Search

The Internet of Things (IoT), a booming technology, will change the way we look at the world today. IoT-based solutions facilitate business by improving and simplifying tasks. The IoT consists of a huge number of sensors, each with a unique address, grouped to form a network entity that exchanges data internally or with other internetworks and intranetworks, using different internet protocols. The main aim of the proposed system is to design a Wi-Fi controlled robotic car that can be used for surveillance applications. A complete description of the block diagram, the flow chart, and the working of the proposed system are discussed in the following sections. Geared DC motors are used to direct the movement of the spy-bot. The HTML scripting language is used to design our webpage, a platform through which we can access the spy-bot. The spy-bot can be compliant for military purposes in remotely monitoring intrusions along the border.

In present-day time, securing the web application against hacking is a big challenge. One of the common types of hacking technique to attack the web application is Cross-Site Scripting (XSS). Cross-Site Scripting (XSS) vulnerabilities are being exploited by the attackers to steal web browser’s resources such as cookies, credentials etc. by injecting the malicious JavaScript code on the victim’s web applications. Since Web browsers support the execution of commands embedded in Web pages to enable dynamic Web pages attackers can make use of this feature to enforce the execution of malicious code in a user’s Web browser. The analysis of detection and prevention of Cross-Site Scripting (XSS) help to avoid this type of attack. We describe a technique to detect and prevent this ki nd of manipulation and hence eliminate Cross-Site Scripting attack.

A web page is a digital document created using Hyper Text Markup Language (HTML). A Web page is suitable for World Wide Web (WWW), which runs on a web browser and hence can be accessed across the globe. Graphical User Interface (GUI) is an interface, which provides ways for humans to interact with the system using HTML controls. In software design, look and feel of GUI comprises design aspects of the web page, the layout of the web page, HTML controls used on the web page, etc. Usually creation of a web page begins by drawing GUI design on a paper first. Web designers then design the web pages using web development tool on the paper. This paper proposes a novel approach to create HTML page automatically from the GUI design drawn on the paper. It considers a GUI design having various HTML controls such as radio button, checkbox, textbox, command button and label. A scanned image of GUI design is provided as an input to the system. Then, system segments the various HTML controls. The segmented HTML controls are then identified. Identified HTML controls are stored in XML database. Actually, XML database contains the name and position of the component on the GUI design. Finally, this XML file is parsed to generate HTML page.

This paper proposed an automatic transformation technical solution for behavior control scripting languages. The solution automatically converts VBA scripting language into JavaScript scripting language. It implements automatic transformation by analyzing and comparing differences in the use of different grammatical of VBA scripts and JavaScript scripts such as data types, control structures, form controls and add-ins Etc. To ensure the accuracy and completeness of conversion the solution generates an abstract syntax tree which represents call and transitive relation between functions. Compared with the conversion tools the solution can reduce repeated manpower and improve productivity.

HTML, an ellipsis for Hypertext Markup Language, is meant exclusively for Web browsers. Apart from contents, it also includes information pertaining to their respective layout and format within its body. Any ASCII Text file can easily be converted into HTML file format by adding TAGs (called elements of HTML) to it and saving it with an ‘.html’ file extension. HTML TAGs are language-specific reserve words enclosed in ‘angle brackets’ that in general come in pair referred to as ‘start’ and ‘end tag’. Most importantly, HTML TAGs are case insensitive and allow for their structuring/re-ordering in a variety of ways. A Web browser is a software application that understands the HTML file format and displays its contents excluding TAGs according to the format specified in TAGs, if any. Web browser is responsible for traversing and retrieving Web resources on the Internet and presenting it before the end user. Hence, HTML documents seem an ideal cover for hiding secret information, as regardless of the manner HTML TAGs are manipulated within language constraints, the appearance of Web page before the human eye remains impervious. This paper introduces its reader to a novel digital steganographic method for hiding information inside the HTML document by changing the ‘case’ of English alphabet within HTML TAGs. The distinct characteristics of our proposed method in contrast to its antecedent include increased data-hiding capacity of the information carrier (HTML cover) and impermeable perceptibility of the altered carrier (HTML stego object), besides inducing randomness (concept supported by information theory) just before bit embedding ensues.

