolutionary Algorithms and javascript: A Study on Different Software and Hardware Architectures 1

引用

18th International Conference on Software Technologies (ICSOFT)

作者： Merelo-Guervos, Juan J. Garcia-Valdez, Mario Castillo, Pedro A. Univ Granada Dept Comp Engn Automat & Robot Granada Spain Univ Granada CITIC Granada Spain Natl Technol Inst Mexico Dept Grad Studies Tijuana Mexico

ISBN: (数字)9783031617539

ISBN: (纸本)9783031617522;9783031617539

Energy-aware computing is the design and operation of hardware and software systems to minimize their energy consumption. This requires consideration of many variables and parameters, making it necessary to focus on a single one or a few to obtain meaningful results;this is why, in this paper, we will investigate the energy consumption of three javascript interpreters (bun, ***, and deno) for evolutionary algorithms (EAs), a type of population-based stochastic optimization algorithm. We expect different energy budgets for running the same EA workload on these interpreters due to their different conceptual designs. We will also compare the energy consumption of the different operators and functions of the EA, to see if there are differences in the energy consumption of the different interpreters. Additionally, we will perform these measurements across different architectures, homogeneous (Intel) and heterogeneous (ARM), to profile their energy consumption. To obtain these results, we will test different tools to measure per-process energy consumption accurately. After choosing a tool, we will perform experiments on a workload similar to an EA to measure the energy consumption of EA-specific functions and operators for different problem sizes. Finally, we will draw a conclusion on which javascript interpreter and architecture are the most energy-efficient for EA workloads if energy is a limited concern.

关键词： Green computing Metaheuristics javascript Energy-aware computing Evolutionary algorithms

来源：评论

学校读者我要写书评

暂无评论

Runtime Verification of javascript Implementations Using Aspect Oriented Programming and Regular Expressions 50

Runtime Verification of JavaScript Implementations Using Asp...

引用

50th Latin American Computing Conference (CLEI)

作者： Pacione, Luciano Urribarri, Dana K. Larrea, Martin L. Tamargo, Luciano H. Univ Nacl Sur Dept Comp Sci & Engn Bahia Blanca Buenos Aires Argentina Univ Nacl Sur Inst Comp Sci & Engn Dept Comp Sci & Engn Comp Graph & Visualizat R&D Lab CICCONICET Bahia Blanca Buenos Aires Argentina Univ Nacl Sur Inst Comp Sci & Engn Dept Comp Sci & Engn CONICET Bahia Blanca Buenos Aires Argentina

ISBN: (纸本)9798331540982;9798331540975

Runtime Verification is a software testing technique based on extracting and analyzing information from a system while it is running. The objective is to use this information to find faults or problems in the system under test. To achieve this, it is necessary that the insertion of testing logic does not modify the code being tested and that it does not affect the performance of the system. In this article, we present a runtime testing framework for javascript, which utilizes Aspect-Oriented Programming and regular expressions. This framework encapsulates the idea of Message Sequence Specification applied to Runtime Verification. Our work is freely available and open source.

关键词： Runtime Verification javascript Aspect Oriented Programming Regular Expression Testing

来源：评论

学校读者我要写书评

暂无评论

Stubbifier: debloating dynamic server-side javascript applications

引用

EMPIRICAL SOFTWARE ENGINEERING 2022年第7期27卷 161-161页

作者： Turcotte, Alexi Arteca, Ellen Mishra, Ashish Alimadadi, Saba Tip, Frank Northeastern Univ Khoury Coll Comp Sci Boston MA 02115 USA Purdue Univ W Lafayette IN 47907 USA Simon Fraser Univ Comp Sci Vancouver BC Canada

javascript is an increasingly popular language for server-side development, thanks in part to the *** runtime environment and its vast ecosystem of modules. With the *** package manager npm, users are able to easily include external modules as dependencies in their projects. However, npm installs modules with all of their functionality, even if only a fraction is needed, which causes an undue increase in code size. Eliminating this unused functionality from distributions is desirable, but the sound analysis required to find unused code is difficult due to javascript's extreme dynamicity. We present a fully automatic technique that identifies unused code by constructing static or dynamic call graphs from the application's tests, and replacing code deemed unreachable with either file- or function-level stubs. Due to javascript's highly dynamic nature, call graph construction may suffer from unsoundness, i.e., code identified as unused may in fact be reachable. To handle such cases, if a stub is called, it will fetch and execute the original code on-demand to preserve the application's behavior. The technique also provides an optional guarded execution mode to guard application against injection vulnerabilities in untested code that resulted from stub expansion. This technique is implemented in an open source tool called Stubbifier, designed to help package developers to produce a minimal production distribution. Stubbifier supports the ECMAScript 2019 standard. In an empirical evaluation on 15 *** applications and 75 clients of these applications, Stubbifier reduced application size by 56% on average while incurring only minor performance overhead. The evaluation also shows that Stubbifier's guarded execution mode is capable of preventing several known injection vulnerabilities that are manifested in stubbed-out code. Finally, Stubbifier can work alongside bundlers, popular javascript tools for bundling an application with its dependencies. For the conside

关键词： Debloating Program analysis javascript Node js

来源：评论

学校读者我要写书评

暂无评论

Concolic Testing of Front-end javascript 1

引用

26th International Conference on Fundamental Approaches to Software Engineering (FASE) Held as Part of the European Joint Conferences on Theory and Practice of Software (ETAPS)

作者： Li, Zhe Xie, Fei Portland State Univ Portland OR 97201 USA

ISBN: (数字)9783031308260

ISBN: (纸本)9783031308253;9783031308260

javascript has become the most popular programming language for web front-end development. With such popularity, there is a great demand for thorough testing of client-side javascript web applications. In this paper, we present a novel approach to concolic testing of front-end javascript web applications. This approach leverages widely used javascript testing frameworks such as Jest and Puppeteer and conducts concolic execution on javascript functions in web applications for unit testing. The seamless integration of concolic testing with these testing frameworks allows injection of symbolic variables within the native execution context of a javascript web function and precise capture of concrete execution traces of the function under test. Such concise execution traces greatly improve the effectiveness and efficiency of the subsequent symbolic analysis for test generation. We have implemented our approach on Jest and Puppeteer. The application of our Jest implementation on Metamask, one of the most popular Crypto wallets, has uncovered 3 bugs and 1 test suite improvement, whose bug reports have all been accepted by Metamask developers on Github. We also applied our Puppeteer implementation to 21 Github projects and detected 4 bugs.

关键词： Concolic Testing javascript Front-end Web Application

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：