Search

Specialized scientific software is volatile and often has a small number of users with a wide variety of computer platforms. The problems of distributing, updating and maintaining such packages can be ameliorated by using the World Wide Web to distribute graphical interface processing to individual users’ Web browsers and performing the numerical computations on a single server. This application uses perl as the CGI scripting language and MATLAB® as the computational language. The use of ascii files for communication between the perl scripts and MATLAB code and for storing error messages greatly simplifies debugging. The system has worked successfully for 12 months and the techniques have been adapted to other applications.

Current Web scripting languages lack an explicit security model. The model proposed in the article has been implemented for JavaScript in the Mozilla browser source code; it is realized by a "safe" interpreter and based on three basic building blocks: access control, to regulate what data a script can access on a user's machine and in what mode; independence of contexts, to ensure that two scripts executing in different contexts (for example, simultaneously in different browser windows or sequentially in the same browser window) cannot access each other's data at will; and trust management, to regulate how trust is established and terminated among scripts executing simultaneously in different contexts. We also advocate a clear separation between a security policy and an implementation. Different users require different degrees of privacy and security, which translate to different degrees of flexibility when interacting with a Web server; these differences can be expressed in different security policies. A sound implementation, however, should be universally applicable. These are principles that first appeared decades ago in work on secure operating systems.

The days of C++-only or Java-only middleware systems are numbered, and dynamic scripting languages will soon become an important part of middleware development. When it comes to Web development, scripting languages such as Perl, Python, Ruby, PHP, and Javascript seem to rule the roost. Java has some presence there as well, of course, in the form of servlets JavaServer Pages and JavaServer Faces, and frameworks such as Struts and Tapestry. Java, and now C#, might also provide a more direct answer to bridging the language divide between middleware and the Web.

The JavaScript scripting language is a simple way of adding interactive functionality to HTML (Hypertext Mark-up Language) pages. In this paper we present the use of JavaScript in two sample quantum-chemical applications, destined primarily for educational purposes. Examples are given in which students are able to enter data and invoke calculations using JavaScript scripts via forms-based interfaces, and follow links to outlines of the theory involved, key equations, and to other pages on the World Wide Web. The performance and potential of interactive scripts in these and wider quantum-chemical applications is discussed.

Scripting is often used in science to create applications via the composition of existing programs. Parallel scripting systems allow the creation of such applications, but each system introduces the need to adopt a somewhat specialized programming model. We present an alternative scripting approach, AMFS Shell, that lets programmers express parallel scripting applications via minor extensions to existing sequential scripting languages, such as Bash, and then execute them in-memory on large-scale computers. We define a small set of commands between the scripts and a parallel scripting runtime system, so that programmers can compose their scripts in a familiar scripting language. The underlying AMFS implements both collective (fast file movement) and functional (transformation based on content) file management. Tasks are handled by AMFS's built-in execution engine. AMFS Shell is expressive enough for a wide range of applications, and the framework can run such applications efficiently on large-scale computers.

Today, many developers try to create a new scripting language to provide scripting features to their own application domain. We proposed The DeSugar parser that provides a flexible means of extending the user-defined syntax by scripting. The goal of the DeSugar parser is to make it easier for users to adopt the language syntax to their own application domain. This paper presents Konoha, which is fully integrated with the DeSugar parser, and which allows users to extend its own syntax through the DeSugar parser scripting interfaces.

