Dissertations / Theses on the topic 'JavaScript programs'

In this project I deal with basic description of source code obfuscation and size reduction techniques of programming languages. The project is primary aimed on scripting language named JavaScript and involved analysis of free obfuscation tools for this language. In the final stage I have created an application is based on theoretical scope of this project and able to obfuscate JavaScript source codes on different levels.

JavaScript has gained increased usage and attention the last years, but development and testing methods is still lagging behind.To mitigate some of these issues, this thesis brings together unit testing and JavaScript, using test-driven development as a methodology. Through exploration of these topics, the differentiators in a unit testing framework are considered. Existing frameworks are also discussed and how the terminology in JavaScript differs from traditional xUnit family frameworks.By creating and running a set of four test cases, both the general and unique features of JavaScript are tested in hand-picked frameworks, which were decided through an evaluation process. One of the contributions is based on this; a recommendation for a minimum set of test library features for a JavaScript unit testing framework.Various factors were found to differentiate the frameworks, and so the thesis also provides a Discovery test case to emphasize some of these aspects. This test case provides practitioners with a quick option for learning a new framework. The set of test cases can be applied to new frameworks to assess their functionality.As the thesis explores an area with little current research, suggestions for further work present several topics, ranging from system level JavaScript testing to quantitative studies building on the set of test cases.

Nous nous intéressons à la mise en œuvre des politiques de confidentialité et d'intégrité des données dans le contexte des applications Web côté client. Étant donné que la plupart des applications Web est développée en JavaScript, on propose des mécanismes statiques, dynamiques et hybrides pour sécuriser le flux d'information en Core JavaScript - un fragment de JavaScript qui retient ses caractéristiques fondamentales. Nous étudions en particulier: une sémantique à dispositif de contrôle afin de garantir dynamiquement le respect des politiques de sécurité en Core JavaScript aussi bien qu'un compilateur qui instrumente un programme avec le dispositif de contrôle proposé, un système de types qui vérifie statiquement si un programme respecte une politique de sécurité donnée, un système de types hybride qui combine des techniques d'analyse statique à des techniques d'analyse dynamique afin d'accepter des programmes surs que sa version purement statique est obligée de rejeter. La plupart des programmes JavaScript s'exécute dans un navigateur Web dans le contexte d'une page Web. Ces programmes interagissent avec la page dans laquelle ils sont inclus parmi des APIs externes fournies par le navigateur. Souvent, l'exécution d'une API externe dépasse le périmètre de l'interprète du langage. Ainsi, une analyse réaliste des programmes JavaScript côté client doit considérer l'invocation potentielle des APIs externes. Pour cela, on présente une méthodologie générale qui permet d'étendre des dispositifs de contrôle de sécurité afin qu'ils prennent en compte l'invocation potentielle des APIs externes et on applique cette méthodologie à un fragment important de l'API DOM Core Level 1<br>In this thesis, we address the issue of enforcing confidentiality and integrity policies in the context of client-side Web applications. Since most Web applications are developed in the JavaScript programming language, we study static, dynamic, and hybrid enforcement mechanisms for securing information flow in Core JavaScript --- a fragment of JavaScript that retains its defining features. Specifically, we propose: a monitored semantics for dynamically enforcing secure information flow in Core JavaScript as well as a source-to-source transformation that inlines the proposed monitor, a type system that statically checks whether or not a program abides by a given information flow policy, and a hybrid type system that combines static and dynamic analyses in order to accept more secure programs than its fully static counterpart. Most JavaScript programs are designed to be executed in a browser in the context of a Web page. These programs often interact with the Web page in which they are included via a large number of external APIs provided by the browser. The execution of these APIs usually takes place outside the perimeter of the language. Hence, any realistic analysis of client-side JavaScript must take into account possible interactions with external APIs. To this end, we present a general methodology for extending security monitors to take into account the possible invocation of arbitrary APIs and we apply this methodology to a representative fragment of the DOM Core Level 1 API that captures DOM-specific information flows

