Carnegie Mellon's new programming language accommodates multiple languages in same program

Wyvern language protects computers from code injection attacks

2014-08-07

(Press-News.org) PITTSBURGH—Computer scientists at Carnegie Mellon University have designed a way to safely use multiple programming languages within the same program, enabling programmers to use the language most appropriate for each function while guarding against code injection attacks, one of the most severe security threats in Web applications today. A research group led by Jonathan Aldrich, associate professor in the Institute for Software Research (ISR), is developing a programming language called Wyvern that makes it possible to construct programs using a variety of targeted, domain-specific languages, such as SQL for querying databases or HTML for constructing Web pages, as sublanguages, rather than writing the entire program using a general purpose language. Wyvern determines which sublanguage is being used within the program based on the type of data that the programmer is manipulating. Types specify the format of data, such as alphanumeric characters, floating-point numbers or more complex data structures, such as Web pages and database queries. The type provides context, enabling Wyvern to identify a sublanguage associated with that type in the same way that a person would realize that a conversation about gourmet dining might include some French words and phrases, explained Joshua Sunshine, ISR systems scientist. "Wyvern is like a skilled international negotiator who can smoothly switch between languages to get a whole team of people to work together," Aldrich said. "Such a person can be extremely effective and, likewise, I think our new approach can have a big impact on building software systems." Many programming tasks can involve multiple languages; when building a Web page, for instance, HTML might be used to create the bulk of the page, but the programmer might also include SQL to access databases and JavaScript to allow for user interaction. By using type-specific languages, Wyvern can simplify that task for the programmer, Aldrich said, while also avoiding workarounds that can introduce security vulnerabilities. One common but problematic practice is to paste together strings of characters to form a command in a specialized language, such as SQL, within a program. If not implemented carefully, however, this practice can leave computers vulnerable to two of the most serious security threats on the Web today — cross-site scripting attacks and SQL injection attacks. In the latter case, for instance, someone with knowledge of computer systems could use a login/password form or an order form on a Web site to type in a command to DROP TABLE that could wipe out a database. "Wyvern would make the use of strings for this purpose unnecessary and thus eliminate all sorts of injection vulnerabilities," Aldrich said. Previous attempts to develop programming languages that could understand other languages have faced tradeoffs between composability and expressiveness; they were either limited in their ability to unambiguously determine which embedded language was being used, or limited in which embedded languages could be used. "With Wyvern, we're allowing you to use these languages, and define new ones, without worrying about composition," said Cyrus Omar, a Ph.D. student in the Computer Science Department and the lead designer of Wyvern's type-specific language approach. Wyvern is not yet fully engineered, Omar noted, but is an open source project that is ready for experimental use by early adopters. More information is available at http://www.cs.cmu.edu/~aldrich/wyvern/. INFORMATION: A research paper, "Safely Composable Type-Specific Languages," by Omar, Aldrich, Darya Kurilova, Ligia Nistor and Benjamin Chung of CMU and Alex Potanin of Victoria University of Wellington, recently won a distinguished paper award at the European Conference on Object-Oriented Programming in Uppsala, Sweden.
This research was supported in part by the Air Force Research Laboratory, the National Security Agency and the Royal Society of New Zealand Marsden Fund. The Institute for Software Research and Computer Science Department are part of Carnegie Mellon's top-ranked School of Computer Science, which is celebrating its 25th year. Follow the school on Twitter @SCSatCMU. About Carnegie Mellon University: Carnegie Mellon is a private, internationally ranked research university with programs in areas ranging from science, technology and business, to public policy, the humanities and the arts. More than 12,000 students in the university's seven schools and colleges benefit from a small student-to-faculty ratio and an education characterized by its focus on creating and implementing solutions for real problems, interdisciplinary collaboration and innovation. A global university, Carnegie Mellon has campuses in Pittsburgh, Pa., California's Silicon Valley and Qatar, and programs in Africa, Asia, Australia, Europe and Mexico.

ELSE PRESS RELEASES FROM THIS DATE:

Stock prices of companies that use the same underwriter tend to move together

2014-08-07

HOUSTON – (Aug. 7, 2014) – The stock prices of companies that use the same lead underwriter during their equity offerings tend to move together, according to a new study by financial economics experts at Rice University and the University of Alabama. "We tested the hypothesis that investment banking networks affect stock prices and trading behavior," said James Weston, a professor of finance at Rice's Jones Graduate School of Business. "Consistent with the notion that investment banks such as Goldman Sachs and Merrill Lynch serve as information hubs for segmented groups ...

Elderly with depression, mild cognitive impairment more vulnerable to accelerated brain aging

2014-08-07

PITTSBURGH, Aug. 7, 2014 – People who develop depression and mild cognitive impairment (MCI) after age 65 are more likely to have biological and brain imaging markers that reflect a greater vulnerability for accelerated brain aging, according to a study conducted by researchers at the University of Pittsburgh School of Medicine. The findings were published online in Molecular Psychiatry. Older adults with major depression have double the risk of developing dementia in the future compared with those who have never had the mood disorder, said senior investigator Meryl A. ...

