Automated verification of role-based access control security models recovered from dynamic web applications

(ProQuest: ... denotes formulae omitted.)1 Research Premises and HypothesisMaintenance costs have a consistent weight in the total costs generated by an application during its entire lifecycle. Previously conducted research and studies that focus on software maintenance support this claim. In [2], the 60/60 rule of software is depicted. The rule claims that maintenance accounts for 60% of the total costs generated by a software in its entire lifecycle. Enhancement or perfective [3] maintenance tasks account for 60% of all the costs generated by maintenance [2], whereas error correction or corrective [3] maintenance tasks account only for 17% of total maintenance costs [2]. In [4] it's stated that software applications evolve over time to meet the changing needs which leads to maintenance generating 67% of the applications total lifecycle costs. In [5] it is argued that maintenance typically accounts for 75% or more of the total software workload. Other relevant research place maintenance costs at 90% [6], 75% [7], 90% [8] or at 60% to 70% [9] of the overall application's lifecycle cost. It is therefore of paramount importance to accurately estimate maintenance cost before implementing a software project in order to better comprehend the total costs associated with developing and owing a software application. Better understanding maintenance costs will provide valuable information regarding resource planning and the appropriate time to decommission the application.The cost of maintenance is directly determined by the number of people involved in the maintenance process and the number of hours each person invests in the maintenance tasks. Thus in order to estimate maintenance cost one needs to estimate the effort invested in the maintenance process. The maintenance effort is expressed in man-hours which entails the number of ours dedicated by the maintenance team to implementing maintenance tasks. Maintenance in web applications has two main components: content maintenance and technical maintenance.Content maintenance requires performing tasks of a non-technical nature like updating product inventory and information, adding news or articles, managing blog posts, updating contact or brand and visual identity information and moderating user comments or messages. Content maintenance team staffing and therefore content maintenance effort is determined by the web application's size [1].According to [1] and as presented in Table 1, content maintenance cost is determined by the number of hours required to keep the web application up to date in terms of content. The larger the application the more hours need to be invested in keeping it up to date in terms of content. The more content changes in an application the more technical maintenance tasks are generated. Technical maintenance tasks are generated because content managers spot bugs or request new functionality to help keep the content up to date. Therefore, content update frequency is a factor that impacts maintenance effort and cost.Technical maintenance requires adding new functionality, performing regular back-ups, monitoring website outages, checking IP reputation, checking DNS configuration, test website speed, check for broken links, perform software updates if third party software was used when developing the web application, monitor traffic statistics and review search engine indexing.According to [1] and as presented in Table 2, technical team stuffing is determined by the level of complexity built into the web application. Thus, a Basic web application which is characterized by static content build mainly using front-end technologies like HTML, CSS and JavaScript will require no more than 1 person to perform maintenance tasks. A Dynamic web application which stores its content in a database and has functionality which is powered by PHP, Java, ASP.NET, Python, Ruby or any other high-level programming language will require 1 to 2 persons to perform maintenance tasks. …

Dynamic web pages composed of inter-woven (tangled) source code written in multiple programming languages (e.g., HTML, PHP, JavaScript, CSS) makes it difficult to analyze and manage clones in web applications. Despite more than a decade of research on software clones, there are not many studies towards the investigation of code clones in web applications. In this paper, we present an in-depth study on the patterns (i.e., forking and templating) of exact and near-miss code clones in two industrial dynamic web applications having distinct architecture. The findings of our study confirm the believed patterns for cloning and suggest that specialized techniques and tool support are necessary for effectively managing clones in the tangled source code of dynamic web applications.

Dynamic Web applications, such as e-commerce Web application, extensively use databases as backend servers. These Web applications are highly dependent on the efficiency with which the Web databases can be accessed. A dynamic Web page consists of many small fragments of scripting languages, called Web views, which may require access to data in disparate databases. These Web views when materialized can enhance the efficiency of database access. An e-commerce Web application has large number of users involved in various personalized interactive activities. These generate a stream of Web page accesses and modification requests that necessitate taking dynamic decisions for selecting Web views for materialization, which minimize the average access time of Web views. In this paper, a Web view selection algorithm (WVSA) that selects Web views for materialization is proposed. Experimental results suggest that materializing Web views using WVSA increases the efficiency of Web view accesses.