Low student success rates in introductory computer programming classes result in low student retention rates in computer science programs. For some sections of the course a traditional approach began using C# in the .Net development environment immediately. An experimental course redesign for one section was prepared that began with a study of HTML and JavaScript and focused on having students build web pages for several weeks; after that the experimental course used C# and the .Net development environment, covering all the material that was covered in the traditional sections. Students were more successful in the experimental section, with a higher percentage of the students passing the course and a higher percentage of the students continuing on to take at least one additional computer science course.<br>Department of Computer Science

The goal of this investigation has been to answer the questions “Which graphs should be used to display a special type of information?”, “What information does a company need to know that a server has gone down?” and “How should the layout of the developed program look to be called easy to understand and nice to use?”. The investigation was helped by the use of user-interviews and information that was collected during meetings. Part of the work was also the development of a prototype of a so called “dashboard” where functions where tested. These tests were then used to find out if the information was showed in a suitable manner. The information gained from these earlier tests has then been compiled into a result which shows that it is important to use y-over time graphs to show information over time. Fraction based information such as pro- cents are best showed with a filling graph, such as the speedometer graph. The second question was easily answered with a simple questionnaire. The result of this questionnaire showed that it was important for companies to know how much of the servers resources was used and how much data that was sent and received. Regarding the last question, the only notable result was the fact that the UI of the prototype was to light. This resulted in a color change for the UI to the darker spectrum.<br>Målet med denna undersökning har varit att besvara frågorna ”vilka grafer kan användas för att visa en speciell typ av information?”,”vilken information be- höver ett företag veta för att fastslå att en server är nere?” samt ”hur ska det utvecklade systemet vara upplagt för att vara enkelt att förstå samt trevligt att använda?”. Undersökningen har utförts med hjälp av användarintervjuer samt information som insamlats under möten. Utöver denna information så har också en prototyp av en så kallad ”dashboard” skapats där grafer samt funktioner som föreslagits undersökts för att återge om informationen samt funktionerna på gränssnittet visas på ett bra sätt. Denna information har då sammanställts till ett resultat som visar att det är viktigt att återvisa information över tid som gra- fer samt procentuell information med hjälp av en fyllande graf, då kanske en hastighetsmätargraf. Den andra frågan svarades enkelt på med hjälp av ett frågeformulär. Detta gav då som resultat att det var viktigt att se resursanvänd- ning på servrarna samt hur mycket information som skickas och mottages. Det- ta implementerades sedan i systemet. I de tidigare nämnda intervjuerna fram- kom det också att det var bra om systemet inte var ljust färgat då detta gjorde så att användarna blev enkelt distraherade av gränssnittet. På grund av detta så ändrades alla färger mot det mörkare spektrumet.

The aim of this master's thesis is to propose a dynamic user interface for a tool engaged in administration of leisure time and educational activities as a web application with an emphasis on frequented operations of daily programmes creation. This will be provided with a sophisticated searching of activities from which you can make a daily programme or on which basis of designated parameters can be achieved an automatical proposition of the programme. I intend to use accessible web technologies to make this real. The purpose of the project is study all these technologies and give shape to an effective user interface respecting needs of the target group of users.

Our reliance on software has been growing fast over the past decades as the pervasive use of computer and software penetrated not only our daily life but also many critical applications. As the computational power of multi-core processors and other parallel hardware keeps increasing, concurrent software that exploit these parallel computing hardware become crucial for achieving high performance. However, developing correct and efficient concurrent software is a difficult task for programmers due to the inherent nondeterminism in their executions. As a result, concurrency related software bugs are among the most troublesome in practice and have caused severe problems in recent years. In this dissertation, I propose a series of new and fully automated methods for verifying and debugging concurrent software. They cover the detection, prevention, classification, and repair of some important types of bugs in the implementation of concurrent data structures and client-side web applications. These methods can be adopted at various stages of the software development life cycle, to help programmers write concurrent software correctly as well as efficiently.<br>Ph. D.

