BabelRef: detection and renaming tool for cross-language program entities in dynamic web applications

This paper presents an original Model-Driven-Engineering (MDE) approach to support the verification and testing of security properties in dynamic web applications. Based on a previously recovered UML-based fine-grained security model, the approach begins by transforming the model into a Prolog-based formal model. The Prolog model is then checked to verify whether the application conforms to specified access control security properties. We demonstrate the use of our method on the popular open source bulletin board system PhpBB 2.0, in the context of three test scenarios: testing for unauthorized access, web application security maintenance, and web application re-engineering.

Dynamic web pages composed of inter-woven (tangled) source code written in multiple programming languages (e.g., HTML, PHP, JavaScript, CSS) makes it difficult to analyze and manage clones in web applications. Despite more than a decade of research on software clones, there are not many studies towards the investigation of code clones in web applications. In this paper, we present an in-depth study on the patterns (i.e., forking and templating) of exact and near-miss code clones in two industrial dynamic web applications having distinct architecture. The findings of our study confirm the believed patterns for cloning and suggest that specialized techniques and tool support are necessary for effectively managing clones in the tangled source code of dynamic web applications.

Presentation of the new web interface of MarsSI, the martian surface data service

Dynamic Web applications, such as e-commerce Web application, extensively use databases as backend servers. These Web applications are highly dependent on the efficiency with which the Web databases can be accessed. A dynamic Web page consists of many small fragments of scripting languages, called Web views, which may require access to data in disparate databases. These Web views when materialized can enhance the efficiency of database access. An e-commerce Web application has large number of users involved in various personalized interactive activities. These generate a stream of Web page accesses and modification requests that necessitate taking dynamic decisions for selecting Web views for materialization, which minimize the average access time of Web views. In this paper, a Web view selection algorithm (WVSA) that selects Web views for materialization is proposed. Experimental results suggest that materializing Web views using WVSA increases the efficiency of Web view accesses.

(ProQuest: ... denotes formulae omitted.)1 Research Premises and HypothesisMaintenance costs have a consistent weight in the total costs generated by an application during its entire lifecycle. Previously conducted research and studies that focus on software maintenance support this claim. In [2], the 60/60 rule of software is depicted. The rule claims that maintenance accounts for 60% of the total costs generated by a software in its entire lifecycle. Enhancement or perfective [3] maintenance tasks account for 60% of all the costs generated by maintenance [2], whereas error correction or corrective [3] maintenance tasks account only for 17% of total maintenance costs [2]. In [4] it's stated that software applications evolve over time to meet the changing needs which leads to maintenance generating 67% of the applications total lifecycle costs. In [5] it is argued that maintenance typically accounts for 75% or more of the total software workload. Other relevant research place maintenance costs at 90% [6], 75% [7], 90% [8] or at 60% to 70% [9] of the overall application's lifecycle cost. It is therefore of paramount importance to accurately estimate maintenance cost before implementing a software project in order to better comprehend the total costs associated with developing and owing a software application. Better understanding maintenance costs will provide valuable information regarding resource planning and the appropriate time to decommission the application.The cost of maintenance is directly determined by the number of people involved in the maintenance process and the number of hours each person invests in the maintenance tasks. Thus in order to estimate maintenance cost one needs to estimate the effort invested in the maintenance process. The maintenance effort is expressed in man-hours which entails the number of ours dedicated by the maintenance team to implementing maintenance tasks. Maintenance in web applications has two main components: content maintenance and technical maintenance.Content maintenance requires performing tasks of a non-technical nature like updating product inventory and information, adding news or articles, managing blog posts, updating contact or brand and visual identity information and moderating user comments or messages. Content maintenance team staffing and therefore content maintenance effort is determined by the web application's size [1].According to [1] and as presented in Table 1, content maintenance cost is determined by the number of hours required to keep the web application up to date in terms of content. The larger the application the more hours need to be invested in keeping it up to date in terms of content. The more content changes in an application the more technical maintenance tasks are generated. Technical maintenance tasks are generated because content managers spot bugs or request new functionality to help keep the content up to date. Therefore, content update frequency is a factor that impacts maintenance effort and cost.Technical maintenance requires adding new functionality, performing regular back-ups, monitoring website outages, checking IP reputation, checking DNS configuration, test website speed, check for broken links, perform software updates if third party software was used when developing the web application, monitor traffic statistics and review search engine indexing.According to [1] and as presented in Table 2, technical team stuffing is determined by the level of complexity built into the web application. Thus, a Basic web application which is characterized by static content build mainly using front-end technologies like HTML, CSS and JavaScript will require no more than 1 person to perform maintenance tasks. A Dynamic web application which stores its content in a database and has functionality which is powered by PHP, Java, ASP.NET, Python, Ruby or any other high-level programming language will require 1 to 2 persons to perform maintenance tasks. …

