Client-side Code Research Articles

Causal inference of server- and client-side code smells in web apps evolution

ContextCode smells (CS) are symptoms of poor design and implementation choices that may lead to increased defect incidence, decreased code comprehension, and longer times to release. Web applications and systems are seldom studied, probably due to the heterogeneity of platforms (server and client-side) and languages, and to study web code smells, we need to consider CS covering that diversity. Furthermore, the literature provides little evidence for the claim that CS are a symptom of poor design, leading to future problems in web apps.ObjectiveTo study the quantitative evolution and inner relationship of CS in web apps on the server- and client-sides, and their impact on maintainability and app time-to-release (TTR).MethodWe collected and analyzed 18 server-side, and 12 client-side code smells, aka web smells, from consecutive official releases of 12 PHP typical web apps, i.e., with server- and client-code in the same code base, summing 811 releases. Additionally, we collected metrics, maintenance issues, reported bugs, and release dates. We used several methodologies to devise causality relationships among the considered irregular time series, such as Granger-causality and Information Transfer Entropy(TE) with CS from previous one to four releases (lag 1 to 4).ResultsThe CS typically evolve the same way inside their group and its possible to analyze them as groups. The CS group trends are: Server, slowly decreasing; Client-side embed, decreasing and JavaScript,increasing. Studying the relationship between CS groups we found that the "lack of code quality", measured with CS density proxies, propagates from client code to server code and JavaScript in half of the applications. We found causality relationships between CS and issues. We also found causality from CS groups to bugs in Lag 1, decreasing in the subsequent lags. The values are 15% (lag1), 10% (lag2), and then decrease. The group of client-side embed CS still impacts up to 3 releases before. In group analysis, server-side CS and JavaScript contribute more to bugs. There are causality relationships from individual CS to TTR on lag 1, decreasing on lag 2, and from all CS groups to TTR in lag1, decreasing in the other lags, except for client CS.ConclusionsThere is statistical inference between CS groups. There is also evidence of statistical inference from the CS to web applications’ issues, bugs, and TTR. Client and server-side CS contribute globally to the quality of web applications, this contribution is low, but significant. Depending on the outcome variable (issues, bugs, time-to-release), the contribution quantity from CS is between 10% and 20%.

Dead or alive: Discovering server HTTP endpoints in both reachable and dead client-side code

Discovering server HTTP endpoints – essentially, enumerating the server’s attack surface – is an important step of every black-box web security scanner. One of the main methods of doing that is inferring server endpoints from the client side, determining what HTTP requests can be sent from client to server. This is trivial for requests triggered by HTML markup elements, such as links and forms, but is much harder for requests sent by JavaScript. Existing approaches to determining requests sent from JavaScript are based on a technique known as dynamic crawling - automated interaction with user interface elements using a headless browser. Dynamic crawling fails when the code that sends a request is impossible or very difficult to trigger with interface interaction. We propose a different approach for finding HTTP requests sent by JS code, which uses static code analysis. While analyzing JavaScript statically is known to be hard and applying existing analyzers to real-world web pages usually does not work, we propose a new lightweight analysis algorithm that can work on pages of real websites and can discover server endpoints that dynamic crawlers cannot. Evaluation results show that augmenting a black-box scanner with the proposed static analysis may significantly improve server-side endpoint coverage.

Research into Occurrence of Insecurely-Serialized Objects in Client-Side Code of Web-Applications

This paper studies the occurrence of insecure deserialization in communication between client-side code and the server-side of a web application. Special attention was paid to serialized objects sent from JavaScript client-side code. Specific patterns of using serialized objects within the client-side JavaScript code were identified and unique classes were formulated, whose main goal is to facilitate manual and automatic analysis of web applications. A tool that detects a serialized object in the client-side code of a web page has been designed and implemented. This tool is capable of finding encoded serialized objects as well as serialized objects encoded using several sequentially applied encodings. For found samples of serialized objects, the tool determines the context in which the found object appears on the page. For objects inside JavaScript code, the tool identifies the previously mentioned classes by mapping the vertices of the abstract syntax tree (AST) of the code. Web application endpoints were checked for whether programming objects were deserialized on the server side, after obtaining the results of the study. As a result of this check, previously unknown vulnerabilities were found, which were reported to the developers of this software. One of them was identified as CVE-2022-24108. Based on the results of this research, a method was proposed to facilitate both manual and automated searches for vulnerabilities of the "Deserialization of untrusted data". The proposed algorithm was tested on more than 50,000 web application pages from the Alexa Top 1M list, as well as on 20,000 web application pages from Bug Bounty programs.