Za odlično izvedbo različnih rekreativnih športnih dogodkov je najpomembnejši faktor sistematična priprava in organizacija celotnega dogodka, kot npr. prijava na dogodek, spremljanje udeležencev in sama izvedba prireditve. Aplikacija RECVENTS ponuja rešitev vsem, ki delajo na področju organizacije rekreativnih športnih dogodkov. Glavni poudarek diplomske naloge je na organiziranju dogodkov s pomočjo aplikacije, informiranju o dogodkih s programskim jezikom PHP in spremljanju doseženih rezultatov udeležencev s pomočjo Node.js in Socket.io. Cilj diplomske naloge je izdelati spletno aplikacijo, ki omogoča organizatorjem rekreativnih športnih prireditev enostavnejše in hitrejše organiziranje, publiciranje (reklamiranje) informacij o rekreativnih dogodkih, ter lažji pretok informacij na relacijah organizator-udeleženec in udeleženec-udeleženec. Aplikacija omogoča uporabnikom lažjo in hitrejšo prijavo na dogodek, istočasno pa ponuja tudi spremljanje rezultatov udeležencev športne prireditve v realnem času, njihovo analizo, ter dostop do arhivov o rezultatih udeležencev vseh minulih prireditev. Cilj diplomske naloge je aplikacija, ki omogoča uporabnikom hitro ustvarjanje, dostopanje in komentiranje dogodkov, ter lažji pretok informacij. The most important factor for the excellent performance of the various recreational sporting events is the systematic preparation and organization of the whole event. That includes registration for the event, monitoring of the participants and implementation of the event. RECVENTS application offers a solution for all who work in area of the organization of recreational sports events. The main focus of the diploma work is to organize events using the application, to inform about the events in the programming language PHP and monitoring the performance of the participants using Node.js and Socket.io. The general aim of the diploma work is to create a web application which makes the organization of the recreational sports events simpler and faster, allows a promotion (advertising) of the recreational events, as well as facilitating the flow of information on the basis the organizer-participant and participant-participant. The application allows the users to register for the event easier and faster, while also offers monitoring of the results of the participants sporting events in real time and analyze them. It also allows to the user easy access to the archives which consists of all of the results for all participants in past events. Another aim of this diploma work is also to create an application that allows the users to create, quickly access and comment the events, as well as to facilitate the flow of the information in general.

Web Applications (WAs) are complex systems and it is difficult to understand their architecture without proper documentation. Due to high pressure of meeting deadlines and short time to market, WAs are liable to be poorly structured and are rarely well documented. Even if documentation is present, it often does not comply with code because code is updated without updating documentation. This leads to problems during maintenance. To improve understanding of a system, attempts can be made to recover architecture from the source code by analyzing the relations and dependencies between a system's components. Architecture of WAs revolves around its web pages (WPs). In this paper, we present a tool for extracting relations between WPs within WAs. WAFE is capable of extracting a large number of relations, and uses combination of procedural language analysis and object oriented language analysis along with WP identifiers (name terms). Another important feature of WAFE tool is its language independence i.e. one can make it functional for any server side language by writing a few regular expressions.

The growth of the Internet in recent years has led to the spread of information crimes in renewed and changing ways. This paper is focused on understanding the issues surrounding cross-site scripting attacks and providing a simple and effective security model to protect websites from such attacks using ZEND framework application. The security model is based on a sequence of levels and is built using a combination of tools. Tests against a set of cross-site scripting attacks show the proposed model effectiveness and convenience.

World Wide Web contains an abundant amount of websites which are deemed invalid as they do not adhere to the HTML standards defined under W3C. Websites which are not well-formed may cause performance degradation for some applications and poses compatibility issues with some browsers. Furthermore, it is harder to render a non well formed webpage using state of the art web browsers. Therefore, a wide spectrum of HTML document validation tools are developed to validate HTML pages. However, these tools are able to validate only static based HTML pages, which is a drawback as it is not catered for current state of the art dynamic server side generated pages. To resolve this issue, we propose a novel framework for validating dynamic web applications. In our framework, we develop set of heuristic rules considering the various languages syntax and operation for well known server side languages such as PHP, Java EE, and ASP.NET. Our proposed framework is able to robustly validate dynamic based HTML pages with high efficiency.

A TouchDevelop script appears to the user as statements in a language which is not unlike many other programming languages. This chapter covers the syntax and semantics of that language. The language is augmented by a powerful and rich API (Application Programming Interface), an API which significantly extends the programming capabilities of the TouchDevelop language. The API is covered in the chapters which follow this one.

For increasingly sophisticated use cases an end user needs to extract, combine, and aggregate information from various (often dynamic) web pages from different websites. Current search engines do not focus on combining information from various web pages in order to answer the overall information need of the user. Semantic Web and Linked Data usually take a static view on the data and rely on providers cooperation. Web automation scripts, initially developed for testing websites, allow end users to capture their browsing activities as executable processes and share them with other end users. A script can contain instructions for accessing, extracting and merging (dynamic) information from various websites for a particular purpose. Techniques for allowing users to search for scripts that satisfy complex constraints restrict to existing scripts in the repository, i.e. they do not deduce scripts that may satisfy the request as well. In this paper, we show how semantic descriptions of web sites can be derived from such scripts, and how such semantic descriptions of web sites along with usage information present in the scripts can be used to obtain new scripts with similar functionality.

This chapter examines different types of Web application attacks, which can allow the professional penetration tester to access information within backend databases or access-restricted areas. Common attack vectors discussed within include SQL injection, Cross-Site Scripting, Web application vulnerabilities, and the use of automated tools.

