Fancy Some Chips for Your TeaStore? Modeling the Control of an Adaptable Discrete System

As the demand for web applications grows, so does the demand for tools that support them. As a general rule, such tools extend general purpose programming languages, like Servlets/Jsp [2] does for Java [4], or define their own programming language, like PHP [3]. But there is no established engine for web applications written with C++. This work presents technical challenges that were faced when developing T++, an engine that supports web application development with C++.

The iData Toolkit is a toolkit that allows programmers to create interactive, type-safe, dynamic web applications with state on a high level of abstraction. The key element of this toolkit is the iData element. An iData element is a form that is generated automatically from a type definition and that can be plugged in in the web page of a web application. In this paper we show how this automatic generation of forms has been implemented. The technique relies essentially on generic programming. It has resulted in a concise and flexible implementation. The kernel of the implementation can be reused for any graphical package. The iData Toolkit is an excellent demonstration of the expressive power of modern generic (poly-typical) programming techniques.

Web applications typically interact with a back-end database to retrieve persistent data and then present the data to the user as dynamically generated output, such as HTML web pages. However, this interaction is commonly done through a low-level API by dynamically constructing query strings within a general-purpose programming language, such as Java. This low-level interaction is ad hoc because it does not take into account the structure of the output language. Accordingly, user inputs are treated as isolated lexical entities which, if not properly sanitized, can cause the web application to generate unintended output. This is called a command injection attack , which poses a serious threat to web application security. This paper presents the first formal definition of command injection attacks in the context of web applications, and gives a sound and complete algorithm for preventing them based on context-free grammars and compiler parsing techniques. Our key observation is that, for an attack to succeed, the input that gets propagated into the database query or the output document must change the intended syntactic structure of the query or document. Our definition and algorithm are general and apply to many forms of command injection attacks. We validate our approach with SqlCheckS , an implementation for the setting of SQL command injection attacks. We evaluated SqlCheckS on real-world web applications with systematically compiled real-world attack data as input. SqlCheckS produced no false positives or false negatives, incurred low runtime overhead, and applied straightforwardly to web applications written in different languages.

Web applications typically interact with a back-end database to retrieve persistent data and then present the data to the user as dynamically generated output, such as HTML web pages. However, this interaction is commonly done through a low-level API by dynamically constructing query strings within a general-purpose programming language, such as Java. This low-level interaction is ad hoc because it does not take into account the structure of the output language. Accordingly, user inputs are treated as isolated lexical entities which, if not properly sanitized, can cause the web application to generate unintended output. This is called a command injection attack, which poses a serious threat to web application security. This paper presents the first formal definition of command injection attacks in the context of web applications, and gives a sound and complete algorithm for preventing them based on context-free grammars and compiler parsing techniques. Our key observation is that, for an attack to succeed, the input that gets propagated into the database query or the output document must change the intended syntactic structure of the query or document. Our definition and algorithm are general and apply to many forms of command injection attacks. We validate our approach with SqlCheckS, an implementation for the setting of SQL command injection attacks. We evaluated SqlCheckS on real-world web applications with systematically compiled real-world attack data as input. SqlCheckS produced no false positives or false negatives, incurred low runtime overhead, and applied straightforwardly to web applications written in different languages.

Programmable Rewriting Strategies in Haskell: — White Paper —

Development of a web-resource today is a very frequent and not always simple task. Especially if we are not talking about a static one-page website, but about a dynamic web application with an unlimited number of pages, as well as the ability to withstand heavy loads, typical of such projects. To solve these problems, there are very few ready-made solutions. Of the best ones, perhaps, only WebDSL can be distinguished, but even it has a number of drawbacks inherited from the Java project implementation language, such as, for example, low flexibility, high performance costs and the need to install a java-machine. The development process was carried out using a relatively low-level C++ general purpose programming language, which saved the project from the problems that its competitors faced, ensured high interpreter performance and cross-platform system-wide. The authors described in detail the selected means of the meta-management of the access rights of the BlockSet project, as well as the syntax of their use in the declarative highly abstract subject-oriented language BML, using simple and accessible examples to demonstrate the conciseness, but the constructiveness of the selected syntax solutions. The results obtained are of great value, as they significantly simplify the further process of administering a web resource, which is also one of the main tasks of the BlockSet project. Thus, the BML language, together with the system of access rights, provides flexible, powerful, and at the same time fairly simple and understandable methods for organizing the required system, which corresponds to the project’s paradigms on flexibility and a low threshold of entry, and also significantly optimizes the development process.