ОБНАРУЖЕНИЕ СЕРВЕРНЫХ ТОЧЕК ВЗАИМОДЕЙСТВИЯ В ВЕБ-ПРИЛОЖЕНИЯХ НА ОСНОВЕ АНАЛИЗА

The problem of server-side endpoint detection in the context of blackbox security analysis of dynamic web applications is considered. We propose a method to increase coverage of server-side endpoint detection using static analysis of client-side JavaScript code to find functions which generate HTTP requests to the server-side of the application and reconstruct parameters for those functions. In the context of application security testing, static analysis allows to find such functions even in dead or unreachable JavaScript code, which cannot be achieved by dynamic crawling or dynamic code analysis. Evaluation of the proposed method and its implementation has been done using synthetic web application with endpoints vulnerable to SQL injections, and the same application was used to compare the proposed method with existing solutions. Evaluation results show that adding JavaScript static analysis to traditional dynamic crawling of web applications may significantly improve server-side endpoint coverage in blackbox application security analysis.

TGenBase - universal database for FAIR experiments

TGenBase is a ROOT-based virtual database which allows to communicate and store data in different underlying database management systems such as PostgreSQL, MySQL, SQLite, based on the configuration. It is primarily used for physics analysis parameter storage. However, it is universally applicable for any data storage task. There are several key features of the TGenBase for the user applications. It is a versioned insert only database, meaning that there is no need to update single entries and the whole history of the entries is available. The historical versions of the data can be queried with for a certain date. Being written as extension of the ROOT framework, it supports saving the ROOT objects such as graphs or histograms as well.We provide the data description interface-a web-based application which allows the end-user to define what and in which form they want the data to be stored and define the relations between different entities. Based on this definition the database schemas, server and client side code is generated from templates and easily deployed. Another feature of this approach is that we are able to generate the full-fledged content management systems with user roles for read and write access. Data query, visualization and modification are available in C++, Python, Web and LabVIEW thin clients.

GEOMETRY VIEWER FOR PGADMIN4: A PROCESS GUIDED BY THE GOOGLE SUMMER OF CODE

Abstract. The latest version of pgAdmin4 was released in mid-2016 and moved to a web-based application that was written in Python and jQuery with Bootstrap, using the Flask framework. This new architecture of pgAdmin4 provided an excellent opportunity to integrate a geometry viewer into the application. This progress started as the geometry viewer was selected as a project for the 2018 Google Summer of Code (GSoC). The requirements for the geometry viewer was elicited through conversations with the mentors and emails to the discussion list of PostGIS and pgAdmin. Once the formal design was finalized the development started. The spatial technology stack implemented to expand pgAdmin4 with a geometry viewer was the JavaScript mapping library Leaflet JS and WKX - parser/serializer library that supports several spatial vector formats. Both these fulfilled the requirements of the coding standard of pgAdmin that all client-side code must be developed in JavaScript using jQuery and other plugins. Leaflet JS is well known for its ease of use and compatibility. WKX is lesser known but well supported and concise to the need to parse the spatial data before rendering on the Leaflet map. The decision on both of these libraries was motivated by their minimal size and possibilities for expansion for future extensions of the viewer. The first version of the geometry viewer was well-received and is currently integrated into the latest versions of pgAdmin4.

Site Insites: Refreshing [Bits Versus Electrons

Periodically, I need to refresh my website. Once again, I’m rebuilding the site from the ground up—or at least, taking a fresh look at the software behind the site. In my April 2016 “Bits Versus Electrons” column, I wrote about building a simple Internet of Things device and shared what I’d learned. As part of the process, I implemented a simple web server from scratch with both server- and client-side code. Without the need to produce a large-scale commercial website, I was free to take a very simple approach using Node (http://nodejs.org/). Starting from scratch can be very refreshing. It turned out that with today’s tools, it was far easier to start with a blank slate than to use heavy-duty environments. Apache and Internet information services (IIS) are valuable, but they also come with attitudes and assumptions. This refresh is my fourth iteration of my website.