Ability to create web page is one of basic IT skills. In the web page creation learning process is student's final project often evaluated on code validity and code cleanness. There is also one problem that cannot be easily handled – recognizing modified projects. Concept of HTML and CSS allows to separate visual form from content. One project can be easily transformed into new visual form in a few steps. This paper is focused on solving this problem by computer automation. The basic idea is that inner structure of web page will be the same or very similar. Web page (HTML document) can be represented as a tree, where nodes are HTML elements. Paper describes basic ways how can be html tree structure compared with another html tree structure automatically by using tree algorithms. Result of this comparison is html structure tree similarity. Paper covers description of algorithms, implementation and testing.

Cross site scripting (XSS) is a common security problem of web applications where an attacker can inject scripting code into the output of the application that is then sent to a user's web browser. In the web browser, this scripting code is executed and used to transfer sensitive data to a third-party. Today's solutions attempt to prevent XSS on the server side, for example, by inspecting and modifying the data sent to and from the web application. The presented solution, on the other hand, stops XSS attacks on the browser/ client side by tracking the use of sensitive information in the JavaScript engine of the web browser. If sensitive information is about to be transferred to a third party, the user can decide if this should be allowed or not. The existing client- side solutions degrade the performance of client's system resulting in a poor web surfing experience. In this project provides a client side solution that uses a step by step approach to protect cross site scripting, without degrading much the user's web browsing experience.

JSPChecker is a static analysis tool that detects context-sensitive cross-site scripting vulnerabilities in legacy web applications. While cross-site scripting flaws can be mitigated through sanitisation, a process that removes dangerous characters from input values, proper sanitisation requires knowledge about the output context of input values. Indeed, web pages are built using a mix of different languages (e.g. HTML, CSS, JavaScript and others) that call for different sanitisation routines. Context-sensitive cross-site scripting vulnerabilities occur when there is a mismatch between sanitisation routines and output contexts.JSPChecker uses data-flow analysis to track the sanitisation routines that are applied to an input value, a combination of string analysis and fault-tolerant parsing to approximate the output context of sanitised values, and uses this information to detect context-sensitive cross-site scripting vulnerabilities. We demonstrate the effectiveness of our approach by analysing five open-source applications and showing how JSPChecker can identify several context-sensitive XSS flaws in real world applications with a precision ranging from 96% to 100%.

Cross Site Scripting (XSS) and clickjacking have been ranked among the top web application threats in recent times. This paper introduces XBuster — our client-side defence against XSS, implemented as an extension to the Mozilla Firefox browser. XBuster splits each HTTP request parameter into HTML and JavaScript contexts and stores them separately. It searches for both contexts in the HTTP response and handles each context type differently. It defends against all XSS attack vectors including partial script injection, attribute injection and HTML injection. Also, existing XSS filters may inadvertently disable frame busting code used in web pages as a defence against clickjacking. However, XBuster has been designed to detect and neutralize such attempts.

Now let’s discuss the tag in HTML5. It allows you to use the JavaScript programming language with your HTML5 content creation pipeline (markup, design, programming, and publishing). The JavaScript language is based on ECMAScript 262.

In modeling and simulation it is often necessary to simulate a model with a variety of settings and evaluate the simulation results with measured data or previously acquired results. As doing this manually is error-prone and ineffective, scripting languages are often used to automate this process. In general a simulation description is tool and model dependent. Therefore, simulating the same model with the same simulation description in different simulation tools or comparing two different models with the same settings is often not easily achieved. We propose an object-oriented, tool-independent, easy-to-use, domain-specific scripting language to describe simulations in an exchangeable and uniform manner. Through this simulation description the simulation settings and the simulation environment can easily be changed while syntax and sequence of commands remain the same. The language is Python based and is designed to be simple, well-readable and intuitive even with marginal programming experience while maintaining Pythons’ strength. The language uses an in-house Python library which provides interfaces to different simulation environments (so far Dymola, OpenModelica, Simulink). This library can also be used directly in Python, enabling experienced Python users to keep describing their simulations in Python but benefiting from our efforts to achieve tool-independence.

The high-profile attacks of malicious HTML and JavaScript code have seen a dramatic increase in both awareness and exploitation in recent years. Unfortunately, exiting security mechanisms provide no enough protection. We propose a new protection mechanism named PMHJ based on the support of both web applications and web browsers against malicious HTML and JavaScript code in vulnerable web applications. PMHJ prevents the injection attack of HTML elements with a random attribute value and the node-split attack by an attribute with the hash value of the HTML element. PMHJ ensures the content security in web pages by verifying HTML elements, confining the insecure HTML usages which can be exploited by attackers, and disabling the JavaScript APIs which may incur injection vulnerabilities. PMHJ provides a flexible way to rein the high-risk JavaScript APIs with powerful ability according to the principle of least authority. The PMHJ policy is easy to be deployed into real-world web applications. The test results show that PMHJ has little influence on the run time and code size of web pages.

