Web Browser Characterisation, Emulation, and Preservation
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
On the Incoherencies in Web Browser Access Control Policies
On the Incoherencies in Web Browser Access Control Policies Kapil Singh∗, Alexander Moshchuk†, Helen J. Wang† and Wenke Lee∗ ∗Georgia Institute of Technology, Atlanta, GA Email: {ksingh, wenke}@cc.gatech.edu †Microsoft Research, Redmond, WA Email: {alexmos, helenw}@microsoft.com Abstract—Web browsers’ access control policies have evolved Inconsistent principal labeling. Today’s browsers do piecemeal in an ad-hoc fashion with the introduction of new not have the same principal definition for all browser re- browser features. This has resulted in numerous incoherencies. sources (which include the Document Object Model (DOM), In this paper, we analyze three major access control flaws in today’s browsers: (1) principal labeling is different for different network, cookies, other persistent state, and display). For resources, raising problems when resources interplay, (2) run- example, for the DOM (memory) resource, a principal is time changes to principal identities are handled inconsistently, labeled by the origin defined in the same origin policy and (3) browsers mismanage resources belonging to the user (SOP) in the form of <protocol, domain, port> [4]; but principal. We show that such mishandling of principals leads for the cookie resource, a principal is labeled by <domain, to many access control incoherencies, presenting hurdles for > web developers to construct secure web applications. path . Different principal definitions for two resources are A unique contribution of this paper is to identify the com- benign as long as the two resources do not interplay with patibility cost of removing these unsafe browser features. To do each other. However, when they do, incoherencies arise. For this, we have built WebAnalyzer, a crawler-based framework example, when cookies became accessible through DOM’s for measuring real-world usage of browser features, and used “document” object, DOM’s access control policy, namely the it to study the top 100,000 popular web sites ranked by Alexa. -
Applying World Wide Web Standards to Embedded Systems
NASA / TMm2002-211199 AIAA-2001-5107 Embedded Web Technology: Applying World Wide Web Standards to Embedded Systems Joseph G. Ponyik and David W. York Glenn Research Center, Cleveland, Ohio March 2002 The NASA STI Program Office... in Profile Since its founding, NASA has been dedicated to CONFERENCE PUBLICATION. Collected the advancement of aeronautics and space papers from scientific and technical science. The NASA Scientific and Technical conferences, symposia, seminars, or other Information (STI) Program Office plays a key part meetings sponsored or cosponsored by in helping NASA maintain this important role. NASA. The NASA STI Program Office is operated by SPECIAL PUBLICATION. Scientific, Langley Research Center, the Lead Center for technical, or historical information from NASA's scientific and technical information. The NASA programs, projects, and missions, NASA STI Program Office provides access to the often concerned with subjects having NASA STI Database, the largest collection of substantial public interest. aeronautical and space science STI in the world. The Program Office is also NASA's institutional TECHNICAL TRANSLATION. English- mechanism for disseminating the results of its language translations of foreign scientific research and development activities. These results and technical material pertinent to NASA's are published by NASA in the NASA STI Report mission. Series, which includes the following report types: Specialized services that complement the STI TECHNICAL PUBLICATION. Reports of Program Office's diverse offerings include completed research or a major significant creating custom thesauri, building customized phase of research that present the results of data bases, organizing and publishing research NASA programs and include extensive data results.., even providing videos. -
HTML5 and the Open Web Platform
HTML5 and the Open Web Platform Stuttgart 28 May 2013 Dave Raggett <[email protected]> The Open Web Platform What is the W3C? ● International community where Members, a full-time staff and the public collaborate to develop Web standards ● Led by Web inventor Tim Berners-Lee and CEO Jeff Jaffe ● Hosted by MIT, ERCIM, Keio and Beihang ● Community Groups open to all at no fee ● Business Groups get more staff support ● Technical Working Groups ● Develop specs into W3C Recommendations ● Participants from W3C Members and invited experts ● W3C Patent process for royalty free specifications 3 Who's involved ● W3C has 377 Members as of 11 May 2013 ● To name just a few ● ACCESS, Adobe, Akamai, Apple, Baidu, BBC, Blackberry (RIM), BT, Canon, Deutsche Telekom, eBay, Facebook, France Telecom, Fujitsu, Google, Hitachi, HP, Huawei, IBM, Intel, LG, Microsoft, Mozilla, NASA, NEC, NTT DoCoMo, Nuance, Opera Software, Oracle, Panasonic, Samsung, Siemens, Sony, Telefonica, Tencent, Vodafone, Yandex, … ● Full list at ● http://www.w3.org/Consortium/Member/List 4 The Open Web Platform 5 Open Web Platform ● Communicate with HTTP, Web Sockets, XML and JSON ● Markup with HTML5 ● Style sheets with CSS ● Rich graphics ● JPEG, PNG, GIF ● Canvas and SVG ● Audio and Video ● Scripting with JavaScript ● Expanding range of APIs ● Designed for the World's languages ● Accessibility with support for assistive technology 6 Hosted and Packaged Apps ● Hosted Web apps can be directly loaded from a website ● Packaged Web apps can be locally installed on a device and run without the need for access to a web server ● Zipped file containing all the necessary resources ● Manifest file with app meta-data – Old work on XML based manifests (Web Widgets) – New work on JSON based manifests ● http://w3c.github.io/manifest/ ● Pointer to app's cache manifest ● List of required features and permissions needed to run correctly ● Runtime and security model for web apps ● Privileged apps must be signed by installation origin's private key 7 HTML5 Markup ● Extensive range of features ● Structural, e.g. -