<p>Control of complex systems is one of important files in complex systems, that not only relies on the essence of complex systems which is denoted by the core concept – emergence, but also embodies the elementary concept in control theory. Aiming at giving a clear and self-contained description of emergence, the paper introduces a formal way to completely describe the formation and dynamics of emergence in complex systems. Consequently, this paper indicates the Emergence-Oriented Control methodology that contains three kinds of basic control schemes: the direct control, the system re-structuring and the system calibration. As a universal ontology, the Emergence-Oriented Control provides a powerful tool for identifying and resolving control problems in specific systems.</p>

This paper reconsiders the threat posed by Shacham's -- a technique by which W-xor-X-style hardware protections are evaded via carefully crafted stack frames that divert control flow into the middle of existing variable-length x86 instructions -- creating short new instructions streams that then return. We believe this attack is both more general and a greater threat than the author appreciated. In fact, the vulnerability is not limited to the x86 architecture or any particular operating system, is readily exploitable, and bypasses an entire category of malware protections. In this paper we demonstrate general return-oriented programming on the SPARC, a fixed instruction length RISC architecture with structured control flow. We construct a Turing-complete library of code gadgets using snippets of the Solaris libc, a general purpose programming language, and a compiler for constructing return-oriented exploits. Finally, we argue that the threat posed by return-oriented programming, across all architectures and systems, has negative implications for an entire class of security mechanisms: those that seek to prevent malicious computation by preventing the execution of malicious code.

BackgroundMany HIV databases and applications focus on a limited domain of HIV knowledge. Since even a “simple” organism like HIV represents a very complex system with many interacting elements, the fractured structure of existing databases and applications likely limits our ability to investigate and understand HIV. To facilitate research, therefore, we have built HIVToolbox, which integrates much of the knowledge about HIV proteins and presents the data in an interactive web application. HIVToolbox allows quick and convenient hypotheses generation, experiment interpretation, and potential new drug structure creation.MethodsHIVToolbox was built as a standard three-tier J2EE web application, consisting of 1) an underlying relational MySQL database, 2) a set of standard Java data access objects that pull data from the database, and 3) a set of dynamic web pages the user interacts with. HIV-1 data from external sources such as the Protein Data Bank, NCBI, Los Alamos, etc. was collected, curated, and stored in the HIVToolbox database. Additional data, such as homology and position statistics matrices, was generated from existing data. Since version 1, drug binding site and drug resistant mutation data has also been added.ResultsHIVToolbox was used to create several new hypotheses about HIV-1 integrase, including predicting the location of a CK2 phosphorylation site, which was later confirmed by experiment. A new version of HIVToolbox support display of the 3D locations of drug resistant mutations on surface plots of HIV proteins and the drug binding sites for structures of complexes of HIV proteins with drugs.ConclusionHIVToolbox is an open-access web application that allows virologists and structural biologists to access detailed information about HIV-1 proteins, such as sequence, structure, functional sites and relationships, homology, drug binding sites, and drug resistant mutations, and to immediately see the relationships between any or all of them. Weblink: [http://hivtoolbox.bio-toolkit.com]