peer-reviewed Although scripting languages have become very popular, even mature scripting language implementations remain interpreted. Several compilers and reimplementations have been attempted, generally focusing on performance. Based on our survey of these reimplementations, we determine that there are three important features of scripting languages that are difficult to compile or reimplement. Since scripting languages are defined primarily through the semantics of their original implementations, they often change semantics between releases. They provide C APIs, used both for foreign-function interfaces and to write third-party extensions. These APIs typically have tight integration with the original implementation, and are used to provide large standard libraries, which are difficult to re-use, and costly to reimplement. Finally, they support run-time code generation. These features make it difficult to design a fully compatible compiler. We present a technique to support these features in an ahead-of-time compiler for PHP. Our technique uses the original PHP implementation through the provided C API, both in our compiler and in our generated code. We support all of these important scripting language features. Additionally, our approach allows us to automatically support limited future language changes. We present a discussion and performance evaluation of this technique.

Cross-Site Scripting is one of the main problems of any Web-based service. Since Web browsers support the execution of commands embedded in Web pages to enable dynamic Web pages attackers can make use of this feature to enforce the execution of malicious code in a user’s Web browser. To augment the users’ experience many web applications are using client side scripting languages such as JavaScript but this growing of JavaScript is increasing serious security vulnerabilities in web application too, such as cross-site scripting (XSS). In this paper, I survey all the techniques those have been used to detect XSS and arrange a number of analyses to evaluate performances of those methodologies.

Collaboration scripts are usually implemented as parts of a particular collaborative-learning platform. Therefore, scripts of demonstrated effectiveness are hardly used with learning platforms at other sites, and replication studies are rare. The approach of a platform-independent description language for scripts that allows for easy implementation of the same script on different platforms has not succeeded yet in making the transfer of scripts feasible. We present an alternative solution that treats the problem as a special case of providing support on top of diverse Web pages: In this case, the challenge is to trigger support based on the recognition of a Web page as belonging to a specific type of functionally equivalent pages such as the search query form or the results page of a search engine. The solution suggested has been implemented by means of a tool called S-COL (Scripting for Collaborative Online Learning) and allows for the sustainable development of scripts and scaffolds that can be used with a broad variety of content and platforms. The tool’s functions are described. In order to demonstrate the feasibility and ease of script reuse with S-COL, we describe the flexible re-implementation of a collaboration script for argumentation in S-COL and its adaptation to different learning platforms. To demonstrate that a collaboration script implemented in S-COL can actually foster learning, an empirical study about the effects of a specific script for collaborative online search on learning activities is presented. The further potentials and the limitations of the S-COL approach are discussed.

Web applications are becoming the dominant way to provide access to online services. At the same time, web application vulnerabilities are being discovered and disclosed at an alarming rate. Web applications often make use of JavaScript code that is embedded into web pages to support dynamic client-side behavior. This script code is executed in the context of the user's web browser. To protect the user's environment from malicious JavaScript code, browsers use a sand-boxing mechanism that limits a script to access only resources associated with its origin site. Unfortunately, these security mechanisms fail if a user can be lured into downloading malicious JavaScript code from an intermediate, trusted site. In this case, the malicious script is granted full access to all resources (e.g., authentication tokens and cookies) that belong to the trusted site. Such attacks are called cross-site scripting (XSS) attacks. In general, XSS attacks are easy to execute, but difficult to detect and prevent. One reason is the high flexibility of HTML encoding schemes, offering the attacker many possibilities for circumventing server-side input filters that should prevent malicious scripts from being injected into trusted sites. Also, devising a client-side solution is not easy because of the difficulty of identifying JavaScript code as being malicious. This paper presents Noxes, which is, to the best of our knowledge, the first client-side solution to mitigate cross-site scripting attacks. Noxes acts as a web proxy and uses both manual and automatically generated rules to mitigate possible cross-site scripting attempts. Noxes effectively protects against information leakage from the user's environment while requiring minimal user interaction and customization effort.

Web pages often embed scripts for a variety of purposes, including advertising and dynamic interaction. Understanding embedded scripts and their purpose can often help to interpret or provide crucial information about the web page. We have developed a functionality-based categorization of JavaScript, the most widely used web page scripting language. We then view understanding embedded scripts as a text categorization problem. We show how traditional information retrieval methods can be augmented with the features distilled from the domain knowledge of JavaScript and software analysis to improve classification performance. We perform experiments on the standard WT10G web page corpus, and show that our techniques eliminate over 50% of errors over a standard text classification baseline.