Darbo tikslas – sudaryti ir praktiškai realizuoti metodą užmaskuoto kenkėjiško programinio kodo tinklalapiuose aptikimui pagal jo savybes. Darbe nagrinėjamos tinklalapiuose talpinamo užmaskuoto kenkėjiško kodo aptikimo problemos. Išanalizuoti kenkėjiško kodo maskavimo metodai ir jo savybės. Aprašytas užmaskuoto JavaScript kodo aptikimo metodas, paremtas nustatytomis užmaskuoto kodo savybėmis ir pagal jas aprašytais paieškos kriterijais: žodžio ilgiu, simbolių skaičiumi žodyje ir simbolių dažniu žodyje. Metodas pristatytas pranešime 14-oje Lietuvos jaunųjų mokslininkų konferencijoje „Mokslas - Lietuvos ateitis“, įvykusioje Vilniuje 2011 m. balandžio 15 d. Remiantis šiuo metodu atliktas tyrimas, kurio rezultatai rodo pasiūlyto metodo veiksmingumą – pasiektas 98% užmaskuoto kodo aptikimo tinklalapiuose tikslumas. Tyrimo rezultatai paskelbti straipsnyje, kuris priimtas spausdinimui recenzuojamame periodiniame mokslo žurnale „Jaunųjų mokslininkų darbai“. Darbą sudaro: įvadas, 6 skyriai, išvados, literatūros sąrašas, priedai. Darbo apimtis – 55 p. teksto be priedų, 23 iliustr., 4 lent., 44 bibliografiniai šaltiniai. Atskirai pridedami darbo priedai.<br>The aim of this thesis is to suggest and practically implement a method of malicious obfuscated code detection using its characteristics. In this thesis we analyze problems of obfuscated malicious code detection in websites, malicious code obfuscation techniques and obfuscated code characteristics. In this paper suggested method of malicious obfuscated code detection in websites using its characteristics is described. Method is based on three search characteristics: word size, number of characters in word and frequency of particular characters. Method was presented in the 14th Conference for Lithuania Junior Researchers SCIENCE FOR FUTURE held in Vilnius, April 15, 2011. An experiment based on this study was made. Results show the effectiveness of the proposed method – 98% accuracy of obfuscated code detection in websites was reached. Experiment results were published in an article, which is being published in a reviewed periodical academic journal "Young Scientists". Structure: introduction, 6 chapters, conclusions and suggestions, references. Thesis consists of – 55 p. text without appendixes, 23 pictures, 4 tables, 44 bibliographical entries. Appendixes included.

Developers often need to re-engineer distributed applications to address changes in requirements, made only after deployment. Much of the complexity of inspecting and evolving distributed applications lies in their distributed nature, while the majority of mature program analysis and transformation tools works only with centralized software. Inspired by business process re-engineering, in which remote operations can be insourced back in house to restructure and outsource anew, this dissertation brings an analogous approach to the re-engineering of distributed applications. Our approach introduces a novel automatic refactoring---Client Insourcing---that creates a semantically equivalent centralized version of a distributed application. This centralized version is then inspected, modified, and redistributed to meet new requirements. This dissertation demonstrates the utility of Client Insourcing in helping meet the changed requirements in performance, reliability, and security. We implemented Client Insourcing in the important domain of full-stack JavaScript applications, in which both the client and server parts are written in JavaScript, and applied our implementation to re-engineer mobile web applications. Client Insourcing reduces the complexity of inspecting and evolving distributed applications, thereby facilitating their re-engineering. This dissertation is based on 4 conference papers and 2 doctoral symposium papers, presented at ICWE 2019, SANER 2020, WWW 2020, and ICWE 2021.<br>Doctor of Philosophy<br>Modern web applications are distributed across a browser-based client and a remote server. Software developers need to optimize the performance of web applications as well as correct and modify their functionality. However, the vast majority of mature development tools, used for optimizing, correcting, and modifying applications work only with non-distributed software, written to run on a single machine. To facilitate the maintenance and evolution of web applications, this dissertation research contributes new automated software transformation techniques. These contributions can be incorporated into the design of software development tools, thereby advancing the engineering of web applications.

