Security-by-construction in web applications development via database annotations

Web applications are typically developed with hard time constraints and are often deployed with security vulnerabilities. Automatic web vulnerability scanners can help to locate these vulnerabilities and are popular tools among developers of web applications. Their purpose is to stress the application from the attacker's point of view by issuing a huge amount of interaction within it. Two of the most widely spread and dangerous vulnerabilities in web applications are SQL injection and cross site scripting (XSS), because of the damage they may cause to the victim business. Trusting the results of web vulnerability scanning tools is of utmost importance. Without a clear idea on the coverage and false positive rate of these tools, it is difficult to judge the relevance of the results they provide. Furthermore, it is difficult, if not impossible, to compare key figures of merit of web vulnerability scanners. In this paper we propose a method to evaluate and benchmark automatic web vulnerability scanners using software fault injection techniques. The most common types of software faults are injected in the web application code which is then checked by the scanners. The results are compared by analyzing coverage of vulnerability detection and false positives. Three leading commercial scanning tools are evaluated and the results show that in general the coverage is low and the percentage of false positives is very high.

Web application development from simple web pages to complex interactive platforms (including social networks, e-commerce systems, corporate portals) requires new approaches, tools and technologies. JavaScript libraries and frameworks play a special role in developing web applications, simplifying the creation of effective, scalable, and convenient interfaces. The purpose of the article is to research the problems and prospects of using React in combination with Redux when creating web applications with a complex structure, to assess the advantages of their joint use in comparison with similar tools and to develop the web application “FarmerProducts”. The research methodology consists of the main methodological approaches and technological tools for developing web applications. Such methods, in particular, are: system and comparative analysis – to identify the features of creating web applications; method of expert assessments, which involves the study of literary sources and information resources, conducting interviews and surveys of experts, as well as the processes of developing and testing scalable and high-performance web applications based on the use of React and Redux. The scientific novelty of the research is the analysis of modern tools (React, Angular, Vue. js) for developing web applications, identifying problems and prospects for their use, creating an author’s web application (using React and Redux), which includes an intuitive interface, a flexible database, simplifying the process of working with the application by using a stack of modern technologies. Conclusions. The paper analyses the problems and prospects of using modern web application development tools; focuses on React, which is suitable for different projects; conducts a comparative analysis of React with Angular, Vue. js and Svelte, identifies their main characteristics, advantages, disadvantages; demonstrates the dependence of the choice of tools on the project context (React in combination with Redux can provide an optimal balance between performance, flexibility and scalability); describes the author’s web application – the FarmerProducts online store; identifies further ways to improve this web application.

In the development and design of Web application, the choice of framework development is very important. A good framework development can speed up the development of Web application, reduce development costs and the workload of developers. Meanwhile, Web application has good expansibility and portability. The framework based on SpringMVC + Spring + Mybatis (SSM) has good performance and rapid development efficiency, gradually becoming a mainstream development framework of Web application.

Currently, mobile handheld device are being used increasingly for web access. This leads to the issue relating to the ease of use for users, which refers to not user-friendly web design, unorganized content and difficulty of information navigation. Based on literature analysis, design of physical features and functions for mobile devices are unique, as it should emphasize mobility, personality and flexibility features, apart from providing the added values, such as accessibility at anytime and anywhere access. However as most web applications are designed specifically for desktop environments, it is discovered that most web applications design are inappropriate for mobile devices. In other words, web sites design for desktop is unsuitable to be adopted for the mobile devices. Literature had stated that designing mobile web application approach differs from development ordinary web for desktop computer. Adapting the original web content dynamically to deal with the constraints of mobile handheld devices (the screen size and limited system resources and variation of user preferences) becomes very important. Combination of User Centred Design (UCD) and Service Science (SS) approach expected to enhance quality of the mobile web that can meet user satisfaction. As such the purpose of this study is to identify the design of mobile web content that is suitable for users' in which it meet users' values and requirement. The work conducted uses a co-creation approach in which co-creation values are obtained through a series of process. Co-creation value is essential as it is the missing part that is not being incorporated during the design process. As a result a guideline on web mobile design application based on co-creation values is established. The investigations presented in this paper highlight some ways in development of mobile web applications by adopting co-creation value with customer to make it more accessible to mobile devices. A case study conducted at Malaysian Agricultural Research And Development Institute (MARDI) as its web mobile applications is still at its initial. A prototype system based on the proposed guideline is provided as a proof of concept and shows the difference required in web applications for mobile design where values are incorporated.