This paper tackles a scripting problem associated with script tasks in BPMN modeling. Usually a BPMN process modeling tool provides a plain text editor without any assisting features for writing a script for a BPMN script task. This is not very convenient even for skilled programmers. There is also a limitation on exporting the script written in one language to different process modeling and execution runtimes that support other scripting languages. To provide easy-to-use and platform-independent scripting, we present a visual block programming editor for defining a visual script for a BPMN script task. The internal representation of the visual script is an XML-based business process script, or XBPScript, from which executable scripts for different target runtimes can be generated. This paper discusses, in particular, how the editor supports a complex function block that can be used in building a script. It also discusses, as an example, how to integrate the visual editor and XBPScript with open source business process management software. An evaluation of the visual editor productivity in comparison with plain text editing is presented.

There are many criteria that could be used as the basis for the selection of server side scripting that could be applied to the school information system. This study compares several server side scripting that could be applied the school information system. Those server side scripting are ASP, JSP, PHP, Python, and Ruby. This research refers to research done by Oyku Alanbay regarding the selection of softwares. In addition, using the theories regarding the quality of the software as the basis for the determination of selection sub criteria server side scripting to the school information system. In the selection of server side scripting for this school information system with three levels of criteria. As for the level 1 criteria is technology related, user related, and vendor related, level 2 criterion consists of 18 sub criteria obtained from the special advantages for server side scripting. And level 3 there are five alternatives is ASP, JSP, PHP, Python, and Ruby. In the selection of server side scripting for this school information systems using Analytical Hierarchy Process (AHP) and the tool uses Expert Choice 2000. The results of this election make PHP as server side scripting needs compared to ASP, JSP, Python, and Ruby with 40.6% weighting values with the most influential factor was 60.4% of the user related.

Avast amount of information about shell scripting is on the Internet. One of the most useful, and where one can learned a great deal, is the Usenet newsgroup comp.unix.shell. Its archives can be searched at http://groups-beta.google.com/group/comp.unix.shell , but for posting, using your own newsreader is recommended over the Google form. There’s no shortage of newsreaders, both text based and GUI: tin, slrn, and pan to name a few, as well as combined mail and newsreaders, such as pine and Mozilla Thunderbird.

Add-on JavaScript originating from users’ inputs to the browser brings new functionalities such as debugging and entertainment, however it also leads to a new type of cross-site scripting attack (defined as add-on XSS by us), which consists of two parts: a snippet of JavaScript in clear text, and a spamming sentence enticing benign users to input the previous JavaScript. In this paper, we focus on the most common add-on XSS, the one caused by browser address bar JavaScript. To measure the severity, we conduct three experiments: (i) analysis on real-world traces from two large social networks, (ii) a user study by means of recruiting Amazon Mechanical Turks [4], and (iii) a Facebook experiment with a fake account. We believe as the first systematic and scientific study, our paper can ring a bell for all the browser vendors and shed a light for future researchers to find an appropriate solution for add-on XSS.

A prototype scripting language was introduced in 2002 to assist the blind in creating forms for Visual Basic programs in a much simpler fashion; currently, creating these forms are particularly difficult for the blind and visually impaired. The language is expanded to include the Visual Basic objects that were omitted from the original grammar for the scripting language. A second prototype of the compiler for the scripting language is now available online. An example and a formal grammar are included.

This paper attempts to provide insight as to how to guarantee a statement like: My PHP script produces WML. To expand a little, the emphasis is to ensure that a script always produces a valid WML page. The context is where pages in a web-site are being created by an embedded scripting language (like PHP, ASP, Perl) and also that the resulting pages are to conform to a strict tagged mark-up scheme like WML or XHTML. Although there are validators for static pages there is nothing available to check that a page containing embedded scripting will (always) generate valid documents. What is required is a validator for dynamic web pages.

Like many of us, your application probably started out small. you had several subroutines you used daily, and over time, other people started using them as well. the more people used your subroutines, however, the more changes and additions became inevitable. To satisfy all the demands, you decide that adding scripting capability to your application was the answer, but what's the best approach? I picked COM (the Component Object Model) to implement scripting capability in Shvib for Windows. Shvib is a shock and vibration analysis program based on Tom Derby's Fortran subroutines that I have been developing at Barry Controls. Freely and commercially available scripting languages abound out there, but after investigating some of them, I decided to use Python as a scripting language for Shvib. Shvib has a Visual Basic 6 GUI and several Fortran subroutines compiled as Windows DLLs to perform computations. Because Shvib is a Windows application, COM was the natural choice to glue the Visual Basic GUI, the Fortran DLLs, and Python scripting together.