The Rapid growth of internet resulted in feature rich and dynamic web applications. This increase in features also introduced completely under estimated attack vectors. Cross site scripting attacks, SQL Injection and malicious file execution are the most dominant classes of web vulnerabilities reported by OWASP 2011. These attacks make use of vulnerabilities in the code of web applications, resulting in serious consequences, such as theft of cookies, passwords and other personal credentials. It is caused by scripts, which do not sanitize user input. Several server-side counter measures for XSS attacks do exist, but such techniques have not been universally applied, because of their deployment overhead. The existing client-side solutions degrade the performance of client's system resulting in a poor web surfing experience. We present automata-based symbolic string analyses (XHunter)for automatic verification of string manipulating programs we compute the pre and post conditions of common string functions using deterministic finite automata (DFAs). Experiment result shows that our approach finds large number of malicious attacks in web application.

In software testing, different testers focus on different aspects of the software such as functionality, performance, design, and other attributes. While many tools and coverage metrics exist to support testers at the code level, not much support is targeted for testers who want to inspect the output of a program such as a dynamic web application. To support this category of testers, we propose a family of output-coverage metrics (similar to statement, branch, and path coverage metrics on code) that measure how much of the possible output has been produced by a test suite and what parts of the output are still uncovered. To do that, we first approximate the output universe using our existing symbolic execution technique. Then, given a set of test cases, we map the produced outputs onto the output universe to identify the covered and uncovered parts and compute output-coverage metrics. In our empirical evaluation on seven real-world PHP web applications, we show that selecting test cases by output coverage is more effective at identifying presentation faults such as HTML validation errors and spelling errors than selecting test cases by traditional code coverage. In addition, to help testers understand output coverage and augment test cases, we also develop a tool called WebTest that displays the output universe in one single web page and allows testers to visually explore covered and uncovered parts of the output.

The iData Toolkit is a toolkit that allows programmers to create interactive, type-safe, dynamic web applications with state on a high level of abstraction. The key element of this toolkit is the iData element. An iData element is a form that is generated automatically from a type definition and that can be plugged in in the web page of a web application. In this paper we show how this automatic generation of forms has been implemented. The technique relies essentially on generic programming. It has resulted in a concise and flexible implementation. The kernel of the implementation can be reused for any graphical package. The iData Toolkit is an excellent demonstration of the expressive power of modern generic (poly-typical) programming techniques.

A framework defined as a structure thatsupports the development of dynamic websites, web applications, and services. Framework code and design are often reusable to assist customization, resource service, and API-related tasks. This study discussed current practice to help a developer understand PHP frameworks adoption for web application development. Three approaches were selected to understand the features suitability of the PHP frameworks: the systematic approach, score criteria evaluation, and PHP framework technical factors. A comparison of 23 different frameworks features also has been studied that involves features such as ORM, Code Generator, Template Engine, and CRUD Generator. Besides PHP framework features, understanding the basic core PHP to build web application would help a lot in learning PHP frameworks. Moreover, new developers should not limit themselves to a particular PHP framework only but also allow themselves to explore various PHP frameworks in the development of web application projects.

In a dynamic web application, client-side code is often dynamically generated from server-side code. Client-side program entities such as HTML presentation elements and Javascript functions/variables are embedded within server-side string literals or variables' values. However, existing tools for code maintenance such as automatic renaming support only work for program entities in a single language on either the server side or the client side. In this paper, we introduce BabelRef, a novel tool that is able to automatically identify and rename client-side program entities and their references that are embedded within server-side code.

Nowadays, Web Applications (WAs) are complex software sys- tems, used by multiple users with different roles and often devel- oped to support and manage business processes. Due to the chang- ing nature of the supported processes, WAs need to be easily and quickly modified, to adapt and align them to the processes they support. In recent years, Model Driven Engineering (MDE) ap- proaches have been proposed and used to develop and evolveWAs. However, the definition of appropriate MDE approaches for the de- velopment of flexible process-centric WAs is still limited. In par- ticular, (flexible) workflow models have never been integrated with the models (e.g., presentation, information models) used in MDE approaches to develop this type of applications. In this paper, we present M3D (Model Driven Development with Declare), a tool for developingWAs that integrates three MDE metamodels used to represent the main components of aWA with the metamodel of De- clare, a declarative language to model business processes. The tool exploits and combines the declarative nature of Declare and the ad- vantages of MDE to get an efficient roundtrip engineering support to develop and evolve flexible process-centric WAs.