The Challenges of Web Engineering and Requirements for Better Tool Support
View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by Computer Science Technical Reports @Virginia Tech The Challenges of Web Engineering and Requirements for Better Tool Support Jochen Rode1, Mary Beth Rosson2, Manuel A. Pérez-Quiñones1 2 1Virginia Polytechnic Institute and State University Pennsylvania State University Center for Human-Computer Interaction School of Information Sciences & Technology 3160 Torgersen Hall 330D IST Building Blacksburg, VA 24061, USA University Park, PA 16802 [email protected], [email protected] [email protected] ABSTRACT We report the findings from two distinct studies – a survey and an We report the experiences of semi-professional developers interview study. After a brief review of related work we discuss regarding the challenges, tools, and processes within the domain our research methods and our major results. The survey and of web application development. The paper summarizes the main interview study jointly highlight key challenges such as: problems in web development, characterizes the habits of implementing security, cross-platform compatibility, debugging, programmers and concludes with a “developer’s wish list” for and technology integration. We first report the findings from the improvements to web technologies and tools. The report is based survey and the interviews separately and then summarize to paint on two independent sources – a survey of 31 web developers and a coherent picture of the status-quo of web development. an in-depth interview study with 10 participants. 2. RELATED WORK Keywords The analysis of web developers’ needs has received little attention Web application development, web development tools, web in the web engineering literature. -
Websockets, JSON, HTML, CSS) Webpods When Installed Motivation Create Web Pages to Display Control System Data
Web pods Accessing Control Data Through Web Standards (WebSockets, JSON, HTML, CSS) WebPODS when installed Motivation Create web pages to display control system data WebPODS (Protocol Oriented Distribution Service) • The Web PODS aims to provide real-time publish/subscribe communication using • WebSockets • JSON • Pure HTML/CSS widgets • Main benefits: • Uses web standards (any web client in any language) • Widgets can be configured through standard CSS • Data access outside of control network (possibly WAN) • Web pages do not need to live on the same server where the gateway is Chrome extension: Simple Web Socket Client HTML Probe (Danielle Connolly, UMich) Test javascript client (Danielle Connolly, UMich) Text monitor examples LED examples WebPODS Specify server location Adding text-monitor Adding led Specify color for “LOW” enum value GWT client (Enrique Schuhmacher, BNL) Using CS-Studio off site through Web Pods WebPODS Architecture WebPODS clients WebPODS Server Web Pods server configuration [xxx@diirt ~]# more .diirt/pods/web/mappings.xml <?xml version='1.0' encoding='UTF-8'?> <mappings version="1"> <mapping channel="calibration/constants" substitution="file:///path/to/file/table.csv" permission="READ_ONLY"/> <mapping channel="public-.*" permission="READ_WRITE"/> <mapping channel="cf-tag-(.\w)" substitution="=cfQuery($1)" permission="READ_ONLY"/> <mapping channel="sim/(.*)" substitution="sim://$1" permission="READ_ONLY"/> </mappings> Access security planned, not yet implemented • Use wss (like https) for authentication • Use username/role/unix group/host for authorization Be careful not to expose too much Web Pods • Rebroadcast data using Web sockets and JSON • Play nice with firewalls, get WAN notifications, data available to web tools, server is one class (no logic, a pass-through to pvmanager), should scale (different sockets on different servers, not tested) • Not a substitute to CA/PVA. -
A Light-Weight Time Protocol Based on Common Web Standards
A light-weight time protocol based on common web standards M. Gutbrod, T. Klein, D. Sibold Physikalisch-Technische Bundesanstalt 38116 Braunschweig, Germany [email protected] Abstract—Distributed systems are an essential part of Industry Highest accuracy can be reached by using PTP (Precision 4.0 and IoT. In order to perform properly they depend on time Protocol) if the IT infrastructure fully complies to PTP unambiguous time information while their stripped-down requirements [4]. The current standard only provides an hardware prevents the use of extensive protocols and algorithms. experimental annex for the integrity protection of PTP messages We developed a light-weight protocol for time transmission aiming which was never well adopted and implemented. Thus, the for simplicity, security and broad applicability by relying solely on current effort to revise the PTP specification includes a plan to common web standards. In this paper the new websocket time provide a new security mechanism for PTP. protocol (WST) will be presented. Our aim was to develop a light-weight and secure time Keywords—time protocol, websocket, ntp, time transmission, protocol that is universally usable. Therefore, it is solely based WST on technologies that are available on virtually every IoT device communicating via internet. I. INTRODUCTION The digital transformation is, among others, driven by the II. WEBSOCKET emergence of distributed systems which may for example Websocket was developed to allow efficient bidirectional consist of a large number of sensors performing measuring tasks. communication with low overhead over TCP connections and is In order to correlate their data, it is important that all sensors, or designed to be compatible with the HTTP protocol. -