Research and Implementation of Collecting Ajax Dynamic Information

In the use of Ajax technology on web pages, it is needed to execute client-side Javascript code to present dynamic information. This will result in that a lot of useful data cannot be retrieved with search engine. This paper will introduce a method based on calling browser API and, add the preprocessing stage and put forward effective element specification before trigger the Ajax page events. Besides, several experiments are introduced to testify it’s feasibility and effectiveness.

Insight Maker: A general-purpose tool for web-based modeling & simulation

A web-based, general-purpose simulation and modeling tool is presented in this paper. The tool, Insight Maker, has been designed to make modeling and simulation accessible to a wider audience of users. Insight Maker integrates three general modeling approaches – System Dynamics, Agent-Based Modeling, and imperative programming – in a unified modeling framework. The environment provides a graphical model construction interface that is implemented purely in client-side code that runs on users’ machines. Advanced features, such as model scripting and an optimization tool, are also described. Insight Maker, under development for several years, has gained significant adoption with currently more than 20,000 registered users. In addition to detailing the tool and its guiding philosophy, this first paper on Insight Maker describes lessons learned from the development of a complex web-based simulation and modeling tool.

Automated detection of parameter tampering opportunities and vulnerabilities in web applications

Parameter tampering attacks are dangerous to a web application whose server fails to replicate the validation of user-supplied data that is performed by the client in web forms. Malicious users who circumvent the client can capitalize on the missing server validation. In this paper, we provide a fo rmal description of parameter tampering vulnerabilities and a high level approach for their detection. We specialize this high level approach to develop complementary detection solutions in two interesting settings: blackbox (only analyze client-side code in web forms) and whitebox (also analyze server-side code that processes submitted web forms). This paper presents interesting challenges encountered in realizing the high level approach for each setting and novel technical contributions that address these challenges. We also contrast utility, difficulties and effectiveness issues in both settings and provide a quantitative comparison of results. Our experiments with real world and open source applications demonstrate that parameter tampering vulnerabilities are prolific (total 47 in 9 applications), and their exploitation can have serious consequences including unauthorized transactions, account hijacking and financial losses. We conclude this paper with a discussion on countermeasures for parameter tampering attacks and present a detailed survey of existing defenses and their suitability.

Web-based spatiotemporal simulation modeling and visualization of tsunami inundation and potential human response

Modeling spatiotemporal phenomena can provide insight into potential behavior of simulated objects during hypothetical events. Simulation frameworks can be a useful method of modeling these scenarios, and become more flexible when developed in a fashion that facilitates automated generation of output based on variable input parameters. By connecting a simulation framework to a web-based system, a user can assign input parameters of their choosing, run a simulation, and explore the output data in a dynamic, animated, map-based context using a standard web browser. The framework described here utilizes tsunami simulation data and user input to generate a combined web-based visualization and simulation model of human response to tsunami inundation. Input parameters pertaining to human population and community of interest are provided by the user and guide automated development of a simulation model scenario of spatiotemporal human response to a hypothetical tsunami inundation event. Simulated human movement is calculated at each time step using casualty model algorithms informed by behavioral research and variables such as water depth and road networks, while a mix of server-side and client-side code renders the mapping interface and supports user interaction within the web browser. Interactive controls included in the web-based simulation viewer allow the user to manipulate the map display and query underlying data either manually by time step or interactively while animation is underway. Although modeling of human movement has inherent limitations, integration of a formal casualty model with the automated simulation framework represents a unique quantitative approach for casualty determination and simulation modeling.

Models as web services using the Open Geospatial Consortium (OGC) Web Processing Service (WPS) standard

Environmental modeling often requires the use of multiple data sources, models, and analysis routines coupled into a workflow to answer a research question. Coupling these computational resources can be accomplished using various tools, each requiring the developer to follow a specific protocol to ensure that components are linkable. Despite these coupling tools, it is not always straight forward to create a modeling workflow due to platform dependencies, computer architecture requirements, and programming language incompatibilities. A service-oriented approach that enables individual models to operate and interact with others using web services is one method for overcoming these challenges. This work advances the idea of service-oriented modeling by presenting a design for a modeling service that builds from the Open Geospatial Consortium (OGC) Web Processing Service (WPS) protocol. We demonstrate how the WPS protocol can be used to create modeling services, and then demonstrate how these modeling services can be brought into workflow environments using generic client-side code. We implemented this approach within the HydroModeler environment, a model coupling tool built on the Open Modeling Interface standard (version 1.4), and show how a hydrology model can be hosted as a WPS web service and used within a client-side workflow. The primary advantage of this approach is that the server-side software follows an established standard that can be leveraged and reused within multiple workflow environments and decision support systems.