Currently, the Taiwan Electronic Medical Record Exchange Center uses the Clinical Document Architecture (CDA) framework, which is based on the international medical standard. The CDA R2 standard, defined in 2005, is used for cross-institution retrieval of electronic medical records (Ministry of Health and Welfare, Information Department, 2021). However, CDA R2 only supports the exchange of clinical documents and is limited to the XML format. Due to the lack of a standardized framework for medical data exchange in Taiwan, different standards and specifications result in different data interface methods between systems, requiring customization for each system by healthcare institutions or the government. The inconsistency in data formats requires healthcare institutions and the government to spend more time on data parsing and mapping, resulting in slow integration of medical data. In this study, we simulated healthcare institutions using Fast Healthcare Interoperability Resources (FHIR) for medical information exchange and utilized the exchanged medical information to create a dynamic dashboard to assist healthcare professionals in making medical decisions. To ensure information security, we employed Hyper Text Transfer Protocol Secure (HTTPS) for secure transmission, which encrypts the transmitted medical record data using the Transport Layer Security (TLS) protocol, preventing deliberate interception and tampering of medical record data between the two systems. Finally, to test the load and performance of static and dynamic resources and web applications, we conducted a system performance evaluation using Apache JMeter. The results of this study demonstrate that replacing the gateway of the Electronic Medical Record Exchange Center with an FHIR server effectively reduces the time and cost spent by developers on data format conversion while also mitigating the information security risks associated with the previous VPN solution. Additionally, by utilizing dynamic charts, healthcare professionals are assisted in making medical decisions.

Introduction. Today we enter an era where the use of technology in everyday life is very natural. The use of this technology turned out to pose a challenge for information providers, one of them was the library. The library must be able to present information that collaborates with technology so that information can be conveyed effectively and efficiently to its users. One of them is by providing library websites using ASP.Net, which is server-side technology to develop web applications based on Microsoft .NET framework. Thus, libraries can create dynamic sites and web applications that are interactive, easy to use, easy to develop.
 Data Collection Method. In collecting data in this paper the writer uses data collection methods in the form of 
 Results and Discussions. This article discusses the history of ASP. Net and its objects namely Namespace, Web Form, Basic Web Form Syntax, Class Page, Request Object, Respone Object, Server Object
 Conclusions. ASP.Net has many objects and is easy to use. Therefore, ASP.NET can be one of the recommendations for use in creating Web libraries

Numerous vulnerabilities have a tendency to taint modern real-world web applications, allowing attackers in retrieving sensitive information and exploiting genuine web applications as a platform for malware activities. Moreover, computing techniques are evolved from the large desktop computer systems to the devices like smartphones, smart watches and goggles. This needs to be ensure that these devices improve their usability and will not be utilized for attacking the personal credentilas (such as credit card numbers, transaction passwords, etc.) of the users. Therefore, there is a need of security architecture over the user's credentials so that no unauthorized user can access it. This chapter summarizes various security models and techniques that are being discovered, studied and utilized extensively in order to ensure computer security. It also discusses numerous security principles and presents the models that ensure these security principles. Security models (such as access control models, information flow models, protection ring, etc.) form the basis of various higher level and complex models. Therefore, learning such security models is very much essential for ensuring the security of the computer and cyber world.

No abstract available.

This paper presents a React.js-based redevelopment of Quml Technologies LLP's static HTML website into a dynamic, scalable platform aimed at improving content management and user experience. The legacy site required extensive manual HTML updates, causing operational delays. The new system integrates a headless Content Management System (CMS) using Strapi, enabling non-technical staff to independently manage content via a user-friendly interface. Responsive design was achieved with Tailwind CSS, while performance optimizations including lazy loading, Server-Side Rendering (SSR), and Static Site Generation (SSG) enhanced site speed and accessibility. Post-implementation metrics showed a 45% reduction in page load times and a 30% improvement in SEO scores using Google Lighthouse audits. These enhancements not only resolved existing bottlenecks but established a maintainable, future-ready framework for continuous business growth and digital scalability.

Query understanding is essential in modern relevance systems, where user queries are often short, ambiguous, and highly context-dependent. Traditional approaches often rely on multiple task-specific Named Entity Recognition models to extract structured facets as seen in job search applications. However, this fragmented architecture is brittle, expensive to maintain, and slow to adapt to evolving taxonomies and language patterns. In this paper, we introduce a unified query understanding framework powered by a Large Language Model (LLM), designed to address these limitations. Our approach jointly models the user query and contextual signals such as profile attributes to generate structured interpretations that drive more accurate and personalized recommendations. The framework improves relevance quality in online A/B testing while significantly reducing system complexity and operational overhead. The results demonstrate that our solution provides a scalable and adaptable foundation for query understanding in dynamic web applications.