A script task is an executable element of a BPMN process model. It is a task that executes an associated script written in a particular scripting language. Most existing process modeling tools provide text editors for scripting without any code assist features. It is therefore not so easy for process modelers who may not have the required programming skills to write scripts. Moreover, a process model associated with a script written in a particular language can be executed only on certain process execution engines that support such a language. To make a script task easier to define as well as portable, this paper presents a method to create a script for a BPMN script task using visual programming. A process modeler can conveniently use the visual script building blocks to compose a script. The visual script is then transformed into an XML-based Business Process Script or XBPScript that is a common representation of computation logic among scripting languages. This XBPScript will be associated with a script task instead of a language-specific script. This makes the script portable as it can be generated later into an executable script of a language that is supported by the target process execution engine during process deployment.

Dynamic web pages are widely used by web applications to provide better user experience and to attract more web users. The web applications use the client side and server side scripts to provide dynamic behavior to the web pages. Cross-Site Scripting (XSS) attack uses malicious scripts and links injected into the trusted web pages to steal sensitive data from the victims. In this paper, we present the experimental results obtained using three machine learning algorithms (Naive Bayes, Support Vector Machine and J48 Decision Tree) for the prediction of Cross-site scripting attack. This is done using the features based on normal and malicious URLs and JavaScript. J48 gave better results than Naive Bayes and Support Vector Machine based on the features extracted from URL and Java Script code. All the algorithms gave comparatively better results with discretized attributes but noticeable difference in performance was seen only in the case of SVM.

Cross-Site Scripting (XSS) is a common attack technique that lets attackers insert the code in the output application of web page which is referred to the web browser of visitor and then the inserted code executes automatically and steals the sensitive information. In order to prevent the users from XSS attack, many client- side solutions have been implemented; most of them being used are the filters that sanitize the malicious input. However, many of these filters do not provide prevention to the newly designed sophisticated attacks such as multiple points of injection, injection into script etc. This paper proposes and implements an approach based on encoding unfiltered reflections for detecting vulnerable web applications which can be exploited using above mentioned sophisticated attacks. Results prove that the proposed approach provides accurate higher detection rate of exploits. In addition to this, an implementation of blocking the execution of malicious scripts have contributed to XSS-Me: an open source Mozilla Firefox security extension that detects for reflected XSS vulnerabilities which can be considered as an effective solution if it is integrated inside the browser rather than being enforced as an extension.

The purpose of this paper is to propose a method for protecting HTML content from unauthorized reuse. A document protected using this method can still be viewed with a standard text editor, but it is virtually impossible to modify, and is therefore unattractive for redistribution. Existing obfuscation methods and restriction codes that limit certain activities in the web browser are less effective due to fundamental problems of circumvention. Not only does our method address these problems using internal reconstruction of obfuscated text, but it also maintains full accessibility to web content. We begin by specifying the HOTDOL (HTML Obfuscation with Text Distribution to Overlapping Layers) standard, under which a document maintains its general layout but has its internal representation of HTML transformed into illegible text. We then suggest three alternative service architectures through which HOTDOL can be applied to existing web services. We performed a quantitative evaluation in the form of an offline survey with 12 questions, confirming the protectiveness of our method relative to other methods currently in use. To assess the computational efficiency of our method, we also measured the processing and rendering times for obfuscated documents in real environments, and found them to be commercially viable.

Web scripting enables users to automate interactions with websites. Online open source repositories provide scripts available for reuse. Yet just because these scripts are open source does not mean they are all reusable: many are specialized and irrelevant to most peoples' needs, while others are hard to understand or learn from. Repositories offer keyword-based search engines to find scripts relevant to specialized needs, but they lack any means for filtering search results according to reusability. To address this shortcoming, we present an approach for creating a model to automatically estimate the reusability of web automation scripts. To test this approach, we prototyped a search engine that uses these reusability estimates to sort one particular kind of web automation scripts, CoScripter macros, according to reusability. An empirical evaluation confirmed that the system's reusability estimates are significantly correlated with user perceptions of macro reusability, thus implying that our approach presents a viable means for helping end-user programmers to find reusable web automation scripts. Keywords—reuse; end-user programming; scripting

JavaScript is a scripting language, of course. The drawbacks and benefits of scripting languages compared to full-fledged programming languages have been explored before. In a previous installment of this column, Diomidis Spinellis points out that with scripting languages, users can benefit from flexible syntax, loose type systems, powerful reflection mechanisms, and shorter build cycles. Scripting languages have proven their usefulness in various application areas. Unix relies heavily on shell scripting to accomplish many complex tasks. Visual Basic, in combination with ActiveX, provides a low-entry barrier into the world of component-based programming. Tcl/Tk is still popular to rapidly develop GUI-based applications. And then there's JavaScript, which has gained considerable importance in realizing clientside functionality on Web apps. In a survey on the most popular programming languages, JavaScript made it to the Top 10.