ChromoZoom: a flexible, fluid, web-based genome browser

Summary: Current web-based genome browsers require repetitious user input to scroll over long distances, alter the drawing density of elements or zoom through multiple orders of magnitude. Generally, either the server or the client is responsible for the majority of data processing, resulting in either servers having to receive and handle data relevant only to one user, or clients redundantly processing widely viewed data. ChromoZoom pre-renders and caches general-use tracks into tiled images on the server and serves them in an interactive web interface with inertial scrolling and precise, fluent zooming via the mouse wheel or trackpad. Custom tracks in several formats can be rendered by client-side code alongside the pre-rendered tracks, minimizing server load because of user-specific rendering and eliminating the need to transmit private data. ChromoZoom thereby enables rapid and simultaneous exploration of curated, experimental and personal genomic datasets.Availability: Human and yeast genome researchers may browse recent assemblies within ChromoZoom at http://chromozoom.org/. Source code is available at http://github.com/rothlab/chromozoom/. Contact: fritz.roth@utoronto.ca Supplementary information: Supplementary data are available at Bioinformatics online.

To upgrade or not to upgrade

Online software upgrades are often plagued by runtime behaviors that are poorly understood and difficult to ascertain. For example, the interactions among multiple versions of the software expose the system to race conditions that can introduce latent errors or data corruption. Moreover, industry trends suggest that online upgrades are currently needed in large-scale enterprise systems, which often span multiple administrative domains (e.g., Web 2.0 applications that rely on AJAX client-side code or systems that lease cloud-computing resources). In such systems, the enterprise does not control all the tiers of the system and cannot coordinate the upgrade process, making existing techniques inadequate to prevent mixed-version races. In this paper, we present an analytical framework for impact assessment, which allows system administrators to directly compare the risk of following an online-upgrade plan with the risk of delaying or canceling the upgrade. We also describe an executable model that implements our formal impact assessment and enables a systematic approach for deciding whether an online upgrade is appropriate. Our model provides a method of last resort for avoiding undesirable program behaviors, in situations where mixed-version races cannot be avoided through other technical means.

Anti-social networking: exploiting the trusting environment of Web 2.0

Social networking sites have created a dangerous cocktail of user-supplied content, open APIs and heavy use of client-side code. Mix in third-party applications, many hosted off-site, and you have a constantly expanding and mutating attack surface in which not even the sites themselves are capable of verifying the content they deliver. Some vulnerabilities stem from poor coding, but we are seeing an increasing number of exploits that take advantage of this environment's lack of security standards and practices. Security solutions designed to protect against XSS, CSRF and other standard web-based exploits may help, but the trust that many users place in social networks will always make them vulnerable to social engineering. Steve Mansfield-Devine takes a look at the security issues associated with this exciting but dangerous category of online service. Social networking has made the web a friendlier, more connected but more complex environment. Sites such as Facebook, MySpace, Orkut, LinkedIn and their like have concocted a dangerous cocktail of user-supplied content, open APIs, and web pages heavily loaded with Javascript and embedded media of all descriptions. And it's an environment that is largely devoid of security standards and practices.

Secure web applications via automatic partitioning

Swift is a new, principled approach to building web applications that are secure by construction . In modern web applications, some application functionality is usually implemented as client-side code written in JavaScript. Moving code and data to the client can create security vulnerabilities, but currently there are no good methods for deciding when it is secure to do so. Swift automatically partitions application code while providing assurance that the resulting placement is secure and efficient. Application code is written as Java-like code annotated with information flow policies that specify the confidentiality and integrity of web application information. The compiler uses these policies to automatically partition the program into JavaScript code running in the browser, and Java code running on the server. To improve interactive performance, code and data are placed on the client side. However, security-critical code and data are always placed on the server. Code and data can also be replicated across the client and server, to obtain both security and performance. A max-flow algorithm is used to place code and data in a way that minimizes client-server communication.