Web applications are constantly under attack. They are popular, typically accessible from anywhere on the Internet, and they can be abused as malware delivery systems.Cross-site scripting flaws are one of the most common types of vulnerabilities that are leveraged to compromise a web application and its users. A large set of cross-site scripting vulnerabilities originates from the browser's confusion between data and code. That is, untrusted data input to the web application is sent to the clients' browser, where it is then interpreted as code and executed. While new applications can be designed with code and data separated from the start, legacy web applications do not have that luxury.This paper presents a novel approach to securing legacy web applications by automatically and statically rewriting an application so that the code and data are clearly separated in its web pages. This transformation protects the application and its users from a large range of server-side cross-site scripting attacks. Moreover, the code and data separation can be efficiently enforced at run time via the Content Security Policy enforcement mechanism available in modern browsers.We implemented our approach in a tool, called deDacota, that operates on binary ASP.NET applications. We demonstrate on six real-world applications that our tool is able to automatically separate code and data, while keeping the application's semantics unchanged.

The power of the hypertext-based information presentation system known as the World-Wide Web can be enhanced by scripts based on thecommon gateway interface (CGI) protocol. CGI scripts residing on a Web server permit the execution of computer programs that can perform a wide variety of functions that may be useful to psychologists. Example applications are presented here, along with reference information for potential script developers.

Constructing server-based Web applications requires creating both Web pages and programs that generate Web pages. This requires a knowledge of the Hypertext Markup Language (HTML), the Common Gateway Interface (CGI) protocol, and a programming language, such as C++, Python, or Perl. While this is not a barrier for programmers, it is for non-programmers. This paper describes WebWriter, an integrated system for constructing Web applications that supports the creation of Web pages by non-programmers. WebWriter includes a direct manipulation Web page editor, the WebWriter Editor, which runs in a Web browser as a CGI service, and the WebWriter Page Generator, which creates new pages as an application runs. As in HyperCard, users create a Web application as a stack of pages, where each page can contain output regions that are filled in at runtime by a script. This paper describes the WebWriter system, issues of server-based authoring tools, and some example applications.

The inclusion of third-party scripts in web pages is a common practice. A recent study has shown that more than half of the Alexa top 10 000 sites include scripts from more than 5 different origins. However, such script inclusions carry risks, as the included scripts operate with the privileges of the including website. We propose JSand, a server-driven but client-side JavaScript sandboxing framework. JSand requires no browser modifications: the sandboxing framework is implemented in JavaScript and is delivered to the browser by the websites that use it. Enforcement is done entirely at the client side: JSand enforces a server-specified policy on included scripts without requiring server-side filtering or rewriting of scripts. Most importantly, JSand is complete: access to all resources is mediated by the sandbox. We describe the design and implementation of JSand, and we show that it is secure, backwards compatible, and that it performs sufficiently well. ispartof: pages:1-10 ispartof: Proceedings of the 28th Annual Computer Security Applications Conference (ACSAC 2012) pages:1-10 ispartof: Annual Computer Security Applications Conference (ACSAC 2012) location:Orlando, Florida, USA date:3 Dec - 7 Dec 2012 status: published

OpenSim is a 3D virtual reality platform and now has been widely used in many fields. Its powerful scripting technology is helpful for third party development. Linden scripting language is the most important scripting language in OpenSim, which only supports virtual worlds' common applications but is weak in domain-specific applications. In order to extend Linden scripting functions, a general extended scheme is proposed in this paper. The structure and rule of OpenSim's scripting engine are analyzed. Then the management mechanisms of thread pool and queue are summed up. We present four extending approaches. Their implementations and scopes of applications are compared. We choose expanding service modules as the general extended scheme. By extending database service of the item bank, scripting functions (e.g., llMakeTest) are developed to support teaching evaluation in 3D virtual learning environments on OpenSim platform. The correctness of the extended scheme is proved by the case study. The scheme provides a guideline for developing Linden scripting functions for specific applications. It is verified that expanding OpenSim's domain-specific applications based on scripting technology is feasible.

