Effective Javascript: 68 Specific Ways to Harness the Power of Javascript
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Interaction Between Web Browsers and Script Engines
IT 12 058 Examensarbete 45 hp November 2012 Interaction between web browsers and script engines Xiaoyu Zhuang Institutionen för informationsteknologi Department of Information Technology Abstract Interaction between web browser and the script engine Xiaoyu Zhuang Teknisk- naturvetenskaplig fakultet UTH-enheten Web browser plays an important part of internet experience and JavaScript is the most popular programming language as a client side script to build an active and Besöksadress: advance end user experience. The script engine which executes JavaScript needs to Ångströmlaboratoriet Lägerhyddsvägen 1 interact with web browser to get access to its DOM elements and other host objects. Hus 4, Plan 0 Browser from host side needs to initialize the script engine and dispatch script source code to the engine side. Postadress: This thesis studies the interaction between the script engine and its host browser. Box 536 751 21 Uppsala The shell where the engine address to make calls towards outside is called hosting layer. This report mainly discussed what operations could appear in this layer and Telefon: designed testing cases to validate if the browser is robust and reliable regarding 018 – 471 30 03 hosting operations. Telefax: 018 – 471 30 00 Hemsida: http://www.teknat.uu.se/student Handledare: Elena Boris Ämnesgranskare: Justin Pearson Examinator: Lisa Kaati IT 12 058 Tryckt av: Reprocentralen ITC Contents 1. Introduction................................................................................................................................ -
Defensive Javascript Building and Verifying Secure Web Components
Defensive JavaScript Building and Verifying Secure Web Components Karthikeyan Bhargavan1, Antoine Delignat-Lavaud1, and Sergio Maffeis2 1 INRIA Paris-Rocquencourt, France 2 Imperial College London, UK Abstract. Defensive JavaScript (DJS) is a typed subset of JavaScript that guarantees that the functional behavior of a program cannot be tampered with even if it is loaded by and executed within a malicious environment under the control of the attacker. As such, DJS is ideal for writing JavaScript security components, such as bookmarklets, single sign-on widgets, and cryptographic libraries, that may be loaded within untrusted web pages alongside unknown scripts from arbitrary third par- ties. We present a tutorial of the DJS language along with motivations for its design. We show how to program security components in DJS, how to verify their defensiveness using the DJS typechecker, and how to analyze their security properties automatically using ProVerif. 1 Introduction Since the advent of asynchronous web applications, popularly called AJAX or Web 2.0, JavaScript has become the predominant programming language for client-side web applications. JavaScript programs are widely deployed as scripts in web pages, but also as small storable snippets called bookmarklets, as down- loadable web apps,1 and as plugins or extensions to popular browsers.2 Main- stream browsers compete with each other in providing convenient APIs and fast JavaScript execution engines. More recently, Javascript is being used to program smartphone and desktop applications3, and also cloud-based server ap- plications,4 so that now programmers can use the same idioms and libraries to write and deploy a variety of client- and server-side programs. -
Typescript-Handbook.Pdf
This copy of the TypeScript handbook was created on Monday, September 27, 2021 against commit 519269 with TypeScript 4.4. Table of Contents The TypeScript Handbook Your first step to learn TypeScript The Basics Step one in learning TypeScript: The basic types. Everyday Types The language primitives. Understand how TypeScript uses JavaScript knowledge Narrowing to reduce the amount of type syntax in your projects. More on Functions Learn about how Functions work in TypeScript. How TypeScript describes the shapes of JavaScript Object Types objects. An overview of the ways in which you can create more Creating Types from Types types from existing types. Generics Types which take parameters Keyof Type Operator Using the keyof operator in type contexts. Typeof Type Operator Using the typeof operator in type contexts. Indexed Access Types Using Type['a'] syntax to access a subset of a type. Create types which act like if statements in the type Conditional Types system. Mapped Types Generating types by re-using an existing type. Generating mapping types which change properties via Template Literal Types template literal strings. Classes How classes work in TypeScript How JavaScript handles communicating across file Modules boundaries. The TypeScript Handbook About this Handbook Over 20 years after its introduction to the programming community, JavaScript is now one of the most widespread cross-platform languages ever created. Starting as a small scripting language for adding trivial interactivity to webpages, JavaScript has grown to be a language of choice for both frontend and backend applications of every size. While the size, scope, and complexity of programs written in JavaScript has grown exponentially, the ability of the JavaScript language to express the relationships between different units of code has not. -