An Introduction to AJAX
An Introduction to AJAX By : I. Moamin Abughazaleh Page 2 /25 How HTTP works? Classical HTTP Process 1. The visitor requests a page Page 3 /25 2. The server send the entire HTML, CSS and Javascript code at once to the client 3. So, the communication is synchronious Page 4 /25 What is Javascript programming actually? What is Javascript programming? It is programming the browsers. So, we are limited to the objects that the Page 5 /25 browser presents us An Alternative for Managing requests - AJAX AJAX stands for Asynchronous JavaScript And XML. AJAX is based on XMLHttpRequest object of Page 6 /25 Javascript - so the browser and XMLHttpRequest is a standard http://www.w3.org/TR/XMLHttpRequest/ It was introduced with IE-5.0 as an ActiveX object (1999) Later all the major browsers added XMLHttpRequest into their object bases. AJAX = Asynchronous JavaScript and XML It is a technique for creating better, faster, and more interactive web applications With XMLHttpRequest object JavaScript can trade data with a web server, without reloading Page 7 /25 the page AJAX uses “asynchronous data transfer” => allowing web pages to request small bits of information from the server instead of whole pages We can create desktop application like web applications using AJAX, this paradigm is also called “WEB 2.0” programming AJAX - Based on Web Standards AJAX is based on the following web standards: XHTML and CSS Presentation DOM Dynamic display of and interaction with data XML and XSLT Tranfering data back and forth Page 8 /25 XMLHttpRequest Asynchronous transfer of data Javascript Bring these technologies together AJAX applications are browser and platform independent The XMLHttpRequest object is supported in Internet Explorer 5.0+, Safari 1.2, Mozilla 1.0 / Firefox, Opera 8+, and Netscape 7. -
Web-Based Information Visualisation Using Javascript and Webgl
Eurographics Conference on Visualization (EuroVis) (2014) Short Papers N. Elmqvist, M. Hlawitschka, and J. Kennedy (Editors) FluidDiagrams: Web-Based Information Visualisation using JavaScript and WebGL Keith Andrews1 and Benedict Wright2 1Institute for Information Systems and Computer Media (IICM), Graz University of Technology, Austria 2Institute for Software Technology (IST), Graz University of Technology, Austria Abstract Much attention has been focused on the provision of information graphics and visualisations inside a web browser. Currently available infovis toolkits produce graphical output by either injecting SVG nodes into the DOM or using the JavaScript Canvas 2D API. FluidDiagrams is a prototype information visualisation framework written in JavaScript which uses the WebGL 3D JavaScript API for its output, falling back to Canvas 2D as necessary, via the Three.js library. Six visualisations are currently implemented: bar chart and line chart, scatter plot and parallel coordinates for multidimensional data, and cone tree and hyperbolic for hierarchies. Anecdotally, visualisations using SVG nodes in the DOM for output can become rather sluggish when display- ing more than a few dozen items. Visualisations using Canvas 2D exhibit similarly slow performance. WebGL utilises hardware acceleration where available and promises much better performance for complex visualisations, potentially in the order of many thousands of items without becoming unresponsive. A comparison of parallel coordinates visualisations with 100 records in 20 dimensions compared three imple- mentations: FluidDiagrams (WebGL), FluidDiagrams (Canvas 2D), and D3 (using SVG nodes). They achieved 62, 6, and 10 frames per second respectively. The FluidDiagrams (WebGL) implementation was able to render 1,000 records in 20 dimensions at 18 frames per second, compared to 1 and 6 respectively. -
Cross-Domain Embedding for Vaadin Applications
Cross-Domain Embedding for Vaadin Applications Janne Lautamäki and Tommi Mikkonen Department of Software Systems, Tampere University of Technology, Korkeakoulunkatu 1, FI-33720 Tampere, Finland {janne.lautamaki,tommi.mikkonen}@tut.fi Abstract. Although the design goals of the browser were originally not at running applications or at displaying a number of small widgets on a single web page, today many web pages considerably benefit from being able to host small embedded applications as components. While the web is full such applications, they cannot be easily reused because of the same origin policy restrictions that were introduced to protect web content from potentially malicious use. In this paper, we describe a generic design for cross domain embedding of web applications in a fashion that enables loading of applications from different domains as well as communication between the client and server. As the proof- of-concept implementation environment, we use web development framework Vaadin, a Google Web Toolkit based system that uses Java for application development. Keywords: Vaadin, JSONP, cross-domain applications. 1 Introduction Web applications – systems that resemble desktop applications in their behavior but are run inside the browser – are becoming increasingly common. The current trend is that web pages have dynamic components side by side with the traditional web content, such as static text and images. These dynamic components can be small widgets that for instance display current weather information or stock exchange data, or even full-fledged web applications that offer a service related to the theme of the web page where they are located [1]. Creating dynamic web pages is much more complex than building plain old web pages. -