Scripting capabilities and application programming interfaces (APIs) are becoming commonly available in modern treatment planning systems. These links to the treatment planning system (TPS) allow users to read data from the TPS, and in some cases use TPS functionality and write data back to the TPS. Such tools are powerful extensions, allowing automation of routine clinical tasks and supporting research, particularly research involving repetitive tasks on large patient populations. The data and functionality exposed by scripting/API capabilities is vendor dependent, as are the languages used by script/API engines, such as the Microsoft .NET framework or Python. Scripts deployed in a clinical environment must be commissioned and validated like any other software tool. This session will provide an overview of scripting applications and a discussion of best practices, followed by a practical introduction to the scripting capabilities of three commercial treatment planning systems. Learning Objectives: 1.Understand the scripting capabilities available in several treatment planning systems 2.Learn how to get started using scripting capabilities 3.Understand the best practices for safe script deployment in a clinical environment R. Popple, Varian Medical Systems has provided research support unrelated to the topic of this session.R. Cardan, Varian Medical Systems for grant research, product evaluation, and teaching honorarium.

Scripting capabilities and application programming interfaces (APIs) are becoming commonly available in modern treatment planning systems. These links to the treatment planning system (TPS) allow users to read data from the TPS, and in some cases use TPS functionality and write data back to the TPS. Such tools are powerful extensions, allowing automation of routine clinical tasks and supporting research, particularly research involving repetitive tasks on large patient populations. The data and functionality exposed by scripting/API capabilities is vendor dependent, as are the languages used by script/API engines, such as the Microsoft .NET framework or Python. Scripts deployed in a clinical environment must be commissioned and validated like any other software tool. This session will provide an overview of scripting applications and a discussion of best practices, followed by a practical introduction to the scripting capabilities of three commercial treatment planning systems. Learning Objectives: 1. Understand the scripting capabilities available in several treatment planning systems 2. Learn how to get started using scripting capabilities 3. Understand the best practices for safe script deployment in a clinical environment R. Popple, Varian Medical Systems has provided research support unrelated to the topic of this session.R. Cardan, Varian Medical Systems for grant research, product evaluation, and teaching honorarium.

Scripting languages have become part of many of the ongoing standards activities related to multimedia. MPEG-4 has considered the inclusion of downloading mechanisms and a set of languages that could include a scripting language. MPEG III has considered the use of DSM-RSF as the reference script language for example decodings. One of the subgroups of the Digital Audio/Visual Council (Davic) could define a scripting language as part of the set-top box application programming interface. And the Hypermedia Languages Special Working Group of ISO JTC1/SCI8/WG8 (the same group responsible for SGML, HyTime, and other broadly applied document processing standards) is developing the Standard Multimedia/Hypermedia Scripting Language.

Acceptance testing is an important part of software development and it is performed to ensure that a system delivers its required functionalities. Today, most modern interactive web applications are designed using Web 2.0 technologies, many among them relying on JavaScript. JavaScript enables the development of client-side functionality through the dynamic modification of the web-page's content and structure without calls to the server. This implies that server-side testing frameworks will necessarily fail to test the complete application behaviors. In this paper we present a method for automated acceptance testing of JavaScript web applications to ensure that required functionalities have been implemented. Using an intuitive, human-readable scripting language our method allows users to describe user stories in high level declarative test scripts and to then execute these test scripts on a web application using an automated website crawler. We also describe a case study that evaluates our approach in terms of capabilities to translate user stories in automated acceptance test scripts.

Web systems undergo constant evolution. This makes them prone to accumulating dead code. In turn, dead code is commonly understood to inhibit software evolution. The only way out of this vicious circle is the careful analysis of the web system, identifying unused features, and eliminating them. However, modern web systems are often built with server side scripting languages such as PHP. Their inherent dynamic features render traditional static dead code identification approaches useless. We describe the technical issues involved in detecting dead PHP code, and propose an identification and removal approach based on dynamic analysis. Further, we describe the examination of our approach in an industry-scale web system, and discuss our lessons learned.

JavaScript is a scripting language that is commonly used to create sophisticated interactive client-side web applications. However, JavaScript code can also be used to exploit vulnerabilities in the web browser and its extensions, and in recent years it has become a major mechanism for web-based malware delivery. In order to avoid detection, attackers often take advantage of the dynamic nature of JavaScript to create highly obfuscated code. This paper describes a semantics-based approach for automatic deobfuscation of JavaScript code. Experiments using a prototype implementation indicate that our approach is able to penetrate multiple layers of complex obfuscations and extract the core logic of the computation, which makes it easier to understand the behavior of the code.