Learn Javascript
Learn JavaScript Steve Suehring Copyright © 2012 by Steve Suehring All rights reserved. No part of the contents of this book may be reproduced or transmitted in any form or by any means without the written permission of the publisher. ISBN: 978-0-7356-6674-0 1 2 3 4 5 6 7 8 9 LSI 7 6 5 4 3 2 Printed and bound in the United States of America. Microsoft Press books are available through booksellers and distributors worldwide. If you need support related to this book, email Microsoft Press Book Support at [email protected]. Please tell us what you think of this book at http://www.microsoft.com/learning/booksurvey. Microsoft and the trademarks listed at http://www.microsoft.com/about/legal/en/us/IntellectualProperty/ Trademarks/EN-US.aspx are trademarks of the Microsoft group of companies. All other marks are property of their respective owners. The example companies, organizations, products, domain names, email addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, email address, logo, person, place, or event is intended or should be inferred. This book expresses the author’s views and opinions. The information contained in this book is provided without any express, statutory, or implied warranties. Neither the authors, Microsoft Corporation, nor its resellers, or distributors will be held liable for any damages caused or alleged to be caused either directly or indirectly by this book. Acquisitions and Developmental Editor: Russell Jones Production Editor: Rachel Steely Editorial Production: Dianne Russell, Octal Publishing, Inc. -
CS 0449: Introduction to Systems Software
CS 0449: Introduction to Systems Software Jonathan Misurda Computer Science Department University of Pittsburgh [email protected] http://www.cs.pitt.edu/∼jmisurda Version 3, revision 1 Last modified: July 27, 2017 at 1:33 P.M. Copyright © 2017 by Jonathan Misurda This text is meant to accompany the course CS 0449 at the University of Pittsburgh. Any other use, commercial or otherwise, is prohibited without permission of the author. All rights reserved. Java is a registered trademark of Oracle Corporation. This reference is dedicated to the students of CS 0449, Fall 2007 (2081). Their patience in dealing with a changing course and feedback on the first version of this text was greatly appreciated. Contents Contents i List of Figures v List of Code Listings vii Preface ix 1 Pointers 1 1.1 Basic Pointers . 2 1.1.1 Fundamental Operations . 2 1.2 Passing Pointers to Functions . 4 1.3 Pointers, Arrays, and Strings . 5 1.3.1 Pointer Arithmetic . 6 1.4 Terms and Definitions . 7 2 Variables: Scope & Lifetime 8 2.1 Scope and Lifetime in C . 9 2.1.1 Global Variables . 11 2.1.2 Automatic Variables . 12 2.1.3 Register variables . 13 2.1.4 Static Variables . 13 2.1.5 Volatile Variables . 16 2.2 Summary Table . 17 2.3 Terms and Definitions . 17 ii Contents 3 Compiling & Linking: From Code to Executable 19 3.1 The Stages of Compilation . 19 3.1.1 The Preprocessor . 20 3.1.2 The Compiler . 21 3.1.3 The Linker . 22 3.2 Executable File Formats . -
Concrete Types for Typescript
Concrete Types for TypeScript Gregor Richards1, Francesco Zappa Nardelli2, and Jan Vitek3 1 University of Waterloo 2 Inria 3 Northeastern University Abstract TypeScript extends JavaScript with optional type annotations that are, by design, unsound and, that the TypeScript compiler discards as it emits code. This design point preserves programming idioms developers are familiar with, and allows them to leave their legacy code unchanged, while offering a measure of static error checking in annotated parts of the program. We present an alternative design for TypeScript that supports the same degree of dynamism but that also allows types to be strengthened to provide correctness guarantees. We report on an implementation, called StrongScript, that improves runtime performance of typed programs when run on a modified version of the V8 JavaScript engine. 1998 ACM Subject Classification F.3.3 Type structure Keywords and phrases Gradual typing, dynamic languages Digital Object Identifier 10.4230/LIPIcs.ECOOP.2015.999 1 Introduction Perhaps surprisingly, a number of modern computer programming languages have been de- signed with intentionally unsound type systems. Unsoundness arises for pragmatic reasons, for instance, Java has a covariant array subtype rule designed to allow for a single polymor- phic sort() implementation. More recently, industrial extensions to dynamic languages, such as Hack, Dart and TypeScript, have featured optional type systems [5] geared to ac- commodate dynamic programming idioms and preserve the behavior of legacy code. Type annotations are second class citizens intended to provide machine-checked documentation, and only slightly reduce the testing burden. Unsoundness, here, means that a variable an- notated with some type T may, at runtime, hold a value of a type that is not a subtype of T due to unchecked casts, covariant subtyping, and untyped code. -
