SE News

If you’re a developer who uses JavaScript or if you know one who does, Bryan Sullivan’s got some advice for you. Take a few moments to acquaint yourself with the dangers of eval and its related functions, and learn to better secure your applications from attackers. In this article, he compares the command to other major security issues like buffer overflows, SQL injection, and cross-site scripting.

Bryan Sullivan

http://www.stickyminds.com/s.asp?F=S15558_COL_2

Raphaël is a small JavaScript library that should simplify your work with vector graphics on the web. If you want to create your own specific chart or image crop and rotate widget, for example, you can achieve it simply and easily with this library.

Raphaël uses the SVG W3C Recommendation and VML as a base for creating graphics. This means every graphical object you create is also a DOM object, so you can attach JavaScript event handlers or modify them later. Raphaël’s goal is to provide an adapter that will make drawing vector art compatible cross-browser and easy.

Dmitry Baranovskiy

http://raphaeljs.com/

Millions of Google users worldwide use JavaScript-intensive applications such as Gmail, Google Docs, and Google Maps. Like developers everywhere, Googlers want great web apps to be easier to create, so we’ve built many tools to help us develop these (and many other) apps. We’re happy to announce the open sourcing of these tools, and proud to make them available to the web development community.

Closure Compiler is a JavaScript optimizer that compiles web apps down into compact, high-performance JavaScript code. Closure Library is a broad, well-tested, modular, and cross-browser JavaScript library. Web developers can pull just what they need from a wide set of reusable UI widgets and controls, as well as lower-level utilities for the DOM, server communication, animation, data structures, unit testing, rich-text editing, and much, much more. Closure Templates grew out of a desire for web templates that are precompiled to efficient JavaScript.

Closure Compiler, Closure Library, Closure Templates, and Closure Inspector all started as 20% projects and hundreds of Googlers have contributed thousands of patches. Today, each Closure Tool has grown to be a key part of the JavaScript infrastructure behind web apps at Google. That’s why we’re particularly excited (and humbled) to open source them to encourage and support web development outside Google. We want to hear what you think, but more importantly, we want to see what you make. So have at it and have fun!

http://googlecode.blogspot.com/2009/11/introducing-closure-tools.html

Today, I had the privilege of speaking with Brendan Eich, CTO of Mozilla Corp. and the creator of JavaScript. Brendan and his cohorts on the ECMAScript 3.1 committee recently finished working out the details for what will become the next version of JavaScript. Rather than cut up his words into a story, I’m just going to post the interview verbatim. There’s no real need to break it up. Herein, he explains what the next JavaScript means to developers. Below is the interview, uncut.

http://www.sdtimes.com/blog/post/2009/04/16/Brendan-Eich-Explains-ECMAScript-Fifth-Edition-To-You.aspx

key to mastering the client side of rich Internet application (RIA) development is learning how to manipulate the Document Object Model (DOM). The DOM gives you access to all the elements on a web page. Inside the browser, the whole web page—paragraphs, forms, tables, etc.—is represented in an object hierarchy. Using JavaScript, you can create, modify and remove elements in the page dynamically.

Chapter 10 of JavaScript for Programmers, excerpted here, introduces the DOM. Find out how to:

• Use JavaScript and the W3C Document Object Model to create dynamic web pages.
• Grasp the concepts of DOM nodes and DOM trees.
• Traverse, edit and modify elements in an XHTML document.
• Change CSS styles dynamically.
• Create JavaScript animations.

When you acquire these skills, you will be able to build robust client-side web applications.

This chapter is an excerpt from JavaScript for Programmers by Paul J. Deitel and Harvey M. Deitel, published by Prentice Hall Professional, Mar. 16, 2009, ISBN 0137001312, Copyright 2009 Pearson Education, Inc.

Paul J. Deitel and Harvey M. Deitel

http://www.devx.com/webdev/Article/41461

jQuery is a small JavaScript library that makes development of HTML-based client JavaScript drastically easier.