Chapter 1 Web Basics and Overview
Chapter 1 Web Basics and Overview The Web is an Internet-based distributed information system. Anyone with a computer connected to the Internet can easily retrieve information by giving a Web address or by simply clicking a mouse button. The Web is a great way to disseminate information and making it available 24/7. Information can also be collected from Web users and customers through online forms. Maintainers and administrators can control and update Web content from anywhere on the Web. All these make the Web a powerful tool for mass communication, e-business and e-commerce. Compared with TV, radio, news papers, and magazines, putting the word out on the Web is relatively simple and inexpensive. But a website is much more than such one-way communication media. It can be a virtual o±ce or store that is always open and supported by workers from anywhere. Web service companies o®er free Web space and tools to generate simple personal or even business Web pages. But, well-designed and professionally implemented websites are much more involved. Even then, expertly produced websites are still much more cost-e®ective than other means of mass communication. For business and commerce, the cost of a website is negligible when compared to building and operating a brick-and-mortar o±ce or store. Once in-place, a website is a store that never closes and that is very attractive. People take great pains in building an o±ce or store to project the right image and to serve the needs 7 8 CHAPTER 1. -
Web Pages Are Stored on Web Server and Can Be Viewed Using a Web Browser
WWEEBB PPAAGGEESS http://www.tutorialspoint.com/internet_technologies/web_pages.htm Copyright © tutorialspoint.com Web Page web page is a document available on world wide web. Web Pages are stored on web server and can be viewed using a web browser. A web page can cotain huge information including text, graphics, audio, video and hyper links. These hyper links are the link to other web pages. Collection of linked web pages on a web server is known as website. There is unique Uniform Resource Locator URL is associated with each web page. Static Web page Static web pages are also known as flat or stationary web page. They are loaded on the client’s browser as exactly they are stored on the web server. Such web pages contain only static information. User can only read the information but can’t do any modification or interact with the information. Static web pages are created using only HTML. Static web pages are only used when the information is no more required to be modified. Dynamic Web page Dynamic web page shows different information at different point of time. It is possible to change a portaion of a web page without loading the entire web page. It has been made possible using Ajax technology. Server-side dynamic web page It is created by using server-side scripting. There are server-side scripting parameters that determine how to assemble a new web page which also include setting up of more client-side processing. Client-side dynamic web page It is processed using client side scripting such as JavaScript. -
How Web Browsers Work HTTP: “Definition: HTTP
How web browsers work http://www.webdevelopersnotes.com/basics/how_do_web_browser_work.php HTTP: HTTP 1.0 document from 1990 http://www.w3.org/Protocols/HTTP/1.0/spec.html “Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD. HTTP utilizes TCP port 80 by default, though other ports such as 8080 can alternatively be used……. “ http://compnetworking.about.com/od/networkprotocols/g/bldef_http.htm HTTPS The secure hypertext transfer protocol (HTTPS) is a communications protocol designed to transfer encrypted information between computers over the World Wide Web. HTTPS is http using a Secure Socket Layer (SSL). A secure socket layer is an encryption protocol invoked on a Web server that uses HTTPS. Most implementations of the HTTPS protocol involve online purchasing or the exchange of private information. Accessing a secure server often requires some sort of registration, login, or purchase. The successful use of the HTTPS protocol requires a secure server to handle the request. http://msdn.microsoft.com/en-us/library/aa767735(v=vs.85).aspx HTML HyperText Markup Language is used for describing web documents (web pages) so that they can be correctly displayed. A markup language is a set of markup tags HTML documents are described by HTML tags Each HTML tag describes different document content http://www.w3schools.com/html/html_intro.asp Static Web Page A web page that uses only HTML does not change its appearance or its data and is therefore always a static webpage URI and URL In computing, a uniform resource identifier (URI) is a string of characters used to identify a name of a resource.