用于漏洞检测的中间语言表示方法

现有Web漏洞检测方法中使用的中间语言针对特定编程语言设计,在对多种编程语言源代码进行漏洞抽象表示时,无法将多语言下的同类型漏洞用统一的中间语言表示,增加了后续漏洞分析处理的难度。针对该问题提出了一种基于污点分析的中间语言表示方法,实现多编程语言下同类型漏洞信息的统一抽象表示。该中间语言设计过程中将漏洞发生过程抽象为三元组表示,将与三元组相关的代码元素抽象为中间语言的关键字,根据三元组间的语义关系设计了该中间语言的语法。在转义时,利用污点分析方法跟踪污染源的执行路径,对路径中的源代码进行转义得到中间语言表示。最后将该中间语言用于漏洞检测模型,实验结果表明该中间语言与对照中间语言相比对编程语言中漏洞信息的抽象表示更具普适性,对漏洞检测具有有效性。     

Syntax extension using a run time model

We describe a method of syntax extension for programming languages which involves using an augmented BNF notation to add new syntactic constructs to the language, and where the meaning of the constructs is usually given by ordinary user subroutines to be executed at run time. This requires fewer special constructs in the language, and also makes it simpler to specify the extensions because the programmer does not have to worry about compile time vs. run time distinctions. The extended BNF may also be used to give specialized syntax to particular data structures.This research was supported under NSF Grant GJ 34342X.     

基于边缘轮廓特征的实时车型分类

采用面向对象技术设计可视化程序设计语言的编译系统,通过对复杂的可视化图片语法进行分析,将各语法现象以语法单元类的形式进行抽象分类,提出了编译器-编译器的设计策略,给出了从可视化图片设计语言到伪指令代码的解决方法.主要研究在面向对象的编辑环境中如何实现满足硬件设备控制器的稳定、高效的编译系统.通过将可视化程序语言分析器(VPLPG)和小型的类C编译(LCC)器配合使用最终实现可视化程序设计语言的编译系统.     

基于可视化程序设计语言的编译系统

采用面向对象技术设计可视化程序设计语言的编译系统，通过对复杂的可视化图片语法进行分析，将各语法现象以语法单元类的形式进行抽象分类，提出了编译器－编译器的设计策略，给出了从可视化图片设计语言到伪指令代码的解决方法。主要研究在面向对象的编辑环境中如何实现满足硬件设备控制器的稳定、高效的编译系统。通过将可视化程序语言分析器(VPLPG)和小型的类C编译(LCC)器配合使用最终实现可视化程序设计语言的编译系统。     

Recovering structured data types from a legacy data model with overlays

Legacy systems are often written in programming languages that support arbitrary variable overlays. When migrating to modern languages, the data model must adhere to strict structuring rules, such as those associated with an object oriented data model, supporting classes, class attributes and inter-class relationships.In this paper, we deal with the problem of automatically transforming a data model which lacks structure and relies on the explicit layout of variables in memory as defined by programmers. We introduce an abstract syntax and a set of abstract rewrite rules to describe the proposed approach in a language neutral formalism. Then, we instantiate the approach for the proprietary programming language that was used to develop a large legacy system we are migrating to Java.     

Language components for modular DSLs using traits

Recent advances in tooling and modern programming languages have progressively brought back the practice of developing domain-specific languages as a means to improve software development. Consequently, the problem of making composition between languages easier by emphasizing code reuse and componentized programming is a topic of increasing interest in research. In fact, it is not uncommon for different languages to share common features, and, because in the same project different DSLs may coexist to model concepts from different problem areas, it is interesting to study ways to develop modular, extensible languages. Earlier work has shown that traits can be used to modularize the semantics of a language implementation; a lot of attention is often spent on embedded DSLs; even when external DSLs are discussed, the main focus is on modularizing the semantics. In this paper we will show a complete trait-based approach to modularize not only the semantics but also the syntax of external DSLs, thereby simplifying extension and therefore evolution of a language implementation. We show the benefits of implementing these techniques using the Scala programming language.     

Formatted syntaxes and modula-2

The formatted syntax notation has been developed for the specification of formatted programming languages. This paper describes how a formatted syntax may be constructed for the purpose of prettyprinting an existing free-format language. Those aspects of the system of particular relevance to free-format languages are emphasized and their use explained. Also, a number of deficiencies in the defining metasyntax and formatting symbol repertoire are discussed. Practical enhancements and further areas of research are suggested. The programming language Modula-2 is used for illustration, and a formatted syntax for it is given.     