Web servers are increasingly being used to deliver dynamic content rather than static HTML pages. In order to generate web pages dynamically, servers need to execute a script, which typically connects to a DBMS. Although CGI was the first approach at server side scripting, it has significant performance shortcomings. Currently, there are many alternative server side scripting architectures which offer better performance than CGI. In this paper, we report our experiences using mod_perl , an Apache Server module, which can improve the performance of CGI scripts by at least an order of magnitude. Except for presenting results from our experiments, we also briefly describe the implementation of an industrial strength database-backed web site that we recently built and give a quick overview of the various server-side scripting mechanisms.

In Gem #52, we saw various facilities that GNAT provides to make Ada a scripting language (sort of). We discussed GNAT.Command_Line, GNATCOLL.Mmap, GNAT.Regpat and GNAT.AWK. This Gem continues the discussion of scripting capabilities, and focuses on interaction with external processes.

Current Web scripting languages lack an explicit security model. The model proposed in the article has been implemented for JavaScript in the Mozilla browser source code; it is realized by a "safe" interpreter and based on three basic building blocks: access control, to regulate what data a script can access on a user's machine and in what mode; independence of contexts, to ensure that two scripts executing in different contexts (for example, simultaneously in different browser windows or sequentially in the same browser window) cannot access each other's data at will; and trust management, to regulate how trust is established and terminated among scripts executing simultaneously in different contexts. We also advocate a clear separation between a security policy and an implementation. Different users require different degrees of privacy and security, which translate to different degrees of flexibility when interacting with a Web server; these differences can be expressed in different security policies. A sound implementation, however, should be universally applicable. These are principles that first appeared decades ago in work on secure operating systems.

Displets provide authors and programmers with a way to freely extend the HTML language on a per-document basis in a principled manner. Currently, in order to be accepted, HTML elements must be approved by the official HTML review board. Non-standard extensions have appeared, and have relied on the commercial power of the proponents for acceptance. Two major forces are driving the extension process of the HTML language: those who favor a better description of document elements, as with SGML, and those who would like better control over the final appearance of documents, as with Postscript and other display-oriented languages. Special notations (such as mathematics, music, etc.), are hardly considered—if at all—in defining the HTML standard. We designed displets to fill this frustrating gap. Displets are Java classes that are activated while rendering an HTML document. Displets provide graphical artists a better control over the final appearance of HTML documents, librarians and indexers a better description of their content, and those in need of new notations a way to describe and use graphical objects in a manner compatible with the graphical and structural habits of the HTML community.

Scripting is often used in science to create applications via the composition of existing programs. Parallel scripting systems allow the creation of such applications, but each system introduces the need to adopt a somewhat specialized programming model. We present an alternative scripting approach, AMFS Shell, that lets programmers express parallel scripting applications via minor extensions to existing sequential scripting languages, such as Bash, and then execute them in-memory on large-scale computers. We define a small set of commands between the scripts and a parallel scripting runtime system, so that programmers can compose their scripts in a familiar scripting language. The underlying AMFS implements both collective (fast file movement) and functional (transformation based on content) file management. Tasks are handled by AMFS's built-in execution engine. AMFS Shell is expressive enough for a wide range of applications, and the framework can run such applications efficiently on large-scale computers.

Today, many developers try to create a new scripting language to provide scripting features to their own application domain. We proposed The DeSugar parser that provides a flexible means of extending the user-defined syntax by scripting. The goal of the DeSugar parser is to make it easier for users to adopt the language syntax to their own application domain. This paper presents Konoha, which is fully integrated with the DeSugar parser, and which allows users to extend its own syntax through the DeSugar parser scripting interfaces.

A TouchDevelop script appears to the user as statements in a language which is not unlike many other programming languages. This chapter covers the syntax and semantics of that language. The language is augmented by a powerful and rich API (Application Programming Interface), an API which significantly extends the programming capabilities of the TouchDevelop language. The API is covered in the chapters which follow this one.