Visual Studio “Code in Strings”
VisCis: Visual Studio “Code in Strings” Paul Roper School of Business and Computer Technology Nelson Marlborough Institute of Technology Nelson, NZ [email protected] When developing web applications using Visual Studio .NET SQL and Javascript. This code is ignored by Visual there are times when the programmer is coding either SQL or Javascript within text strings. Consequently such code is never Studio, and consequently can be the source of run- checked for correct syntax before it is run. As far as Visual time errors. The writer wanted to see if another Studio is concerned, the contents of a string are irrelevant. As program could extract this “code in strings” and syn- long as the code is inside matching quotes, it is simply a valid string. tax check it at edit-time, potentially saving devel- There is an irony here in that Visual Studio is a sophisticated oper time and frustration. tool with powerful features for developers such as highlighting syntax errors as lines are typed. However, the SQL and 1.1 SQL in ASP.NET program code Javascript code inside strings is just as prone to errors as any other code but these errors are only discovered at run time. In SQL instructions have long been part of web terms of time taken to find and fix, they probably consume application code (Java, ASP, PHP etc). Both stu- relatively more time per lines of code than the VB or C# code that is thoroughly checked at edit-time. Both SQL and Javascript dents and experienced developers frequently expe- are necessary for any non-trivial web application although the rience problems with the syntax of embedded SQL use of stored procedures in MSSQL removes SQL code from particularly unmatched quotes, inadvertent use of a program code. -
Secure Coding in Modern C++
MASARYK UNIVERSITY FACULTY OF INFORMATICS Secure coding in modern C++ MASTER'S THESIS Be. Matěj Plch Brno, Spring 2018 MASARYK UNIVERSITY FACULTY OF INFORMATICS Secure coding in modern C++ MASTER'S THESIS Be. Matěj Plch Brno, Spring 2018 This is where a copy of the official signed thesis assignment and a copy of the Statement of an Author is located in the printed version of the document. Declaration Hereby I declare that this paper is my original authorial work, which I have worked out on my own. All sources, references, and literature used or excerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Be. Matěj Plch Advisor: RNDr. Jifi Kur, Ph.D. i Acknowledgements I would like to thank my supervisor Jiří Kůr for his valuable guidance and advice. I would also like to thank my parents for their support throughout my studies. ii Abstract This thesis documents how using modern C++ standards can help with writing more secure code. We describe common vulnerabilities, and show new language features which prevent them. We also de• scribe coding conventions and tools which help programmers with using modern C++ features. This thesis can be used as a handbook for programmers who would like to know how to use modern C++ features for writing secure code. We also perform an extensive static analysis of open source C++ projects to find out how often are obsolete constructs of C++ still used in practice. iii Keywords secure coding, modern C++, vulnerabilities, ISO standard, coding conventions, -
Resource Management and Tuples in C∀
Resource Management and Tuples in C8 by Robert Schluntz A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Master of Mathematics in Computer Science Waterloo, Ontario, Canada, 2017 © Robert Schluntz 2017 I hereby declare that I am the sole author of this thesis. This is a true copy of the thesis, including any required final revisions, as accepted by my examiners. I understand that my thesis may be made electronically available to the public. ii Abstract C8 is a modern, non-object-oriented extension of the C programming language. This thesis addresses several critical deficiencies of C, notably: resource management, a limited function- return mechanism, and unsafe variadic functions. To solve these problems, two fundamental language features are introduced: tuples and constructors/destructors. While these features exist in prior programming languages, the contribution of this work is engineering these features into a highly complex type system. C is an established language with a dedicated user-base. An important goal is to add new features in a way that naturally feels like C, to appeal to this core user-base, and due to huge amounts of legacy code, maintaining backwards compatibility is crucial. iii Acknowledgements I would like to thank my supervisor, Professor Peter Buhr, for all of his help, including reading the many drafts of this thesis and providing guidance throughout my degree. This work would not have been as enjoyable, nor would it have been as strong without Peter’s knowledge, help, and encouragement. I would like to thank my readers, Professors Gregor Richards and Patrick Lam for all of their helpful feedback. -
CFFI Documentation Release 1.5.2