The article discusses technologies for developing the web application designed to accompany the process of conducting an intellectual game in the format of an interactive quiz. An analysis of similar applications was carried out, which showed that none of them satisfies all the criteria essential in this situation. Requirements for the web application have been determined: the ability to create a library of quizzes, various types of questions, edit ready-made quizzes, participants enter answers through their devices online, award points for the correctness and speed of answers, display questions on the presenter's screen and on team devices, view intermediate and final results in the form of a list, returning participants to the game if necessary, saving the points received. The process of developing an optimized user interface using HTML, CSS, JavaScript, which allows users to interact with the web application, is described, the structure of the web application, the main forms of the administrator and game participants are presented. The server side of the application was developed using Node.JS technologies, including the Socket.io library, and the MongoDB database, the resulting collection of non-relational database is shown. To implement the functionality of the application pages, JavaScript was used; examples of codes are presented that implement the mechanism for connecting the presenter to the game, retrieving information from the database, recording the team's response, and awarding points for the correctness and speed of the response. The web application allows you to reduce the time spent by event organizers and participants and makes it possible to improve the organization of work in general. The presented web application for accompanying intellectual games was successfully approbated during events at the Nizhny Tagil State Social-Pedagogical Institute (branch) of the Russian State Vocational Pedagogical University. The materials of the article can serve as practical recommendations for the development of such web applications to accompany intellectual games held in the format of interactive quizzes.

Parametric Web application cost estimation is referred to the usage of mathematical model to derive the estimated effort and duration of Web application development. Typically, majority of Web application developers are applying expert judgment and estimation by analogy in Web application development. This paper is focusing on feasibility study of WEBMO (Web model), a parametric Web application cost estimation model, in Web application development within Klang Valley in Malaysia. WEBCOMO, a parametric Web application tool is developed based on WEBMOpsilas methodology to fulfill the objective of the study.

In recent months the priority area of modern medicine has become on-line informatization and computerization. The most promising development has been the use of information and computer support in an integrated diagnostic system for patients with cleft lip and palate. In our research we aim to developed an autonomous web application that allows practitioners to determine the tactics of multidisciplinary diagnosis and treatment based on data integrated into a specific web application in order to increase the efficiency of the treatment of children with cleft lip and palate of different age groups. Based on more than 45 years of clinical and scientific experience in diagnosis and treatment of patients with cleft lip and palate we developed a web application “ADI” (Application of Digital Imaging). The developed web application “ADI” is a system for processing, accumulating and analyzing information on the rehabilitation of patients with cleft lip and palate by type of pathology and age, allowing doctors to obtain structured information about the stages of the necessary methods of interdisciplinary cleft lip and palate diagnosis and treatment. One of the main advantages of “ADI” web application is the ability to quickly exchange information between specialists in various fields of knowledge. Such complex information is the basis for combining scientific ideas, analysis and exchange of experience of various specialists, thereby making it possible to create a unified system of interdisciplinary rehabilitation of children with congenital pathology of the maxillofacial region #COMESYSO1120.

Web script crashes and malformed dynamically-generated Web pages are common errors, and they seriously impact usability of Web applications. Current tools for Web-page validation cannot handle the dynamically-generated pages that are ubiquitous on today's Internet. In this work, we apply a dynamic test generation technique, based on combined concrete and symbolic execution, to the domain of dynamic Web applications. The technique generates tests automatically, uses the tests to detect failures, and minimizes the conditions on the inputs exposing each failure, so that the resulting bug reports are small and useful in finding and fixing the underlying faults. Our tool Apollo implements the technique for PHP. Apollo generates test inputs for the Web application, monitors the application for crashes, and validates that the output conforms to the HTML specification. This paper presents Apollo's algorithms and implementation, and an experimental evaluation that revealed 214 faults in 4 PHP Web applications.

Web Application Development has shown progressive and rapid growth using various techniques. Nonetheless, web application security is a major component in web development that is often overlooked or not properly focused on. Due to ad hoc existence and poor code written, most available web applications are vulnerable and desirable target for the attackers. To alleviate this issue, the use of defensive programming basic technique allows the developers to develop secure applications. Defensive programming includes validate output and correctly manages error messages. This avoids the misuse of snippets and builds the program in a consistent way despite unpredictable inputs. The purpose of this paper is twofold. Firstly, this paper discussed the development of a web application program using PHP as server-side scripting exploiting defensive programming techniques to overwhelm web application vulnerabilities. Secondly, this paper examined common vulnerabilities of web application risks refer to Open Web Application Security Project to validate the effectiveness of defensive programming technique. The work presented in this paper shall be a fundamental guideline for the development of secure web-based applications.