The article explores in detail the methodologies for developing web applications for medical clinics using the popular React library. The main goal of this study is the analysis of modern approaches to the creation of web applications that meet the specific requirements of medical institutions. Particular attention is paid to the functional and non-functional characteristics that are critical to such systems, including data security, user experience, integration with existing systems, and compliance with regulatory standards. First of all, a comprehensive analysis of the requirements of medical clinics for web applications was carried out. Data security is one of the most important aspects as healthcare institutions work with sensitive information. The study examines methods for ensuring the confidentiality and integrity of medical data, including compliance with HIPAA and GDPR standards. React makes it easy to integrate modern security tools such as JWT (JSON Web Tokens) for authentication and authorization, and use secure HTTP connections for data transfer. In addition, special attention is paid to the user experience (UX/UI), which should ensure the convenience and efficiency of using the web application by both medical personnel and patients. React allows you to create dynamic and interactive interfaces that can adapt to different devices and screens, thus providing a high-quality user experience. This is especially important for medical applications, where the accuracy and speed of interaction can affect the quality of healthcare delivery. A detailed description of best practices and approaches to web application development using React is provided. A component architecture is considered, which provides modularity and code reuse, which is a key factor in creating scalable and easily maintainable applications. Different methods of state management in the application, such as the use of Context API and Redux, have been explored, which allows for efficient data management and stable operation of the application. Guidelines for configuring routing using the React Router library are described, allowing you to create dynamic and multi-page applications while providing smooth navigation and a good user experience. In addition, ways to ensure application security are considered, including protection against XSS attacks, CSRF and other types of vulnerabilities, which is critical in medical applications. The article provides specific recommendations for implementing a web application for a medical clinic. They include practical code examples that demonstrate the implementation of key functionalities such as user registration and authentication, medical record processing, and database interaction. The process of setting up the infrastructure for development, testing and deployment of the application is described, including the use of CI/CD tools to automate these processes, which contributes to increasing the efficiency of development and the quality of the final product. The article provides valuable information for developers who seek to create effective and secure web applications for medical clinics using modern technologies. The conclusions and recommendations presented in the study will help ensure high quality and compliance of the developed solutions with modern industry standards and requirements, which will contribute to increasing the efficiency of the work of medical institutions and the quality of medical services provided to patients

Chapter 33 - From Novice to expert

Volumes of information available from network information services have been increasing considerably in recent years. Users' satisfaction with an information service depends very much on the quality of the network information retrieval (NIR) system used to retrieve information. The construction of such a system involves two major development areas: user interface design and the implementation of NIR protocols.In this paper we describe and discuss the possibilities of using formal methods of protocol converter design to construct the part of an NIR system client that deals with network communication. If this approach is practicable it can make implementation of NIR protocols more reliable and amenable to automation than traditional designs using general purpose programming languages. This will enable easy implementation of new NIR protocols custom-tailored to specialized NIR services, while the user interface remains the same for all these services.Based on a simple example of implementing the Gopher protocol client we conclude that the known formal methods of protocol converter design are generally not directly applicable for our approach. However, they could be used under certain circumstances when supplemented with other techniques which we propose in the discussion.

Choosing the Event-B formal method to model and develop distributed railway interlocking systems can give us a great advantage over the general purpose programming languages, especially in case of the safety analysis of these systems. Despite its many benefits, Event-B suffers from an efficient reuse mechanism, which is highly disadvantageous in the development of large interlocking systems. In this paper we propose a structured approach to modelling and developing large geographical interlocking systems, combining the communication models of session types with the railway entity models of Event-B. This work combines Event-B with a component-based reuse strategy realized with session types and consists of an Event-B extension with communication primitives to enable communication between the railway entities, a projection of session type specifications and a verification mechanism for these specifications to ensure global safety by the local verification of entities.

This article surveys principles for the design and development of microcomputer-based instructional software. A set of design guidelines based upon existing research are outlined. Three approaches to authoring software are examined: general purpose programming languages, author languages, and authoring systems. The tradeoffs in using these three approaches are outlined. The implications of research in automated instructional development systems and intelligent tutoring systems are discussed.

Object oriented (OO) is the most accepted object modeling languages nowadays. Although OO languages are successful in modeling real world entities, nevertheless, there is little to no support for modeling state of object precisely in code. To overcome this problem, a new general purpose programming language is proposed that is built on two paradigms which are typestate-oriented and permission-based. One of the most vital factor for every language to be accepted and effective for users is having an enhanced standard library and clearly one of the most important parts is Input and Output (I/O) Application Programming Interface (API). One of a new programming language is Plaid language. Since the Plaid is at its early stage of development, I/O features provided by the Plaid standard library are very basic and limited. This paper presents I/O API that we have developed for the Plaid based on the features provided by Java I/O API. For the evaluation we used two metrics which are the number of features provided by I/O API, and the number of exceptions eliminated by using Plaid and typestate-oriented programming language.