微软与Netscape联手制定JavaScript标准

近日,微软和Netscape终于协商决定,将携手创制标准化的JavaScript,实际上就是将两家的Java脚本描述语言统一成一种标准语言,这将有助于JavaScript语言在全世界的应用.JavaScript是用于创制具有Java能力的Web页面(可被Netscape的Navigator浏览器访问)的语言.由于Netscape没有公布其原始的脚本描述规范,使脚本描述语言成为其专有技术,而微软在其Internet Explorer浏览器就只好采用自己的JScuipt版本语言,从而使Java语言不能在两种浏览器上得到兼容.     

TPython：一种扩充的Python语言

Python是一种流行的动态语言,但是由于完全的动态性影响了其执行效率和使用。因此,在Python基础上进行了静态化扩充,研制了TPython语言。该语言在注释中引入了可选的类型声明,并提供了包括类型检查在内的静态检查。相对于动态语言而言,TPython能够提高程序的可读性和可靠性,降低调试成本,相对于静态语言而言,TPython又具有语法简单,易于开发的优势。     

具有时间多样性的JavaScript代码保护方法

Web应用同本地应用一样面临恶意主机威胁.如何确保暴露于用户主机中的Web应用核心算法或关键业务流程等重要信息的安全成为亟待解决的问题.针对现有JavaScript代码保护方法难以抵御动态分析且抗累积攻击效果差的问题,提出了一种具有时间多样性的JavaScript代码保护(TDJSP)方法.首先,通过程序多样化处理和路径空间模糊化,使JavaScript程序在执行时具有多样性效果,以有效抵御累积攻击;其次,检测调试器、模拟器等非正常执行环境的特征,并根据检测结果进行响应,增加攻击者进行动态分析的难度.理论分析和实验结果表明,JavaScript程序的抗逆向分析能力得到了提高,同时,其空间增长率约为3.1(优于JScrambler3),时间延迟为毫秒级.因此,该方法能够在不影响程序性能的前提下提升Web应用的安全性.     

子树类型敏感的JavaScript引擎灰盒测试技术

JavaScript引擎是浏览器的重要组成部分,很多攻击都针对JavaScript引擎发起,业界对面向JavaScript引擎的漏洞挖掘技术一直展现出强烈的需求.本文提出一种面向JavaScript引擎的子树类型敏感灰盒测试技术,并且实现了系统ILS,在路径反馈的模糊测试框架上,通过对JavaScript代码的语法分析...     

JavaScript的Cookies编程

一、引言 JavaScript是一种解释性语言,它是由Netscape和Sun Microsystem联合开发的用来增加用户的交互操作和Web页面动态内容的一种语言。我们可以通过在一个HTML文档中直接插入适当的JavaScript代码来创建一个JavaScript。当在浏览器里打开这个JavaScript文档时,该浏览器内置的JavaScript解释器将翻译并执行其代码。JavaScript支持事件驱动和标准的程序结构(变量、数组、函数、控制流结构等),其最适合做的是:管理交互式多媒体Web页面,在Web页面中增加日期、时间、状态     

基于马尔可夫模型的软件错误定位方法

软件调试是软件开发的重要环节.统计错误定位技术通过分析程序执行频谱来估计程序中错误所在的位置.针对不同类型的程序频谱,此类技术建立不同的启发式模型描述程序行为.已有研究表明,其准确度同目标错误和程序类型相关,且不存在某种普遍有效的技术.文中从单元测试的特性出发,探讨预测错误类型的可行性,并采用马尔可夫过程对错误类型进行预测,从错误定位技术备选集中选择适合的技术来实施.实验表明文中方法能够更快地定位程序错误.     

用JavaScript控制层次对象的技巧

一、概述 JavaScript是一种跨系统平台、具有面向对象编程能力的脚本语言。它嵌入在标准的HTML语言中,在客户端,由Netscape或与之兼容的浏览器解释执行。JavaScript与Java、CGI程序协作,对Web页面进行控制,实现与用户的动态交互。     

采用了剪枝优化的子类型关系判定算法

静态类型化XML处理语言为处理XML数据提供了新的途径,但现有的此类语言大多数效率较低.研究此类语言的一个重要问题——子类型关系的判定,并使用剪枝优化策略对XDuce的子类型关系判定算法进行优化.实验数据显示,优化后算法的执行效率平均提高20%.该策略具有普遍性,对所有使用类似算法的静态类型化XML处理语言都有效.     