JavaScript has permeated into every aspect of the web experience in today's world, making it highly crucial to process it as quickly as possible. With the proliferation of HTML5 and its associated mobile web applications, the world is slowly but surely moving into an age where majority of the webpages will involve complex computations and manipulations within the JavaScript engine. Recent techniques like Just-in-Time (JIT) compilation have become commonplace in popular browsers like Chrome and Firefox, and there is an ongoing effort to further optimize them in the context of mobile systems. In order to fully take advantage of JavaScript-heavy webpages, it is important to first characterize the interaction of these webpages (both existing pages and modern HTML5 pages) with the different components of the JavaScript engine, viz. the interpreter, the method JIT, the optimizing compiler and the garbage collector. In this thesis, the aforementioned characterization work was leveraged to identify the limits of JavaScript optimizations. Subsequently, a particular optimization, i.e. Register Allocation heuristics was explored in detail on different types of JavaScript programs. This was primarily because the majority of the time (an average of 52.81%) spent in the optimizing compiler is for the register allocation stage alone. By varying the heuristics for register assignment, interval priority and spill selection, a clear idea is obtained about how it impacts certain types of programs more than others. This thesis also gives a preliminary insight into JavaScript applications and benchmarks, showing that these applications tend to be register-intensive, with large live intervals and sparse uses, and sensitive to array and string manipulations. A statically-selected optimal register allocation scheme outperforms the default register allocation scheme resulting in 9.1% performance improvement and 11.23% reduction in execution time on a representative mobile system.<br>text

碩士<br>國立交通大學<br>資訊科學與工程研究所<br>103<br>Due to the development and the popularity of Web applications, JavaScript is not only for assisting the display of items in websites but also be used for computation-intensive programs. The demand for higher performance JavaScript programs is growing. For decades, JavaScript engines have improved dramatically due to the introduced just-in-time (JIT) compilation techniques and some other optimizations. However, the nature of JavaScript language makes it difficult for further optimizations because its dynamic features make the program behavior unpredictable and hard to determine its type information at static time. In this thesis, we present an ahead-of-time JavaScript compiler, called JASM, which translates JavaScript programs into asm.js programs, which is a subset of the JavaScript language and has high-performance execution. subset of JavaScript and runs with high speeds. We also propose a data-flow-based type-inference system that infer all possible data types at static time. Our evaluations demonstrated that the proposed method is effective in improving the execution time of JavaScript programs in the test benchmarks on an average of 40x and 20x speedup on a PC and a mobile device, respectively.

碩士<br>國立交通大學<br>資訊科學與工程研究所<br>102<br>JavaScript is a dynamic language that is widely supported in modern Web browsers.JavaScript programs are usually executed by a JavaScript engine, which is implemented using an interpreter or a just-in-time compiler. However, the dynamic aspects of interpretation and run-time compilation intrinsically limit the performance of JavaScript programs. In this paper, we propose a JavaScript compiler, called JSComp,that statically translates partial JavaScript programs into Native Client modules or asm.js programs for improving the execution performance and also a hybrid execution model (a combination of static compilation and dynamic interpretation) for JavaScript programs so as to take advantages of high-performance execution in the compilation model and dynamic code evaluation in the interpretation model. Our evaluations demonstrated that the proposed mechanisms were effective in improving the execution performance of JavaScript programs in the SunSpider benchmark suite by an average of 50%.

碩士<br>銘傳大學<br>資訊管理學系碩士班<br>107<br>When developing a large software system, debugging is a very time-consuming process. As a result, Automatic Program Debug and Repair has become a hot research topic. In this thesis, we first review the Nopol system that can debug and repair Java programs, based on both the Test-Based Debug and Repair Model and the Single-Fault Model. Second, we revise Nopol to debug and repair JavaScript programs that are now popular in designing the front-end interface of web systems. Though Java and JavaScript share a lot of aspects, we point out that the latter one involves a lot of function calls that would cause a single-fault to become multiple faults that could not be debugged by the mechanism of Nopol. In addition, we propose a new mechanism to overcome this problem. Finally, we replace the brute-force patch generation process of Nopol with a new process that produces patches based on the special characteristics of JavaScript programs.