Today's Internet is teeming with dynamic web applications visited by numerous Internet users. During their visits, typical Web users will unknowingly use tens of Rich Internet Applications like Flash banners or media players. For HTML-based web applications, it is well-known that Cross-site Scripting (XSS) vulnerabilities can be exploited to steal credentials or otherwise wreak havoc, and there is a lot of research into solving this problem. An aspect of this problem that seems to have been mostly overlooked by the academic community, is that XSS vulnerabilities also exist in Adobe Flash applications, and are actually easier to exploit because they do not require an enclosing HTML ecosystem. In this paper we present FlashOver, a system to automatically scan Rich Internet Applications for XSS vulnerabilities by using a combination of static and dynamic code analysis that reports no false positives. FlashOver was used in a large-scale experiment to analyze Flash applications found on the top 1,000 Internet sites, exposing XSS vulnerabilities that could compromise 64 of those sites, of which six are in the top 50. ispartof: 7TH ACM SYMPOSIUM ON INFORMATION, COMPUTER AND COMMUNICATIONS SECURITY (ASIACCS 2012) ispartof: AsiaCCS location:Seoul date:2 May - 4 May 2012 status: published

Scripting Languages are often used in order to assist the user in repetitious tasks or when smaller program logics shall be expressed. Normally a scripting language is easier to learn than a programming language so that a wide range of professional developers and end users can use the language for its specific tasks. This paper introduces a specific, small scripting language supporting the deployment of programs as well as the test of distributed control systems. In contrast to existing scripting languages, the language comprises only the required set of instructions and is not too complex and therefore easy to maintain.

An important feature of web search interfaces are the restrictions enforced on input values - those reflecting either the semantics of the data or requirements specific to the interface. Both integrity constraints and "access restrictions" can be of great use to web exploration tools. We demonstrate here a novel technique for discovering constraints that requires no form submissions whatsoever. We work via statically analyzing the JavaScript client-side code used to enforce the constraints, when such code is available. We combine custom recognizers for JavaScript functions relevant to constraint checking with a generic program analysis layer. Integrated with a web browser, our system shows the constraints detected on accessed web forms, and allows a user to see the corresponding JavaScript code fragment.

There is an urgent need for novel programming abstractions to leverage the parallelism in modern multicore machines. We introduce S , a new domain-specific language targeting the server-side scripting of high-performance RESTful Web services. S promotes an innovative programming model based on explicit (control-flow) and implicit (process-level) parallelism control, allowing the service developer to specify which portions of the control-flow should be executed in parallel. For each service, the choice of the best level of parallelism is left to the runtime system. We assess performance and scalability by implementing two non-trivial composite Web services in S . Experiments show that S-based Web services can handle thousands of concurrent client requests on a modern multicore machine.

This chapter illustrates the use of Python scripts to interrogate Pyomo models and customize the optimization process. We present a variety of simple scripts for common analysis activities. We also discuss several advanced scripting topics using examples such as hybrid optimization and Benders decomposition. Together, these scripting examples illustrate how Pyomo users can go beyond the simple use of the pyomo command to formulate and analyze optimization models.

Publisher Summary Perl is an efficient tool for parsing text and pattern matching. There are many cases in the course of a penetration test where one wants to search through directories and the files they contain for some specific text, or text patterns. Perl is also a very useful tool for manipulating text. Perl replicates many of the features and functionality of other text manipulation tools such as sed and awk, and is also capable of passing output to external commands in the operating system if one finds a task Perl cannot handle using its internal set of features. Perl is a great tool for many things, but, like many other scripting languages, it is limited by the environment in which it is designed to function. In order to run a Perl script, one needs to have an interpreter on the system on which it will run, and one is constrained to what can be done with a command-line interface. Perl code can be developed in a variety of tools, from simple editors to specialized integrated development environments (IDEs). One can also make use of additional features, such as the ability to create graphical interfaces for scripts and, through the use of some utilities, compile them into executable binary formats.

Nowadays websites generate dynamic responses to the user requests. This leads them to dynamic web scripting languages. PHP, JSP and ASP.NET are the three most popular web scripting languages in the world. PHP is particularly useful for lightweight web applications. JSP which employs Java in its implementation is useful for the systems which require extra security. ASP.NET which is a Microsoft product combines some of the fine features of both PHP and JSP. All the three languages have pros and cons associated with them. In this paper, we have compared the impacts of these three languages on the performance of a web server. We have described and analyzed the results of conducting experiments on four benchmarks: calculating the factorial of 100, determining whether a random word having 1 million characters is a palindrome or not, sorting a list of 1 million random integers using merge sort, running Dijkstra's algorithm on a graph with 1000 nodes and 5000 edges. We employed famous web servers viz. Apache 2.2.6, Apache Tomcat 6.0.26 and IIS 7.5. We have shown the results using both built-in modules and self-written codes. Moreover, we have used C# with ASP.NET which being an object oriented language provides built-in modules.