Web applications are not protected by today's network level firewalls, because they allow access to TCP port 80 without restrictions. However, many successful attacks today are not on the network level, but on application level. For protecting against application level attacks, a firewall must understand the application protocols, that are used on its open ports. This happens in application level firewalls and for Web application in Web application firewalls. The underlying concepts of Web application firewalls differ much from the concepts of traditional network level firewalls. This book explains the underlying concepts of Web application firewalls. Afterwards, they are applied to a collection of security requirements, that application developers should respect today for developing a secure Web application. A Web application firewall is capable of automatically implementing many of these requirements. As a result, Web application developers can ignore these requirements, because the Web applications firewall already ensures their implementation and therefore the security of the Web application. This book is intended for anyone, who is interested in securing his Web application.

End-users who are nonprogrammers create web applications by using advanced web development tools. However, these tools are not supported by any methodological process which produces that web applications are of low quality. This paper presents an approach to bring web engineering principles to the end-user community. We complement the web engineering method OOWS with tools that allow end-users to develop web applications by: (1) describing web applications in terms of the end-users’ knowledge about the application domain, (2) automatically obtaining a web application prototype by means of the OOWS code generation strategy, and (3) personalizing the web application look and feel by simply selecting a design template. To achieve this, an ontology-based strategy is introduced to support end-users throughout the web application development. We also introduce a strategy that allows us to define domain-independent presentation templates.

Web application frameworks are a proven means to accelerate the development of interactive web applications. However, implementing collaborative real-time applications like Google Docs requires specific concurrency control services (i.e. document synchronization and conflict resolution) that are not included in prevalent general-purpose frameworks like jQuery or Knockout. Hence, developers have to get familiar with specific collaboration frameworks (e.g. ShareJS) which substantially increases the development effort. To ease the development of collaborative web applications, we propose a set of source code annotations representing a lightweight mechanism to introduce concurrency control services into mature web frameworks. Those annotations are interpreted at runtime by a dedicated collaboration engine to sync documents and resolve conflicts. We enhanced the general-purpose framework Knockout with a collaboration engine and conducted a developer study comparing our approach to a traditional concurrency control library. The evaluation results show that the effort to incorporate collaboration capabilities into a web application can be reduced by up to 40 percent using the annotation-based solution.

Web applications are evolving towards strong content-centred information systems accessible through the web. The development processes and implementation of these applications are unlike the development and implementation of traditional information systems. In this paper, we propose a Web Engineering Method (WEM): a method for developing Content Management System (CMS)-based web applications. Critical to a successful development of CMS-based web applications is adaptation to the dynamic business. We first define CMS-based web applications and identify their specific characteristics. Combining these characteristics with situational factors in projects, we show that by taking parts of proven methods, such as UML-based Web Engineering (UWE) and the Unified Process (UP), a unique method can be assembled for situational development of CMS-based web applications. We successfully validated the method at GX, a web-technology company specialised in developing and implementing CMS-based web applications.

The Rapid growth of internet resulted in feature rich and dynamic web applications. This increase in features also introduced completely under estimated attack vectors. Cross site scripting attacks, SQL Injection and malicious file execution are the most dominant classes of web vulnerabilities reported by OWASP 2011. These attacks make use of vulnerabilities in the code of web applications, resulting in serious consequences, such as theft of cookies, passwords and other personal credentials. It is caused by scripts, which do not sanitize user input. Several server-side counter measures for XSS attacks do exist, but such techniques have not been universally applied, because of their deployment overhead. The existing client-side solutions degrade the performance of client's system resulting in a poor web surfing experience. We present automata-based symbolic string analyses (XHunter)for automatic verification of string manipulating programs we compute the pre and post conditions of common string functions using deterministic finite automata (DFAs). Experiment result shows that our approach finds large number of malicious attacks in web application.

A Web application is an application that is invoked with a Web browser over the Internet. Ever since 1994 when the Internet became available to the public and especially in 1995 when the World Wide Web put a usable face on the Internet, the Internet has become a platform of choice for a large number of ever-more sophisticated and innovative Web applications. In just one decade, the Web has evolved from being a repository of pages used primarily for accessing static, mostly scientific, information to a powerful platform for application development and deployment. New Web technologies, languages, and methodologies make it possible to create dynamic applications that represent a new model of cooperation and collaboration among large numbers of users. Web application development has been quick to adopt software engineering techniques of component orientation and standard components. For example, search, syndication, and tagging have become standard components of a new generation of collaborative applications and processes. Future developments in Web applications will be driven by advances in browser technology, Web Internet infrastructure, protocol standards, software engineering methods, and application trends.