CFFI Documentation Release 1.5.2 Armin Rigo, Maciej Fijalkowski February 13, 2016 Contents 1 What’s New 3 1.1 v1.5.2...................................................3 1.2 v1.5.1...................................................3 1.3 v1.5.0...................................................3 1.4 v1.4.2...................................................3 1.5 v1.4.1...................................................3 1.6 v1.4.0...................................................3 1.7 v1.3.1...................................................4 1.8 v1.3.0...................................................4 1.9 v1.2.1...................................................5 1.10 v1.2.0...................................................5 1.11 v1.1.2...................................................5 1.12 v1.1.1...................................................5 1.13 v1.1.0...................................................6 1.14 v1.0.3...................................................6 1.15 v1.0.2...................................................6 1.16 v1.0.1...................................................6 1.17 v1.0.0...................................................6 2 Installation and Status 7 2.1 Platform-specific instructions......................................8 3 Overview 11 3.1 Simple example (ABI level, in-line)................................... 11 3.2 Out-of-line example (ABI level, out-of-line).............................. 12 3.3 Real example (API level, out-of-line).................................. 13 3.4 Struct/Array Example -
Formally Verifying Webassembly with Kwasm
Formally Verifying WebAssembly with KWasm Towards an Automated Prover for Wasm Smart Contracts Master’s thesis in Computer Science and Engineering RIKARD HJORT Department of Computer Science and Engineering CHALMERS UNIVERSITY OF TECHNOLOGY UNIVERSITY OF GOTHENBURG Gothenburg, Sweden 2020 Master’s thesis 2020 Formally Verifying WebAssembly with KWasm Towards an Automated Prover for Wasm Smart Contracts RIKARD HJORT Department of Computer Science and Engineering Chalmers University of Technology University of Gothenburg Gothenburg, Sweden 2020 Formally Verifying WebAssembly with KWasm Towards an Automated Prover for Wasm Smart Contracts RIKARD HJORT © RIKARD HJORT, 2020. Supervisor: Thomas Sewell, Department of Computer Science and Engineering Examiner: Wolfgang Ahrendt, Department of Computer Science and Engineering Master’s Thesis 2020 Department of Computer Science and Engineering Chalmers University of Technology and University of Gothenburg SE-412 96 Gothenburg Telephone +46 31 772 1000 Cover: Conceptual rendering of the KWasm system, as the logos for K ans Web- Assembly merged together, with a symbolic execution proof tree protruding. The cover image is made by Bogdan Stanciu, with permission. The WebAssembly logo made by Carlos Baraza and is licensed under Creative Commons License CC0. The K logo is property of Runtime Verification, Inc., with permission. Typeset in LATEX Gothenburg, Sweden 2020 iv Formally Verifying WebAssembly with KWasm Towards an Automated Prover for Wasm Smart Contracts Rikard Hjort Department of Computer Science and Engineering Chalmers University of Technology and University of Gothenburg Abstract A smart contract is immutable, public bytecode which handles valuable assets. This makes it a prime target for formal methods. WebAssembly (Wasm) is emerging as bytecode format for smart contracts. -
Intro to Javascript
1 Intro to Javascript CS380 Client Side Scripting 2 CS380 Why use client-side programming? 3 PHP already allows us to create dynamic web pages. Why also use client-side scripting? client-side scripting (JavaScript) benefits: usability : can modify a page without having to post back to the server (faster UI) efficiency : can make small, quick changes to page without waiting for server event-driven : can respond to user actions like clicks and key presses CS380 Why use client-side programming? 4 server-side programming (PHP) benefits: security : has access to server's private data; client can't see source code compatibility : not subject to browser compatibility issues power : can write files, open connections to servers, connect to databases, ... CS380 What is Javascript? 5 a lightweight programming language ("scripting language") used to make web pages interactive insert dynamic text into HTML (ex: user name) react to events (ex: page load user click) get information about a user's computer (ex: browser type) perform calculations on user's computer (ex: form validation) CS380 What is Javascript? 6 a web standard (but not supported identically by all browsers) NOT related to Java other than by name and some syntactic similarities CS380 Javascript vs Java 7 interpreted, not compiled more relaxed syntax and rules fewer and "looser" data types variables don't need to be declared errors often silent (few exceptions) key construct is the function rather than the class "first-class" functions are used in many situations contained within a web page and integrates with its HTML/CSS content CS380 Javascript vs Java 8 + = CS380 JavaScript vs.