This demonstration presents the language design of Konoha-Script, a statically typed object-oriented scripting language. KonohaScript provides the very similar scripting experiences compared to dynamic languages. In addition, it also preserves useful programming supports by static typing, such as automated verification of careless mistakes, improved readability of source code, better opportunity of optimized code generation. This demonstration will show how KonohaScript improved scripting experiences with static typing, using our open source implementation fully written in C.

Scripting vulnerabilities, such as cross-site scripting (XSS), plague web applications today. Most research on defense techniques has focused on securing existing legacy applications written in general-purpose languages, such as Java and PHP. However, recent and emerging applications have widely adopted web templating frameworks that have received little attention in research. Web templating frameworks offer an ideal opportunity to ensure safety against scripting attacks by secure construction, but most of today's frameworks fall short of achieving this goal.We propose a novel and principled type-qualifier based mechanism that can be bolted onto existing web templating frameworks. Our solution permits rich expressiveness in the templating language while achieving backwards compatibility, performance and formal security through a context-sensitive auto-sanitization (CSAS) engine. To demonstrate its practicality, we implement our mechanism in Google Closure Templates, a commercially used open-source templating framework that is used in GMail, Google Docs and other applications. Our approach is fast, precise and retrofits to existing commercially deployed template code without requiring any changes or annotations.

This study aimed to develop a language converter to translate ColdFusion to PHP (Hypertext Preprocessor) codes. ColdFusion and PHP server- side scripting languages each have its own advantages and disadvantages. ColdFusion is a commercial rapid application development platform while PHP is an open-source general-purpose scripting language. Ever since the emergence of open-source software that has led to the downfall of commercial software, several issues have stirred the IT industry. Thus, this research effort intended to address fundamental queries such as the technology conversion from ColdFusion to PHP and the maintenance of semantics codes involving these two scripting languages. The proponents used iterative model to successfully develop the converter basing on the following frameworks: tag parsing, semantic parsing and code generator. Findings revealed that the converter was able to translate ColdFusion into PHP but was delimited into basic syntax. It was evaluated by chosen respondents who were satisfied on the capability of the converter to translate ColdFusion into PHP.

Stealing information from a user’s computer through the Internet is a growing concern. One type of Internet attacks or Cybercrime is Cross-Site Scripting or XSS. It allows an attacker to retrieve information from an Internet user by inserting a script to a vulnerable website where it automatically mines private data from the victim, then sends those data to another website. This study was conducted to examine the different vulnerable aspects of a website. A list of XSS-vulnerable websites was gathered, as well as a list of different XSS scripts. These websites were tested with the XSS scripts to determine the entry point to which the scripts can penetrate. A web proxy application was created which implements different mechanisms to prevent these XSS scripts from successfully mining private data. The web proxy application was able to minimize XSS attacks by comparing the scripts inside the website with the database of XSS scripts. The researchers however, recommend that the process of preventing XSS scripts be improved by adding artificially intelligent algorithms that will read patterns for XSS scripts and distinguish them from safe scripts.