Agent-oriented model-driven development for JADE with the JADEL programming language

This paper describes, from motivations and main objectives to actual implementation, a novel agent-oriented programming language called JADEL. JADEL is designed to support the effective implementation of JADE agents and multi-agent systems in the scope of real-world model-driven development because it concretely helps developers by natively supporting agent-oriented abstractions, and because it is based on mature industrial-strength technologies. The four core abstractions that JADEL supports, namely agents, behaviours, communication ontologies, and interaction protocols, are presented by gradually introducing the specific syntaxes that the language provides for them. In the last part of the paper, a complete example of a simple JADEL multi-agent system is presented and discussed. Such an example is a well-known example from the official distribution of JADE and many programmers learned the basics of JADE from it. The choice of this example allows comparing JADEL source code with reference Java source code using JADE, and it clearly emphasizes the practical advantages of agent-oriented programming.Section 1 introduces and motivates the presented work. Section 2 surveys major AOP languages and, even if it cannot be considered exhaustive, it highlights the specific features of selected languages that have been relevant for the design of JADEL. Section 3 provides an overview of the features of JADE that are supported by JADEL. Section 4 presents the language in details by discussing main supported abstractions, and by specifying its formal syntax. Section 5 presents the most interesting parts of a complete example of the use of JADEL to develop a simple multi-agent system. Finally, Section 6 concludes the paper with a discussion of the current state of the presented work, and a preliminary assessment of the proposed language.     

基于多模态对比学习的代码表征增强预训练方法

代码表征旨在融合源代码的特征,以获取其语义向量,在基于深度学习的代码智能中扮演着重要角色.传统基于手工的代码表征依赖领域专家的标注,繁重耗时,且无法灵活地复用于特定下游任务,这与绿色低碳的发展理念极不相符.因此,近年来,许多自监督学习的编程语言大规模预训练模型(如CodeBERT)应运而生,为获取通用代码表征提供了有效途径.这些模型通过预训练获得通用的代码表征,然后在具体任务上进行微调,取得了显著成果.但是,要准确表示代码的语义信息,需要融合所有抽象层次的特征(文本级、语义级、功能级和结构级).然而,现有模型将编程语言仅视为类似于自然语言的普通文本序列,忽略了它的功能级和结构级特征.因此,旨在进一步提高代码表征的准确性,提出了基于多模态对比学习的代码表征增强的预训练模型(representation enhanced contrastive multimodal pretraining, REcomp). REcomp设计了新的语义级-结构级特征融合算法,将它用于序列化抽象语法树,并通过多模态对比学习的方法将该复合特征与编程语言的文本级和功能级特征相融合,以实现更精准的语义建模.最后,...     

A type-safe embedding of SQL into Java using the extensible compiler framework J%

J% is an extension of the Java programming language that efficiently supports the integration of domain-specific languages. In particular, J% allows the embedding of domain-specific language code into Java programs in a syntax-checked and type-safe manner. This paper presents J%׳s support for the sql language. J% checks the syntax and semantics of sql statements at compile-time. It supports query validation against a database schema or through execution to a live database server. The J% compiler generates code that uses standard jdbc api calls, enhancing runtime efficiency and security against sql injection attacks.     

A comparison of object-oriented programming in four modern languages

Object-oriented programming has become a widely used, important programming paradigm that is supported in many different languages. C++ has become the most widely used object-oriented language and many C++ programmers are unfamiliar with the different approaches taken by other languages in the paradigm. This paper is intended as an introduction to a broad range of ideas in object-oriented programming. Specifically, we introduce four modern programming languages that support object-oriented programming (Oberon-2, Modula-3, Sather and Self), and show how a simple application is coded in these languages. While each of these programming languages provide support for inheritance, dynamic dispatch, code reuse, and information hiding, they do so in very different ways and with varying levels of efficiency and simplicity. The use of a simple example, based on a common programming problem, facilitates our comparison. We have coded the application in all of these languages, including C++, and we compare the compile times, object code sizes, and run times of the available implementations. Implementations of all the languages compared and all of the programs we measure are available on the Internet. Ultimately, our goal is to encourage and facilitate programmers in understanding and exploring a variety of object-oriented programming languages.     

SEMANOL (73) a metalanguage for programming the semantics of programming languages

Summary SEMANOL is a practical programming system for writing readable formal specifications of the syntax and semantics of programming languages. SEMANOL is based on a theory of semantics which embraces algorithmic (operational) and extensional (input/output) semantics. Specifications for large contemporary languages have been constructed in the formal language, SEMANOL (73), which is a readable high-level notation. A SEMANOL (73) specification can be executed (by an existing interpreter program); when given a program from the specified language, and its input, the execution of the SEMANOL (73) specification produces the program's output. The demonstrated executability of SEMANOL (73) provides important practical advantages. This paper includes discussions of the theory of semantics underlying SEMANOL, the syntax and semantics of the SEMANOL (73) language, the use of the SEMANOL (73) language in the SEMANOL method for describing programming languages, and the contrast between the Vienna definition method (VDL) and SEMANOL.     

An implementation of Algol 68 for a small computer

A large subset of the language Algol 68 has been implemented on a small computer—the TESLA 200 with a 64 Kbyte store. In this paper, the general structure of the compiler and organization of the program at run-time are described. Especially, the original methods and devices are mentioned that cause a considerable enhancement of the speed of compilation and program run. These concern the syntax analysis (consistent notation, error recovery), the organization of the resulting program (procedure organization, algorithms of work with multiple values) and the techniques of code generation. We try to show that Algol 68 is a suitable programming language for small as well as large computers and that it can successfully compete with traditional programming languages.     