采用了剪枝优化的子类型关系判定算法

静态类型化XML处理语言为处理XML数据提供了新的途径,但现有的此类语言大多数效率较低.研究此类语言的一个重要问题——子类型关系的判定,并使用剪枝优化策略对XDuce的子类型关系判定算法进行优化.实验数据显示,优化后算法的执行效率平均提高20%.该策略具有普遍性,对所有使用类似算法的静态类型化XML处理语言都有效.     

Just-in-time value specialization

JavaScript emerges today as one of the most important programming languages for the development of client-side web applications. Therefore, it is essential that browsers be able to execute JavaScript programs efficiently. However, the dynamic nature of this programming language makes it very challenging to achieve this much needed efficiency. In this paper we propose parameter-based value specialization as a way to improve the quality of the code produced by JIT engines. We have empirically observed that almost 60% of the JavaScript functions found in the world's 100 most popular websites are called only once, or are called with the same parameters. Capitalizing on this observation, we adapt a number of classic compiler optimizations to specialize code based on the runtime values of function's actual parameters. We have implemented the techniques proposed in this paper in IonMonkey, an industrial quality JavaScript JIT compiler developed at the Mozilla Foundation. Our experiments, run across three popular JavaScript benchmarks, SunSpider, V8 and Kraken, show that, in spite of its highly speculative nature, our optimization pays for itself. As an example, we have been able to speed up V8 by 4.83%, and to reduce the size of its generated native code by 18.84%.     

Model-based automated testing of JavaScript Web applications via longer test sequences

JavaScript has become one of the most widely used languages for Web development. Its dynamic and event-driven features make it challenging to ensure the correctness of Web applications written in JavaScript. A variety of dynamic analysis techniques have been proposed which are, however, limited in either coverage or scalability. In this paper, we propose a simple, yet effective, model-based automated testing approach to achieve a high code-coverage within the time budget via testing with longer event sequences. We implement our approach as an open-source tool LJS, and perform extensive experiments on 21 publicly available benchmarks. On average, LJS is able to achieve 86.5% line coverage in 10 minutes. Compared with JSDEP, a state-of-the-art breadth-first search based automated testing tool enriched with partial order reduction, the coverage of LJS is 11%–19% higher than that of JSDEP on real-world large Web applications. Our empirical findings support that proper longer test sequences can achieve a higher code coverage in JavaScript Web application testing.     

Algorithms for Web service selection with static and dynamic requirements

A main feature of Service Oriented Architectures is the capability to support the development of new applications through the composition of existing Web services that are offered by different service providers. The runtime selection of which providers may better satisfy the end-user requirements in terms of quality of service remains an open issue in the context of Web services. The selection of the service providers has to satisfy requirements of different nature: requirements may refer to static qualities of the service providers, which do not change over time or change slowly compared to the service invocation time (for example related to provider reputation), and to dynamic qualities, which may change on a per-invocation basis (typically related to performance, such as the response time). The main contribution of this paper is to propose a family of novel runtime algorithms that select service providers on the basis of requirements involving both static and dynamic qualities, as in a typical Web scenario. We implement the proposed algorithms in a prototype and compare them with the solutions commonly used in service selection, which consider all the service provider qualities as static for the scope of the selection process. Our experiments show that a static management of quality requirements is viable only in the unrealistic case where workload remains stable over time, but it leads to very poor performance in variable environments. On the other hand, the combined management of static and dynamic quality requirements allows us to achieve better user-perceived performance over a wide range of scenarios, with the response time of the proposed algorithms that is reduced up to a 50 % with respect to that of static algorithms.     