The Rapid growth of internet resulted in feature rich and dynamic web applications. This increase in features also introduced completely under estimated attack vectors. Cross site scripting attacks, SQL Injection and malicious file execution are the most dominant classes of web vulnerabilities reported by OWASP 2011. These attacks make use of vulnerabilities in the code of web applications, resulting in serious consequences, such as theft of cookies, passwords and other personal credentials. It is caused by scripts, which do not sanitize user input. Several server-side counter measures for XSS attacks do exist, but such techniques have not been universally applied, because of their deployment overhead. The existing client-side solutions degrade the performance of client's system resulting in a poor web surfing experience. We present automata-based symbolic string analyses (XHunter)for automatic verification of string manipulating programs we compute the pre and post conditions of common string functions using deterministic finite automata (DFAs). Experiment result shows that our approach finds large number of malicious attacks in web application.

Chapter 3 - JavaBeans and Forms

In software testing, different testers focus on different aspects of the software such as functionality, performance, design, and other attributes. While many tools and coverage metrics exist to support testers at the code level, not much support is targeted for testers who want to inspect the output of a program such as a dynamic web application. To support this category of testers, we propose a family of output-coverage metrics (similar to statement, branch, and path coverage metrics on code) that measure how much of the possible output has been produced by a test suite and what parts of the output are still uncovered. To do that, we first approximate the output universe using our existing symbolic execution technique. Then, given a set of test cases, we map the produced outputs onto the output universe to identify the covered and uncovered parts and compute output-coverage metrics. In our empirical evaluation on seven real-world PHP web applications, we show that selecting test cases by output coverage is more effective at identifying presentation faults such as HTML validation errors and spelling errors than selecting test cases by traditional code coverage. In addition, to help testers understand output coverage and augment test cases, we also develop a tool called WebTest that displays the output universe in one single web page and allows testers to visually explore covered and uncovered parts of the output.

The iData Toolkit is a toolkit that allows programmers to create interactive, type-safe, dynamic web applications with state on a high level of abstraction. The key element of this toolkit is the iData element. An iData element is a form that is generated automatically from a type definition and that can be plugged in in the web page of a web application. In this paper we show how this automatic generation of forms has been implemented. The technique relies essentially on generic programming. It has resulted in a concise and flexible implementation. The kernel of the implementation can be reused for any graphical package. The iData Toolkit is an excellent demonstration of the expressive power of modern generic (poly-typical) programming techniques.

Cloud service capabilities can always be clearly indicated by Quality of Service (QoS) properties. The quality and effectiveness of cloud services can be measured at both client and server sides. The parameters such as response time, throughput and failure rate influence the QoS properties at the client side. These parameters may differ with the utilization of the application for the same service. The proposed Bayesian Personalized Ranking-based Rank Prediction Scheme (BPR-RPS) provides rank prediction of QoS properties on the client side, since client-side properties vary with the usage of the application. The proposed rank prediction framework provides ranking to the services when particular cloud services are requested by the client. Personalization of cloud providers and customers is made possible by concentrating on the item recommendation imposed on the cloud by creating user-specific ranking for a set of items. The past response of the user with respect to the item aids in decision-making. The proposed ranking framework includes the following modules: Computation of similarity index between the active and ad hoc users and finding of identical users based on similarity index values.