Web applications are constantly under attack. They are popular, typically accessible from anywhere on the Internet, and they can be abused as malware delivery systems.Cross-site scripting flaws are one of the most common types of vulnerabilities that are leveraged to compromise a web application and its users. A large set of cross-site scripting vulnerabilities originates from the browser's confusion between data and code. That is, untrusted data input to the web application is sent to the clients' browser, where it is then interpreted as code and executed. While new applications can be designed with code and data separated from the start, legacy web applications do not have that luxury.This paper presents a novel approach to securing legacy web applications by automatically and statically rewriting an application so that the code and data are clearly separated in its web pages. This transformation protects the application and its users from a large range of server-side cross-site scripting attacks. Moreover, the code and data separation can be efficiently enforced at run time via the Content Security Policy enforcement mechanism available in modern browsers.We implemented our approach in a tool, called deDacota, that operates on binary ASP.NET applications. We demonstrate on six real-world applications that our tool is able to automatically separate code and data, while keeping the application's semantics unchanged.

Among the dozen most popular applications on the Internet, the World Wide Web (WWW) is showing the fastest growth. Its power comes from a simple but powerful documentation language, HyperText Markup Language. In this paper we propose a knowledge-based approach and schema to facilitate the creation and maintenance of HTML-based documentation for a set of documents whose content is partially derived from other information souses, such as databases. We denote the system as the Knowledge-Based HTML Document Generator (KHDG). The basic idea is to use regularly updated information on information servers, such as databases, as the major source of knowledge for KHDG. Analyzing and authoring expertise are employed as rules for reasoning about the construction of HTML documents and their interrelationships. The index information about reusable document components is maintained in the Document Catalog Base (DCB). This scheme makes the components stored in distributed repository consistent and easy to integrate. KHDG produces the HTML document in a threestep process: source information analysis and extraction, HTML document planning and HTML page generation. The implementation of the system is based on CGI scripting in a Windows web server. We suggest that the approach utilized in KHDG is capable of automating routine HTML document generation and maintenance based on regularly updated databases.

Scripting languages have become part of many of the ongoing standards activities related to multimedia. MPEG-4 has considered the inclusion of downloading mechanisms and a set of languages that could include a scripting language. MPEG III has considered the use of DSM-RSF as the reference script language for example decodings. One of the subgroups of the Digital Audio/Visual Council (Davic) could define a scripting language as part of the set-top box application programming interface. And the Hypermedia Languages Special Working Group of ISO JTC1/SCI8/WG8 (the same group responsible for SGML, HyTime, and other broadly applied document processing standards) is developing the Standard Multimedia/Hypermedia Scripting Language.

The inclusion of third-party scripts in web pages is a common practice. A recent study has shown that more than half of the Alexa top 10 000 sites include scripts from more than 5 different origins. However, such script inclusions carry risks, as the included scripts operate with the privileges of the including website. We propose JSand, a server-driven but client-side JavaScript sandboxing framework. JSand requires no browser modifications: the sandboxing framework is implemented in JavaScript and is delivered to the browser by the websites that use it. Enforcement is done entirely at the client side: JSand enforces a server-specified policy on included scripts without requiring server-side filtering or rewriting of scripts. Most importantly, JSand is complete: access to all resources is mediated by the sandbox. We describe the design and implementation of JSand, and we show that it is secure, backwards compatible, and that it performs sufficiently well. ispartof: pages:1-10 ispartof: Proceedings of the 28th Annual Computer Security Applications Conference (ACSAC 2012) pages:1-10 ispartof: Annual Computer Security Applications Conference (ACSAC 2012) location:Orlando, Florida, USA date:3 Dec - 7 Dec 2012 status: published

OpenSim is a 3D virtual reality platform and now has been widely used in many fields. Its powerful scripting technology is helpful for third party development. Linden scripting language is the most important scripting language in OpenSim, which only supports virtual worlds' common applications but is weak in domain-specific applications. In order to extend Linden scripting functions, a general extended scheme is proposed in this paper. The structure and rule of OpenSim's scripting engine are analyzed. Then the management mechanisms of thread pool and queue are summed up. We present four extending approaches. Their implementations and scopes of applications are compared. We choose expanding service modules as the general extended scheme. By extending database service of the item bank, scripting functions (e.g., llMakeTest) are developed to support teaching evaluation in 3D virtual learning environments on OpenSim platform. The correctness of the extended scheme is proved by the case study. The scheme provides a guideline for developing Linden scripting functions for specific applications. It is verified that expanding OpenSim's domain-specific applications based on scripting technology is feasible.