Developers of JavaScript web applications have little tool support for catching errors early in development. In comparison, an abundance of tools exist for statically typed languages, including sophisticated integrated development environments and specialized static analyses. Transferring such technologies to the domain of JavaScript web applications is challenging. In this paper, we discuss the challenges, which include the dynamic aspects of JavaScript and the complex interactions between JavaScript, HTML, and the browser. From this, we present the first static analysis that is capable of reasoning about the flow of control and data in modern JavaScript applications that interact with the HTML DOM and browser API.One application of such a static analysis is to detect type-related and dataflow-related programming errors. We report on experiments with a range of modern web applications, including Chrome Experiments and IE Test Drive applications, to measure the precision and performance of the technique. The experiments indicate that the analysis is able to show absence of errors related to missing object properties and to identify dead and unreachable code. By measuring the precision of the types inferred for object properties, the analysis is precise enough to show that most expressions have unique types. By also producing precise call graphs, the analysis additionally shows that most invocations in the programs are monomorphic. We furthermore study the usefulness of the analysis to detect spelling errors in the code. Despite the encouraging results, not all problems are solved and some of the experiments indicate a potential for improvement, which allows us to identify central remaining challenges and outline directions for future work. Developers of JavaScript web applications have little tool support for catching errors early in development. In comparison, an abundance of tools exist for statically typed languages, including sophisticated integrated development environments and specialized static analyses. Transferring such technologies to the domain of JavaScript web applications is challenging. In this paper, we discuss the challenges, which include the dynamic aspects of JavaScript and the complex interactions between JavaScript, HTML, and the browser. From this, we present the first static analysis that is capable of reasoning about the flow of control and data in modern JavaScript applications that interact with the HTML DOM and browser API. One application of such a static analysis is to detect type-related and dataflow-related programming errors. We report on experiments with a range of modern web applications, including Chrome Experiments and IE Test Drive applications, to measure the precision and performance of the technique. The experiments indicate that the analysis is able to show absence of errors related to missing object properties and to identify dead and unreachable code. By measuring the precision of the types inferred for object properties, the analysis is precise enough to show that most expressions have unique types. By also producing precise call graphs, the analysis additionally shows that most invocations in the programs are monomorphic. We furthermore study the usefulness of the analysis to detect spelling errors in the code. Despite the encouraging results, not all problems are solved and some of the experiments indicate a potential for improvement, which allows us to identify central remaining challenges and outline directions for future work.

Implementing a new programming language system is a daunting task. A common trap is to punt on the design and engineering of exact garbage collection and instead opt for reference counting or conservative garbage collection (GC). For example, AppleScript™, Perl, Python, and PHP implementers chose reference counting (RC) and Ruby chose conservative GC. Although easier to get working, reference counting has terrible performance and conservative GC is inflexible and performs poorly when allocation rates are high. However, high performance GC is central to performance for managed languages and only becoming more critical due to relatively lower memory bandwidth and higher memory latency of modern architectures. Unfortunately, retrofitting support for high performance collectors later is a formidable software engineering task due to their exact nature. Whether they realize it or not, implementers have three routes: (1) forge ahead with reference counting or conservative GC, and worry about the consequences later; (2) build the language on top of an existing managed runtime with exact GC, and tune the GC to scripting language workloads; or (3) engineer exact GC from the ground up and enjoy the correctness and performance benefits sooner rather than later.We explore this conundrum using PHP, the most popular server side scripting language. PHP implements reference counting, mirroring scripting languages before it. Because reference counting is incomplete, the implementors must (a) also implement tracing to detect cyclic garbage, or (b) prohibit cyclic data structures, or (c) never reclaim cyclic garbage. PHP chose (a), AppleScript chose (b), and Perl chose (c). We characterize the memory behavior of five typical PHP programs to determine whether their implementation choice was a good one in light of the growing demand for high performance PHP. The memory behavior of these PHP programs is similar to other managed languages, such as Java™ ---they allocate many short lived objects, a large variety of object sizes, and the average allocated object size is small. These characteristics suggest copying generational GC will attain high performance.Language implementers who are serious about correctness and performance need to understand deferred gratification: paying the software engineering cost of exact GC up front will deliver correctness and memory system performance later.

A typical Web 2.0 application usually includes JavaScript from various sources with different trust. It is critical to properly regulate JavaScript's access to web application resources. Unfortunately, existing protection mechanisms in web browsers do not provide enough granularity in JavaScript access control. Specifically, existing solutions partially mitigate this sort of threat by only providing access control for certain types of JavaScript objects, or by unnecessarily restricting the functionality of untrusted JavaScript. In this paper, we systematically analyze the complete access control requirements in a web browser's JavaScript environment and identify the fundamental lack of fine-grained JavaScript access control mechanisms in modern web browsers. As our solution, we propose a reference monitor called JCShadow that enables fine-grained access control in JavaScript contexts without unnecessarily restricting the functionality of JavaScript. We have developed a proof-of-concept prototype in the Mozilla Firefox browser and the evaluation with real-world attacks indicates that JCShadow effectively prevents such attacks with low performance overhead.