Software development process consists of various stages like design, implementation, and testing. Since programmers are considerably involved in these stages, their intuition and expertise play a vital role in the success of software deployment. Therefore, various tools have been developed that assist programmers in creating, debugging and managing their programs. Program analysis, the process of analyzing program behavior by examining its source code or execution, forms the basis of such software tools. In this thesis, we identify and address following three research gaps in the area of program analysis. Type-awareness in concolic testing Software testing is a widely used dynamic program analysis technique. It helps to determine the program correctness by executing it to identify undesired behaviors. Since manually writing effective test suite is challenging, various automated test generation approaches have been proposed. Concolic testing is one such approach that outputs a test suite for a given program with the intent of maximizing code coverage. This technique is shown to be very effective for statically typed languages. With the modernization of web programming, dynamically typed JavaScript has become a popular language. We study the extension of concolic testing for JavaScript programs. We show that, for JavaScript programs, such approach generates a large number of test cases that explore paths and types of the variables repeatedly. Due to the resultant sizable test suite, adaption of such technique becomes impractical. In our first work, we propose an effective approach that scales concolic testing by incorporating type-awareness in conventional concolic testing. Our experiments demonstrate that, for a significant percentage of the functions, type-aware concolic testing generates a small percentage (less than 5%) of the test cases as compared to conventional concolic testing. On average, this approach achieves over 97% of line coverage and over 94% of branch coverage for all the functions across all benchmarks. Our experimental results show that adapting type-aware concolic testing is as effective as conventional concolic testing in detecting bugs and achieving coverage, even with a small percentage of test cases. Test synthesis to detect redundant traversal bugs Test generation techniques like concolic testing focus on verifying the functional correctness of the program. Producing correct results is not the only requirement of the program. These results should also be achieved within budgeted time. Efficiency, another important aspect of the program, can be validated with performance testing. Our second work focuses on automated performance testing in the context of redundant traversal bugs. Such bugs occur when program fragment performs repetitive and same computations across loop iterations. Various static and dynamic analysis techniques have been proposed to detect such bugs automatically. However, the effectiveness of dynamic analyses is dependent on input test cases, and static analyses are less useful in validating the presence of this problem. We propose an approach to generate tests for exposing redundant traversal of loops automatically. Our experiments reveal the effectiveness of the proposed approach in generating 224 tests that reveal 46 bugs across seven libraries, including 34 previously unknown bugs. The tests generated using our approach significantly outperform the randomly generated tests in their ability to expose the inefficiencies, demonstrating the usefulness of our design. Performance hints for stable multithreaded systems Assuring correctness and efficiency of the sequential programs is easier as compared to multithreaded programs. This is mainly because the execution of multithreaded programs depends not only on the input but also on thread interleavings. Stable multithreaded systems restrict the set of possible schedules such that schedule remains unaffected for the given input, even with minor changes. This eases the process of bug reproduction and thereby guaranteeing correctness. However, the determinism imposed in these systems can potentially serialize the schedule resulting in performance degradation. Our third work focuses on automatically deriving performance hints so that such serialization can be avoided. Our experimental results demonstrate that we are able to reduce the overall execution time of programs by up to 34% when compared to the execution time where barriers are inserted manually. Moreover, we observe a performance improvement ranging from 38% to 88% as compared to programs without barriers. Our experimental results show that adapting PEGASUS to infer barriers for multiple versions of a source program is seamless. In this thesis, we motivate the problems mentioned above and discuss proposed solutions in detail. We implement above ideas, develop research prototypes, and study them on well known real-world programs. The ease in using these prototypes makes our proposed approach a viable contribution in designing techniques to develop software tools. All the tools that are developed as part of this thesis have been released publicly

