Seminar:
Webprogrammierung
Verteilung
Die Themen sind wie folgt verteilt worden:
| Student | Thema | Betreuer |
|---|---|---|
| Karla Alcazar | Webprogrammierung mit Scheme | Stefan Franck |
| Matthias Braun | The Influence of Browsers on Evaluators | Peter Thiemann |
| Timothy Burk | Java Server Pages | Stefan Franck |
| Nico Dietrich | Webprogrammierung in WASH | Stefan Franck |
| Jens Heidrich | JWig System | Peter Thiemann |
| Stefan Heimann | Xen bzw. Comega | Matthias Neubauer |
| Daniel Höfler | Securing web application code by static analysis and runtime protection | Matthias Neubauer |
| Roman Malytskyy | XML Programmierung mit C# | Matthias Neubauer |
| Jens Singler | Cocoon | Stefan Franck |
| Johannes Sprenger | SML Server | Matthias Neubauer |
| Jan Stamer | Webservices mit .NET | Peter Thiemann |
| He Xun | Abstracting application-level web security | Peter Thiemann |
Übersicht
Aufgrund der großen Nachfrage gibt es hier noch einige zusätzliche Themen:
- Securing web application code by static analysis and runtime protection
- Abstracting application-level web security
- Recovery guarantees for Internet applications
Die alten (und größtenteils vergebenen) Themen:
- Java Server Pages
- Cocoon
- Webservices mit .NET
- Webprogrammierung mit Scheme
- Webprogrammierung in WASH
- JWig System
- Verifying interactive Web Programs
- Der Einfluss von Browsern auf Evaluatoren
- XML Programmierung mit C#
- Xen bzw. Comega
- SML - Server
Anmerkung: Die Beschreibungen der jeweiligen Systeme entstammen zumeist den Beschreibungen von den originären Homepages der Entwickler.
Securing web application code by static analysis and runtime protection
Das Paper "Securing web application code by static analysis and runtime protection" (in gedruckter Form bei uns erhältlich) soll vorgestellt werden:
Abstract
Security remains a major roadblock to universal acceptance of the Web for many kinds of transactions, especially since the recent sharp increase in remotely exploitable vulnerabilities have been attributed to Web application bugs. Many verification tools are discovering previously unknown vulnerabilities in legacy C programs, raising hopes that the same success can be achieved with Web applications. In this paper, we describe a sound and holistic approach to ensuring Web application security. Viewing Web application vulnerabilities as a secure information flow problem, we created a lattice-based static analysis algorithm derived from type systems and typestate, and addressed its soundness. During the analysis, sections of code considered vulnerable are instrumented with runtime guards, thus securing Web applications in the absence of user intervention. With sufficient annotations, runtime overhead can be reduced to zero. We also created a tool named.WebSSARI (Web application Security by Static Analysis and Runtime Inspection) to test our algorithm, and used it to verify 230 open-source Web application projects on SourceForge.net, which were selected to represent projects of different maturity, popularity, and scale. 69 contained vulnerabilities. After notifying the developers, 38 acknowledged our findings and stated their plans to provide patches. Our statistics also show that static analysis reduced potential runtime overhead by 98.4%.
Abstracting application-level web security
Das Paper "Security for Web Applications and P2P" (in gedruckter Form bei uns erhältlich) soll vorgestellt werden:
Abstract
Application-level web security refers to vulnerabilities inherent in the code of a web-application itself (irrespective of the technologies in which it is implemented or the security of the web-server/back-end database on which it is built). In the last few months application-level vulnerabilities have been exploited with serious consequences: hackers have tricked e-commerce sites into shipping goods for no charge, user-names and passwords have been harvested and condential information (such as addresses and credit-card numbers) has been leaked.In this paper we investigate new tools and techniques which address the problem of application-level web security. We (i) describe a scalable structuring mechanism facilitating the abstraction of security policies from large web-applications developed in heterogenous multi-platform environments; (ii) present a tool which assists programmers develop secure applications which are resilient to a wide range of common attacks; and (iii) report results and experience arising from our implementation of these techniques.
Recovery guarantees for Internet applications
Das Paper "Recovery guarantees for Internet applications" (in gedruckter Form bei uns erhältlich) soll vorgestellt werden. Achtung: Dieses Thema umfasst 40 Seiten - der Arbeitsaufwand ist also deutlich höher als bei allen anderen Themen!