PHP is a dynamic language popularly used in Web development for writing server-side code to dynamically create multiple versions of client-side pages at run time for different configurations. A PHP program contains code to be executed or produced for multiple configurations/versions. That dynamism and multi-configuration nature leads to dangling references. Specifically, in the execution for a configuration, a reference to a variable or a call to a function is dangling if its corresponding declaration cannot be found. We conducted an exploratory study to confirm the existence of such dangling reference errors including dangling cross-language and embedded references in the client-side HTML/JavaScript code and in data-accessing SQL code that are embedded in scattered PHP code. Dangling references have caused run-time fatal failures and security vulnerabilities. We developed DRC, a static analysis method to detect such dangling references. DRC uses symbolic execution to collect PHP declarations/references and to approximate all versions of the generated output, and then extracts embedded declarations/references. It associates each detected declaration/reference with a conditional constraint that represents the execution paths (i.e. configurations/versions) containing that declaration/reference. It then validates references against declarations via a novel dangling reference detection algorithm. Our empirical evaluation shows that DRC detects dangling references with high accuracy. It revealed 83 yet undiscovered defects caused by dangling references.

No abstract available.

This paper presents a React.js-based redevelopment of Quml Technologies LLP's static HTML website into a dynamic, scalable platform aimed at improving content management and user experience. The legacy site required extensive manual HTML updates, causing operational delays. The new system integrates a headless Content Management System (CMS) using Strapi, enabling non-technical staff to independently manage content via a user-friendly interface. Responsive design was achieved with Tailwind CSS, while performance optimizations including lazy loading, Server-Side Rendering (SSR), and Static Site Generation (SSG) enhanced site speed and accessibility. Post-implementation metrics showed a 45% reduction in page load times and a 30% improvement in SEO scores using Google Lighthouse audits. These enhancements not only resolved existing bottlenecks but established a maintainable, future-ready framework for continuous business growth and digital scalability.

Query understanding is essential in modern relevance systems, where user queries are often short, ambiguous, and highly context-dependent. Traditional approaches often rely on multiple task-specific Named Entity Recognition models to extract structured facets as seen in job search applications. However, this fragmented architecture is brittle, expensive to maintain, and slow to adapt to evolving taxonomies and language patterns. In this paper, we introduce a unified query understanding framework powered by a Large Language Model (LLM), designed to address these limitations. Our approach jointly models the user query and contextual signals such as profile attributes to generate structured interpretations that drive more accurate and personalized recommendations. The framework improves relevance quality in online A/B testing while significantly reducing system complexity and operational overhead. The results demonstrate that our solution provides a scalable and adaptable foundation for query understanding in dynamic web applications.

Development of a web-resource today is a very frequent and not always simple task. Especially if we are not talking about a static one-page website, but about a dynamic web application with an unlimited number of pages, as well as the ability to withstand heavy loads, typical of such projects. To solve these problems, there are very few ready-made solutions. Of the best ones, perhaps, only WebDSL can be distinguished, but even it has a number of drawbacks inherited from the Java project implementation language, such as, for example, low flexibility, high performance costs and the need to install a java-machine. The development process was carried out using a relatively low-level C++ general purpose programming language, which saved the project from the problems that its competitors faced, ensured high interpreter performance and cross-platform system-wide. The authors described in detail the selected means of the meta-management of the access rights of the BlockSet project, as well as the syntax of their use in the declarative highly abstract subject-oriented language BML, using simple and accessible examples to demonstrate the conciseness, but the constructiveness of the selected syntax solutions. The results obtained are of great value, as they significantly simplify the further process of administering a web resource, which is also one of the main tasks of the BlockSet project. Thus, the BML language, together with the system of access rights, provides flexible, powerful, and at the same time fairly simple and understandable methods for organizing the required system, which corresponds to the project’s paradigms on flexibility and a low threshold of entry, and also significantly optimizes the development process.