An optimization model for the container pre-marshalling problem

In most container yards around the world, containers are stacked high to utilize yard space more efficiently. In these yards, one major factor that affects their operational efficiency is the need to re-shuffle containers when accessing a container that is buried beneath other containers. One way to achieve higher loading efficiency is to pre-marshal the containers in such a way that it fits the loading sequence. In this research, we present a mathematical model for the container pre-marshalling problem. With respect to a given yard layout and a given sequence that containers are loaded onto a ship, the model yields a plan to re-position the export containers within the yard, so that no extra re-handles will be needed during the loading operation. The optimization goal is to minimize the number of container movements during pre-marshalling. The resulting model is an integer programming model composed of a multi-commodity flow problem and a set of side constraints. Several possible variations of the model as well as a solution heuristic are also discussed. Computation results are provided.     

Extracting models from source code in software modernization

Model-driven software modernization is a discipline in which model-driven development (MDD) techniques are used in the modernization of legacy systems. When existing software artifacts are evolved, they must be transformed into models to apply MDD techniques such as model transformations. Since most modernization scenarios (e.g., application migration) involve dealing with code in general-purpose programming languages (GPL), the extraction of models from GPL code is an essential task in a model-based modernization process. This activity could be performed by tools to bridge grammarware and MDD technical spaces, which is normally carried out by dedicated parsers. Grammar-to-Model Transformation Language (Gra2MoL) is a domain-specific language (DSL) tailored to the extraction of models from GPL code. This DSL is actually a text-to-model transformation language which can be applied to any code conforming to a grammar. Gra2MoL aims to reduce the effort needed to implement grammarware-MDD bridges, since building dedicated parsers is a complex and time-consuming task. Like ATL and RubyTL languages, Gra2MoL incorporates the binding concept needed to write mappings between grammar elements and metamodel elements in a simple declarative style. The language also provides a powerful query language which eases the retrieval of scattered information in syntax trees. Moreover, it incorporates extensibility and grammar reuse mechanisms. This paper describes Gra2MoL in detail and includes a case study based on the application of the language in the extraction of models from Delphi code.     

An operational semantics for object-oriented concepts based on the class hierarchy

The formalisation of object-oriented languages is essential for describing the implementation details of specific programming languages or for developing program verification techniques. However there has been relatively little formalisation work aimed at abstractly describing the fundamental concepts of object-oriented programming, separate from specific language considerations or suitability for a particular verification style. In this paper we address this issue by formalising a language that includes the core object-oriented programming language concepts of field tests and updates, methods, constructors, subclassing, multithreading, and synchronisation, built on top of standard sequential programming constructs. The abstract syntax is relatively close to the core of typical object-oriented programming languages such as Java. A novel aspect of the syntax is that objects and classes are encapsulated within a single syntactic term, including their fields and methods. Furthermore, class terms are structured according to the class hierarchy, and objects appear as subterms of their class (and method instances as subterms of the relevant object). This helps to narrow the gap between how a programmer thinks about their code and the underlying mathematical objects in the semantics. The semantics is defined operationally, so that all actions a program may take, such as testing or setting local variables and fields, or invoking methods on other objects, appear on the labels of the transitions. A process-algebraic style of interprocess communication is used for object and class interactions. A benefit of this label-based approach to the semantics is that a separation of concerns can be made when defining the rules of the different constructs, and the rules tend to be more concise. The basic rules for individual commands may be composed into more powerful rules that operate at the level of classes and objects. The traces generated by the operational semantics are used as the basis for establishing equivalence between classes.     

An agile approach to language modelling and development

We have developed novel techniques for component-based specification of programming languages. In our approach, the semantics of each fundamental programming construct is specified independently, using an inherently modular framework such that no reformulation is needed when constructs are combined. A language specification consists of an unrestricted context-free grammar for the syntax of programs, together with an analysis of each language construct in terms of fundamental constructs. An open-ended collection of fundamental constructs is currently being developed. When supported by appropriate tools, our techniques allow a more agile approach to the design, modelling, and implementation of programming and domain-specific languages. In particular, our approach encourages language designers to proceed incrementally, using prototype implementations generated from specifications to test tentative designs. The components of our specifications are independent and highly reusable, so initial language specifications can be rapidly produced, and can easily evolve in response to changing design decisions. In this paper, we outline our approach, and relate it to the practices and principles of agile modelling.     

An entity-relationship programming language

The syntax for an integrated E-R programming language is presented. The problems that arise when a query language is embedded in a general-purpose programming language are discussed. Other E-R languages are also discussed. The requirements for the language and a syntax for an E-R model in which entity sets are mutually disjoint and each entity type has a unique, perhaps multiattribute, key are presented. The syntax for a more limited model restricted to binary relationships between entity types and without attributes is presented. Some implementation considerations are discussed