Abstract
Internet-based e-services require application developers to deal explicitly with failures of the underlying software components, for example web servers, servlets, browser sessions, and so forth. This complicates application programming, and may expose failures to end users. This paper presents a framework for an application-independent infrastructure that provides recovery guarantees and masks almost all system failures, thus relieving the application programmer from having to deal with these failures---by making applications "stateless." The main concept is an interaction contract between two components regarding message and state preservation. The framework provides comprehensive recovery encompassing data, messages, and the states of application components. We describe techniques to reduce logging cost, allow effective log truncation, and permit independent recovery for critical components. We illustrate the framework's utility via web-based e-services scenarios. Its feasibility is demonstrated by our prototype implementation of interaction contracts based on the Apache web server and the PHP servlet engine. Finally, we discuss industrial relevance for middleware architectures such as. Net or J2EE.
Java Server Pages
Die JSP Technik benutzt XML-ähnliche Tags und kapselt die Logik, die den Inhalt der Zeite erzeugt, ein.
Die Anwendung kann in serverseitigen Ressourcen basieren, auf die von der Seite mittels der Tags
zugegriffen wird. Jegliche Formatierungstags (HTML oder XML) werden direkt an die Antwortseite
weitergeleitet.
JSP ist eine Erweiterung der Java Servlets. Diese sind Plattform unabhängige, serverseitige Module
die benutzt werden können, um die Fähigkeiten eines Webservers zu erweitern. Die Servlets sind
Anwendungen, die auf Verlangen zu dem Teil des Systems heruntergeladen werden, das sie braucht.
Links zum Thema:
- JSP-Portal JavaServer Pages (JSP) Technology
- JavaServer Pages Specification
- JSP Standard Tag Library (JSTL) (Documentation)
- The J2EE 1.4 Tutorial for J2EE 1.4 SDK (JSP 2.0), Chapter 12: JavaServer Pages Technology
- Short Course: Introduction to JavaServer Pages technology
- Servlets-Portal Java Servlet Technology
- Java Servlets Specification
- The J2EE 1.4 Tutorial for J2EE 1.4 SDK (JSP 2.0), Chapter 11: Java Servlet Technology
Cocoon
Apache Cocoon ist eine Web Entwicklungs System, das komponentenbasierte Webentwicklung unterstützt. Es benutzt dabei die Technik von sog. "component pipelines", wobei jede Komponente in der Pipeline auf eine bestimmte Operation spezialisiert ist. Web Anwendungen werden dadurch entwickelt, dass diese Komponenten wie Bauklötze zusammengesetzt werden, indem sie in die Pipeline eingeklinkt werden, was keine Programmierkenntnisse erfordert.
Links zum Thema:
- Das Cocoon Portal
- CocoDocoWiki
- Verschiedene Ressourcen zum Thema Cocoon
- TECFAs Cocoon Seite
- Die Ziegeler Community
- Cocoon-Center
- CocoonHive.org
- Cocoon 2 How-To Seiten
Webservices mit .NET
.NET ist die Microsoft Lösung für Web Dienste, die das Erzeugen und Benutzen von XML-basierten Anwendungen, Prozessen und Webseiten ermöglicht. Diese Dienste teilen und vereinen Informationen und Funktionen miteinander. .NET ist eine ganze Familie von Produkent, die Industrie und Internet Standarts erfüllen. Es gibt Anwendungen für verschiedene Bereiche und Phasen der Entwicklung. .NET soll in die bekannten Microsoft Programme eingebettet werden.
Links zum Thema:
- Microsoft .NET
- Microsoft .NET (deutsche Seite)
Webprogrammierung mit Scheme
Scheme ist ein Dialekt der Lisp-Programmiersprache, der von Guy Lewi Steele Jr. und Gerald Jay Sussman entwickelt wurde. Das Hauptaugenmerk lag auf einer einfachen Semantik. Es unterstützt viele Programmiertechniken, hauptsächlich funktionale aber auch imperative, Message-passing orientierte usw.
Links zum Thema:
- Scheme-Portal www.schemers.org
- Der aktuelle Scheme-Sprachstandard R5RS
- Scheme Requests for Implementation (SRFI) (Final SRFIs)
- PLT Scheme Portal
- PLT Documentation
- How to Design Programs (HtDS)
- How to Use Scheme (HtUS)
- Paper "Developing Interactive Web Programs", Matthias Felleisen, AFP 2002, (PS.GZ)
Webprogrammierung in WASH
Das "Web Authoring System Haskell" (WASH) ist eine Gruppe von "Embedded Domain Specific Languages" (EDSL) um Internetanwendungen zu implementieren. Jede dieser Sprachen ist in Haskell eingebettet, was bedeutet, dass es als "Combinator Library" umgesetzt wurde.