The continued development and maturation of advanced HTML features such as Cascading Style Sheets (CSS), Javascript, and AJAX, as well as their widespread adoption by browsers, has enabled web pages to flourish with sophistication and interactivity. Unfortunately, this presents challenges to the web search community, as a web page's representation in the browser (i.e., what users see) can diverge dramatically from its raw HTML content (i.e., what search engines index and retrieve). For example, interactive pages may contain content in regions that are not visible before a user action, such as focusing a tab, but which are nonetheless still contained within the raw HTML. We study this divergence by comparing raw HTML to its fully rendered form across a number of metrics spanning presentation, geometry, and content, using a large, representative sample of popular web pages. We found that a large divergence currently exists, and we show via a historical analysis that this divergence has grown more pronounced over the last decade. The general finding of our study is that continuing to index the web via simple HTML parsing will diminish the effectiveness of retrieval on the modern web, and that the IR community should work toward more sophisticated web page processing in indexing technology. ispartof: pages:1990-1994 ispartof: Proceedings of the 21st ACM international conference on information and knowledge management (CIKM 2012) pages:1990-1994 ispartof: The 21st ACM international conference on information and knowledge management (CIKM 2012) location:Maui, Hawaii date:29 Oct - 2 Nov 2012 status: published

The structure of dynamic websites comprised of a set of objects such as HTML tags, script functions, hyperlinks and advanced features in browsers lead to numerous resources and interactiveness in services currently provided on the Internet. However, these features have also increased security risks and attacks since they allow malicious codes injection or XSS (Cross-Site Scripting). XSS remains at the top of the lists of the greatest threats to web applications in recent years. This paper presents the experimental results obtained on XSS automatic classification in web pages using Machine Learning techniques. We focus on features extracted from web document content and URL. Our results demonstrate that the proposed features lead to highly accurate classification of malicious page.

Scripting Languages are often used in order to assist the user in repetitious tasks or when smaller program logics shall be expressed. Normally a scripting language is easier to learn than a programming language so that a wide range of professional developers and end users can use the language for its specific tasks. This paper introduces a specific, small scripting language supporting the deployment of programs as well as the test of distributed control systems. In contrast to existing scripting languages, the language comprises only the required set of instructions and is not too complex and therefore easy to maintain.

We define an abstract standards-compliant web browser model. The model focuses on those parts of the browser behaviour which are most relevant for the deployment and execution of web applications, such as interaction with a scripting language (here, ECMAScript), cookies, and asynchronous behaviour of the network layer, while hiding other aspects, such as page navigation and presentational issues. We use a multi-agent Abstract State Machine as our formal model, showing how the browser behaviour can be partitioned into a number of distinct components, and specifying precisely their interactions. The specification can also be used as basis to prove consistency properties of common frameworks for web applications.

This demonstration presents the language design of Konoha-Script, a statically typed object-oriented scripting language. KonohaScript provides the very similar scripting experiences compared to dynamic languages. In addition, it also preserves useful programming supports by static typing, such as automated verification of careless mistakes, improved readability of source code, better opportunity of optimized code generation. This demonstration will show how KonohaScript improved scripting experiences with static typing, using our open source implementation fully written in C.

As more and more Web applications emerging on sever end today, the Web browser on client end has become a host of a variety of applications other than just rendering static Web pages. This leads to more and more performance requirements of a Web browser, for which user experience is very important. This situation may become more urgency when on handheld devices. Some efforts like redesign a new Web browser have been made to overcome this problem. In this paper, we address this issue by optimizing the main processes of the Web browser on a state-of-the-art 64-core architecture, Godson-T, which was developed at Chinese Academy of Sciences, as multi-/many-core architecture to be the mainstream processor in the upcoming years. We start a new core to process a new tab when facing up to intensive URL requests, and we use scratch-pad memory (SPM) of each core as a local buffer to store the HTML source data to be processed to reduce off-chip memory access and exploit more data locality, otherwise, we use DTA to transfer HTML data for backup. Experiments conducted on the cycle-accurate simulator show that, starting each tab process by a new core could obtain 5.7% to 50% speedup with different number of cores used to process corresponding URL requests, with on-chip scratchpad memory of each core used to store the HTML data, more speedup could be achieved when number of cores increase. Also, as Data Transfer Agent (DTA) used to transfer the HTML data, the backup of HTML data can get 2X to 5X speedups according to different data amount.