La compréhension des objets dans les programmes orientés objet est une tâche impor- tante à la compréhension du code. JavaScript (JS) est un langage orienté-objet dyna- mique, et son dynamisme rend la compréhension du code source très difficile. Dans ce mémoire, nous nous intéressons à l’analyse des objets pour les programmes JS. Notre approche construit de façon automatique un graphe d’objets inspiré du diagramme de classes d’UML à partir d’une exécution concrète d’un programme JS. Le graphe résul- tant montre la structure des objets ainsi que les interactions entre eux. Notre approche utilise une transformation du code source afin de produire cette in- formation au cours de l’exécution. Cette transformation permet de recueillir de l’infor- mation complète au sujet des objets crées ainsi que d’intercepter toutes les modifications de ces objets. À partir de cette information, nous appliquons plusieurs abstractions qui visent à produire une représentation des objets plus compacte et intuitive. Cette approche est implémentée dans l’outil JSTI. Afin d’évaluer l’utilité de l’approche, nous avons mesuré sa performance ainsi que le degré de réduction dû aux abstractions. Nous avons utilisé les dix programmes de réfé- rence de V8 pour cette comparaison. Les résultats montrent que JSTI est assez efficace pour être utilisé en pratique, avec un ralentissement moyen de 14x. De plus, pour 9 des 10 programmes, les graphes sont suffisamment compacts pour être visualisés. Nous avons aussi validé l’approche de façon qualitative en inspectant manuellement les graphes gé- nérés. Ces graphes correspondent généralement très bien au résultat attendu. Mots clés: Analyse de programmes, analyse dynamique, JavaScript, profilage.<br>Understanding of objects in object-oriented programs is an important task for understanding the code. JavaScript (JS) is a dynamic object-oriented language, Its dynamic nature makes understanding its source code very difficult. In this thesis, we focus on object analysis in JS programs to automatically produce a graph of objects inspired by UML class diagrams from an execution trace. The resulting graph shows the structure of the objects as well as their interconnections. Our approach uses a source-to-source transformation of the original code in order to collect information at runtime. This transformation makes it possible to collect complete information with respect to object creations and property updates. From this information, we perform multiple abstractions that aim to generate a more compact and intuitive representation of objects. This approach has been implemented in the JSTI prototype. To evaluate our approach, we measured its performance and the graph compression achieved by our abstractions. We used the ten V8 benchmarks for this purpose. Results show that JSTI is efficient enough to be used in practice, with an average slowdown of around 14x. Moreover, for 9 out of the 10 studied programs, the generated object graphs are sufficiently small to be visualized directly by developers. We have also performed a qualitative validation of the approach by manually inspecting the generated graphs. We have found that the graphs generated by JSTI generally correspond very closely to the expected results. Keywords: Program analysis, dynamic analysis, JavaScript, profiling.

Indiana University-Purdue University Indianapolis (IUPUI)<br>Asynchronous JavaScript and XML (AJAX) is the primary method for enabling asynchronous communication over the Web. Although AJAX is providing warranted real-time capabilities to the Web, it requires unconventional programming methods at the expense of extensive resource usage. WebSockets, which is an emerging protocol, has the potential to address many challenges with implementing asynchronous communication over the Web. There, however, has been no in-depth study that quantitatively compares AJAX and WebSockets. This thesis therefore provides two contributions to Web development. First, it provides an experience report for adding real-time monitoring support over the Web to the Open-source Architecture of Software Instrumentation of Systems(OASIS), which is open-source real-time instrumentation middleware for distributed real-time and embedded (DRE) systems. Secondly, it quantitatively compares using AJAX and WebSockets to stream collected instrumentation data over the Web in real-time. Results from quantitative comparison between WebSockets and AJAX show that a WebSockets server consumes 50% less network bandwidth than an AJAX server; a WebSockets client consumes memory at constant rate, not at an increasing rate; and WebSockets can send up to 215.44% more data samples when consuming the same amount network bandwidth as AJAX.