Links zum Thema:
- WASH-Homepage
- User-Manual (PDF)
- Online-Dokumentation der WASH-API
- Paper über WASH/HTML (Postscript, PDF), WASH/CGI (PDF), wash4hs (PS.GZ)
- Haskell-Portal www.haskell.org
- Der aktuelle Haskell-Sprachstandard Haskell 98 Report
- Haskell Hierarchical Libraries
- The Haskell Interpreter Hugs
- GHC, the Glasgow Haskell Compiler
JWIG System
JWIG ist ein Java-basiertes Entwicklungssystem um Web Dienste zu entwickeln. Es integriert zentrale Eigenschaften der bigwig Sprache in Java. Im Gegensatz zu Servlets und JSP bietet JWIG einen Ansatz zur Umsetzung von Sessions, der Cookies und das Neuschreiben von URLs verhindert und garantiert, dass dynamisch erzeugte Dokumente XHTML 1.0 valid sind.
Links zum Thema:
Verifying Interactive Web Programs
Das folgende Paper soll vorgestellt werden:
Abstract
Web programs are important, increasingly representing the primary public interfaces of commercial organizations. Unfortunately, Web programs also exhibit numerous flaws. In addition to the usual correctness problems faced by software, Web programs must contend with numerous subtle user operations such as clicking the Back button or cloning and submitting a page multiple times. Many existing Web verification tools fail to even consider, much less effectively handle, these operations.
This paper describes a model checker designed to identify errors in Web software. We present a technique for automatically generating novel models of Web programs from their source code; these models include the additional control flow enabled by these user operations. In this technique, we exploit a constraint-based approach to avoid overapproximating this control flow; this approach allows us to evade exploding the size of the model. Further, we present a powerful base property language that permits specification of useful Web properties, along with several property idioms that simplify specification of the most common Web properties. Finally, we discuss the implementation of this model checker and a study of its effectiveness.
Das ganze Paper als PDF-Datei.
The Influence of Browsers on Evaluators
Dieses Paper (PDF (neuer Link) oder direkt von ACM mit Zugangskontrolle - also nur von Uni-Rechnern aus erreichbar) soll vorgestellt werden
XML Programmierung mit C#
Das folgende Paper soll vorgestellt werden:
Abstract
Regular expression types have been proposed as a foundation for statically typed processing of XML
and similar forms of tree-structured data. To date, however, regular expression types have been explored
mainly in the setting of special-purpose languages (e.g., XDuce, CDuce, and XQuery) whose type systems
were designed around regular expression types \from the ground up." The goal of the Xtatic language
is to bring regular expression types to a broader audience by presenting them as a lightweight extension
of a popular object-oriented language, C#.
We develop here the formal core of the Xtatic design|a combination of the tree-structured data
model of XDuce with the classes-and-objects data model of a conventional object-oriented language.
Our tool for this investigation is a tiny language called FX, whose features are drawn from Featherweight
Java (FJ) and from the core of XDuce. Points of interest include a smooth interleaving of the two
value spaces, in which XDuce's tree structures are grafted into of FJ's class hierarchy while objects and
object types play the role of XDuce's label values and label types; a definition of the subtype
relation, inherited from XDuce and extended to objects; and a natural encoding of XML documents and
their schemas using a simple form of singleton classes.
- Das ganze Paper als PDF-Datei
- weitere Ressourcen
Xen bzw. Comega
Das folgende Paper soll vorgestellt werden:
Abstract
This paper proposes extending popular object-oriented programming languages such as C#, VB or Java with native support for XML. In our approach XML documents or document fragments become first class citizens. This means that XML values can be constructed, loaded, passed, transformed and updated in a type-safe manner. The type system extensions, however, are not based on XML Schemas. We show that XSDs and the XML data model do not fit well with the class-based nominal type system and object graph representation of our target languages. Instead we propose to extend the C# type system with new structural types that model XSD sequences, choices, and all-groups. We also propose a number of extensions to the language itself that incorporate a simple but expressive query language that is influenced by XPath and SQL. We demonstrate our language and type system by translating a selection of the XQuery use cases.
Link zum Paper
SML - Server
SMLserver ist ein Web Server Plugin für den AOL Server, ein Open Source multi-threaded Web Server, der von America Online entwickelt wurde und für große, dynamische Webseiten benutzt wird. SMLserver erlauben effiziente gethreadete Ausführung von Standard ML Programmen und hat auch viele der Möglichkeiten des AOL Servers, inklusive der Möglichkeit, auf viele verschiedene Relationale Datenbanken Systeme wie Oracle oder Postgres zuzugreifen.
Links zum Thema