Largest cancer genetic analysis reveals new way of classifying cancer

2014-08-07

Researchers with The Cancer Genome Atlas (TCGA) Research Network have completed the largest, most diverse tumor genetic analysis ever conducted, revealing a new approach to classifying cancers. The work, led by researchers at the UNC Lineberger Comprehensive Cancer Center at the University of North Carolina at Chapel Hill and other TCGA sites, not only revamps traditional ideas of how cancers are diagnosed and treated, but could also have a profound impact on the future landscape of drug development. "We found that one in 10 cancers analyzed in this study would be classified ...

Physical fitness can help prevent young adolescents' depression, study finds

2014-08-07

WASHINGTON – Physically fit sixth-graders – especially girls – are less likely to report feeling depressed when they reach seventh grade, according to a study presented at the American Psychological Association's 122nd Annual Convention. Even when researchers considered existing symptoms of depression and weight, sixth-grade girls who performed better on a cardiorespiratory fitness test were less likely to feel depressed when they were surveyed again in seventh grade. There was a smaller but similar effect on boys' depression, according to the findings presented by Camilo ...

Fundamental plant chemicals trace back to bacteria

2014-08-07

MADISON, Wis. — A fundamental chemical pathway that all plants use to create an essential amino acid needed by all animals to make proteins has now been traced to two groups of ancient bacteria. The pathway is also known for making hundreds of chemicals, including a compound that makes wood strong and the pigments that make red wine red. "We have been trying to unravel the source of the phenylalanine amino acid for some time," says Hiroshi Maeda, an assistant professor of botany at the University of Wisconsin-Madison. "Plants use this pathway to make natural products ...

Cell mechanics may hold key to how cancer spreads and recurs

2014-08-07

CHAMPAIGN, Ill. — Cancer cells that break away from tumors to go looking for a new home may prefer to settle into a soft bed, according to new findings from researchers at the University of Illinois. Some particularly enterprising cancer cells can cause a cancer to spread to other organs, called metastasis, or evade treatment to resurface after a patient is thought to be in remission. The Illinois team, along with colleagues in China, found that these so-called tumor-repopulating cells may lurk quietly in stiffer cellular environments, but thrive in a softer space. The ...

Climate warming may have unexpected impact on invasive species, Dartmouth study finds

2014-08-07

Rising temperatures may be seen as universally beneficial for non-native species expanding northward, but a Dartmouth College study suggests a warmer world may help some invaders but hurt others depending on how they and native enemies and competitors respond. The study, which sheds light on the uncertain relationship between climate change and invasive species, appears in the journal Ecology. A PDF of the study is available on request. Climate change and invasive species rank among the largest predicted threats to global ecosystems over the next century, but they are ...

Part of the brain stays 'youthful' into older age

2014-08-07

At least one part of the human brain may be able to process information the same way in older age as it does in the prime of life, according to new research conducted at the University of Adelaide. A study compared the ability of 60 older and younger people to respond to visual and non-visual stimuli in order to measure their "spatial attention" skills. Spatial attention is critical for many aspects of life, from driving, to walking, to picking up and using objects. "Our studies have found that older and younger adults perform in a similar way on a range of visual ...

Dimethyl fumarate for MS: Added benefit is not proven

2014-08-07

Dimethyl fumarate (trade name: Tecfidera) has been approved since January 2014 for adults with relapsing remitting multiple sclerosis (RRMS). In an early benefit assessment pursuant to the Act on the Reform of the Market for Medicinal Products (AMNOG), the German Institute for Quality and Efficiency in Health Care (IQWiG) has examined whether this new drug for MS offers an added benefit over the appropriate comparator therapy specified by the Federal Joint Committee (G-BA). However, no added benefit can be determined, as no suitable data are available, neither for the direct ...

Growing human GI cells may lead to personalized treatments

2014-08-07

AUDIO: Washington University scientists have developed a method to grow human intestinal epithelial cells from tiny biopsies that are collected from patients during routine screening procedures like colonoscopies. They say the... Click here for more information. A method of growing human cells from tissue removed from a patient's gastrointestinal (GI) tract eventually may help scientists develop tailor-made therapies for inflammatory bowel disease and other GI conditions. Reporting ...

LAST 30 PRESS RELEASES:

Mysterious ‘Dark Dwarfs’ may be hiding at the heart of the Milky Way

Real-world data shows teclistamab can benefit many multiple myeloma patients who would have been ineligible for pivotal trial

Itani studying translation potential of secure & efficient software updates in industrial internet of things architectures

Elucidating the source process of the 2021 south sandwich islands tsunami earthquake

Zhu studying use of big data in verification of route choice models

[Press-News.org] Carnegie Mellon's new programming language accommodates multiple languages in same program
Wyvern language protects computers from code injection attacks