In recent years, web applications have become tremendously popular. However, vulnerabilities are pervasive resulting in exposure of organizations and firms to a wide array of risks. SQL injection attacks, which has been ranked at the top in web application attack mechanisms used by hackers can potentially result in unauthorized access to confidential information stored in a backend database and the hackers can take advantages due to flawed design, improper coding practices, improper validations of user input, configuration errors, or other weaknesses in the infrastructure. Whereas using cross-site scripting techniques, miscreants can hijack Web sessions, and craft credible phishing sites. In this paper we have made a survey on different techniques to prevent SQLi and XSS attacks and we proposed a solution to detect and prevent against the malicious attacks over the developer's Web Application written in programming languages like PHP, ASP.NET and JSP also we have created an API (Application Programming Interface) in native language through which transactions and interactions are sent to IDS Server through Inter Server Communication Mechanism. This IDS Server which is developed from PHPIDS, a purely PHP based intrusion detection system and has a system architecture meant only for PHP application detects and prevents attacks like SQLi (SQL Injection) and XSS(Cross-site scripting), LFI(Local File Inclusion), and RFE(Remote File Execution) and returns back the result to the Web Application and logs the intrusions. In addition to this behavioural pattern of Web Logs is analysed using WAPT algorithm (Web Access Pattern Tree), which helps in recording the activity of the web application and examines any suspicious behaviour, uncommon patterns of behaviour over a period of time, and it also monitors the increased activity and known attack variants. Based on this an report is generated dynamically using P-Chart which can help the Website owner to increase the security measures, and also used to improve the quality of the Web Application.

Many web pages display personal information provided by users. The goal of this work is to protect that content from untrusted scripts that are embedded in host pages. We present a browser modification that provides fine-grained control over what parts of a document are visible to different scripts, and executes untrusted scripts in isolated environments where private information is not accessible. To ease deployment, we present a method for automatically inferring what nodes in a web page contain private content. This paper describes how we modify the Chromium browser to enforce newly defined security policies, presents our automatic policy generation method, and reports on experiments inferring and enforcing privacy policies for a variety of web applications.

This chapter will take a look at how to use Python to accomplish different utility tasks with SL4A. On a typical PC, these would fall into the command-line utility class of programs.

We describe a scripting language for smart space applications based on the OWL Web Ontology Language. The design goals of the scripting language are: I. A syntax that easily expresses common script applications for smart spaces. II. Based on OWL to enable synergy with semantic web technologies. III. Ease of implementation by using existing OWL reasoners. We motivate the design of the scripting language and give some examples of how to use it. Furthermore, we will give a formal definition of the syntax and semantics of the scripting language based on the OWL 2 definition.

Database based Web applications have been widely incorporated on the Internet and organizations use these services to provide a broad range of services to people. Along with the growing of the internet, there has been a surge in attacks that target these applications. In typical cross site scripting the target views a website which contains code inserted into the HTML which was not written by the website designer or administrator. This bypasses the document object model which was intended to protect domain specific cookies (sessions, settings, etc.). In most instances the target will sent a link to a website on the server which the target has a legitimate account and by viewing that website the attackers malicious code is executed (commonly JavaScript is used to sent the user's cookie to a third party server, in effect stealing their session and their account). This was a quick overview of cross site scripting. The purpose of this document is to avoid/Mitigate cross site scripting attacks which are very popularly used by hackers nowadays. This type of computer security vulnerability typically found in web applications that enables malicious attackers to inject client-side script into web pages viewed by other users. By this document we are trying to mitigate XSS attack on server side using signature based model for the better security of Website's owner.

This chapter contains sections titled: How Does It Work? Instructions Operators Mathematical Functions Data Types Constants Variables ]]>

The technology base for modern computer games is usually provided by a game engine. Many game engines have built-in dedicated scripting languages that allow the development of complete games that are built using those engines, as well as extensive modification of existing games through scripting alone. While some of these game engines implement proprietary languages, others use existing scripting systems that have been modified according to the game engine's requirements. Scripting languages generally provide a very high level of abstraction method for syntactically controlling the behaviour of their host applications and different types of scripting system allow different types of modification of their underlying host application. In this paper we propose a simple classification for scripting systems used in computer games for entertainment and serious purposes.

SQL Injection vulnerability is ranked 1st in the OWASP1 top 10 vulnerability list and has resulted in massive attacks on a number of websites in the past few years. Inspite of preventive measures like educating developers about safe coding practices, statistics shows that these vulnerabilities are still dominating the top. Various static and dynamic approaches have been proposed to mitigate this vulnerability. In this paper, we present a hybrid approach to prevent SQL injection attacks in PHP, a popular server side scripting language. This technique is more effective to prevent SQL injection attack in a dynamic web content environment without use of complex string analyzer logic. Initially, we construct a Query model for each hotspot by running the application in safe mode. In the production environment, dynamically generated queries are validated with it. The results and analysis shows the proposed approach is simple and effective to prevent common SQL injection vulnerabilities.