JavaScript框架jQuery和ExtJS的对比研究

随着Web 2.0时代的到来,Web应用程序越来越强调丰富的用户体验。而这恰恰主要通过客户端大量的JavaScript来提供友好的交互,于是如何选择一个方便有效的JavaScript框架进行开发便成为一个大家关注的问题。通过比较目前流行的两种JavaScript框架（jQuery和ExtJS）,分析各自优缺点,以期为Web开发者选择合适的JavaScript框架提供帮助。     

JavaScript框架jQuery和ExtJS的对比研究

随着Web 2.0时代的到来,Web应用程序越来越强调丰富的用户体验。而这恰恰主要通过客户端大量的JavaScript来提供友好的交互,于是如何选择一个方便有效的JavaScript框架进行开发便成为一个大家关注的问题。通过比较目前流行的两种JavaScript框架(jQuery和ExtJS),分析各自优缺点,以期为Web开发者选择合适的JavaScript框架提供帮助。     

Byte code level cross-compilation for developing web applications

JavaScript provides the technological foundation of Web 2.0 applications. AJAX (Asynchronous JavaScript And XML) applications have received wide-spread attention as a new way to develop highly interactive web applications. Breaking with the complete-page-reload paradigm of traditional web applications, AJAX applications rival desktop applications in their look-and-feel. But AJAX places a high burden on a web developer requiring extensive JavaScript knowledge as well as other advanced client-side technologies. In this paper, we introduce a technique that allows a developer to implement an application in Java or any.NET language and then automatically cross-compile it to an AJAX-enabled web application.     

攻击网页浏览器:面向脚本代码块的ROP Gadget注入

即时编译机制（just-in-time compilation）改善了网页浏览器执行JavaScript脚本的性能,同时也为攻击者向浏览器进程注入恶意代码提供了便利.借助即时编译器,攻击者可以将脚本中的整型常数放置到动态代码缓存区,以便注入二进制恶意代码片段（称为gadget）.通过常数致盲等去毒化处理,基于常数的注入已经得到有效遏制.证实了不使用常数转而通过填充脚本代码块也能实施gadget注入,并实现图灵完备的计算功能.在编译一段给定的脚本代码时,即时编译器生成的动态代码中通常存在着一些固定的机器指令序列.这些指令序列的存在性不受常数致盲和地址空间布局随机化等安全机制的影响,同时,这些指令序列中可能蕴涵着攻击者期望的gadget.在实施攻击时,攻击者可以汇集特定的脚本代码块来构造一个攻击脚本,再借助即时编译器来注入gadget.在x86-64架构上评估了这种注入攻击在SpiderMonkey和GoogleV8这两个开源即时编译引擎上的可行性.通过给这两个引擎输入大量的JavaScript脚本,可以得到较为丰富的动态代码块.在这些动态代码块上的统计分析结果表明,这两个引擎生成的动态代码中都存在图灵完备的gadget集合.在实际攻击场景中,攻击者可以利用的脚本集合完全包含且远远多于实验用的脚本.因此,攻击者可以采用该方法注入需要的gadget,以便构造出实现任意功能的ROP（return-orientedprogramming）代码.     

基于CGI接口实现嵌入式系统远程控制

伴随着“把互联网带到生活中”的口号，依托互联网络对硬件终端设备进行远程控制已成为网络发展的重要方向。嵌入式技术的发展使在硬件设备中广泛使用的嵌入式操作系统也能提供Web Server功能。基于其提供的CGI接口，使用C语言和JavaScript脚本相结合编写CGI脚本，并完成相应的控制功能，使用JavaScript生成客户端界面，通过CGI接口实现浏览器到服务器端的通信，这样就可以很方便地在嵌入式系统中实现一个基于B／S模型的远程控制方法。     

基于WEB的教师个人网站的研究

近年来,随着计算机科学的发展,数据库技术在Internet中的应用越来越广泛,各类网站的应用为知识、信息交流提供了更加周到和人性化的服务。实用性已逐渐成为当今Web应用的潮流。以ASP为开发技术,以VBScript、JavaScript为服务器端脚本语言,以ASP作为客户端脚本语言,实现了一个简单网上教师和学生的交流系统。设计过程中采用了AJAX,web2.0,div+css等设计元素,网站设计尽可能的在用户体验度上有所突破。