OK, I admit it. For many, many years I hated JavaScript. I hated writing JavaScript code, and I hated the pain that goes along with dealing with different browsers using reams of script code even more. I still hate those same problems, but thanks to a recently-gained better understanding of JavaScript and a small JavaScript client library called jQuery, I no longer dread the days when I have to write client-centric AJAX script code. In fact, I welcome them now! With client logic getting ever more complex and browsers still diverging in features and implementation of features, jQuery and other client libraries provide much needed normalization when working with JavaScript and the HTML DOM.

Rick Strahl

http://www.devx.com/codemag/Article/40923

When HTML first came out, browsers could have been called “Application Thin Clients”, if the buzzword had been in use at the time. The introduction of javascript made it possible to execute code on the client, and this turned browsers into something much more than just a “display” mechanism.

Before Javascript, Web application development was simple: everything was done server-side. The concept of MVC - Model View Controller - was easy: the HTML was generated, and that was the view. With Javascript being a full-blown programming language, the lines are being blurred between which code is responsible for the View, the Controller and even the Model. The resultant split of responsibility across client and server in wildly diverse programming languages is driving many developers to alternative technologies such as Flash, and causing headaches for those Web developers who remain.

The key components of the solution - to allow the developer to create MVC applications in a single programming language, where at least the “View” source is extracted and compiled to Javascript and HTML - actually exist and are used in production environments, thanks to Google Web Toolkit and Pyjamas. RubyJS is well on the way, too.

Luke Kenneth Casson Leighton

http://advogato.org/article/993.html

JavaScript is the most widely used dynamic language in the world and is becoming increasingly important as an application programming language. While many hard core developers are still in denial, Web 2.0 application developers from small and large companies are developing increasingly complex applications that run close to the user.

Dave Thomas

http://www.jot.fm/issues/issue_2008_11/column3/index.html

Developers and designers are using more and more JavaScript in modern designs. Sometimes this can be a hindrance to the user and take away from the simplicity of the design, and other times it can add greatly to the user’s experience. The key is a) adding the right amount of JavaScript, and b) using the right JavaScript techniques. We have already collected various JavaScript techniques in the past – now it’s time for a new portion of JavaScript.

Thanks to the Web’s widespread adoption of JavaScript, JavaScript libraries have sprung up to help make design and development easier. Here are a few of the major JavaScript libraries that developers use: jQuery, Prototype, Scriptaculous, mootools, Dojo. These frameworks have thriving communities whose members have developed countless plug-ins that can greatly add to the JavaScript framework.

However, sometimes we need JavaScript solutions that are a little more involved or specific. Here are 75 more handy JavaScript techniques that have made websites much sleeker and more interesting.

Glen Stansberry

http://www.smashingmagazine.com/2008/09/11/75-really-useful-javascript-techniques/

Yesterday, I saw that someone had created a full IoC container framework in Javascript, called squirrel. I have written (at length) previously about JDA (Javascript Dataflow Architecture) and its benefits for creating rich clients in Javascript, sometimes referring to it as “Spring for Javascript”.

However, JDA is focusing more on being a pragmatic, easy-to-use (and understand) messaging kernel, for the web page where the rich client resides, rather than a full-out IoC implementation - which Squirrel certainly is!

The goal of both frameworks are of course to force the developer (Yes, that means you) to modularize code, and not sprawl all over the page out of laziness (as usual).

Peter Svensson

http://unclescript.blogspot.com/2007/11/coming-frameworks-sofea-jda-squirrel.html

Microsoft Silverlight is a cross-browser, cross-platform plug-in for delivering the next generation of .NET based media experiences and rich interactive applications for the Web. Silverlight offers a flexible programming model that supports AJAX, VB, C#, Python, and Ruby, and integrates with existing Web applications. Silverlight supports fast, cost-effective delivery of high-quality video to all major browsers running on the Mac OS or Windows.

http://silverlight.net/

JavaScript Hijacking appears to be a ubiquitous problem. As part of Fortify’s work, the 12 most popular AJAX frameworks were analyzed, including frameworks from Google (NASDAQ: GOOG), Microsoft (NASDAQ: MSFT), Yahoo! (NASDAQ: YHOO) and the open source community. Fortify determined that among them, only Direct Web Remoting (DWR) 2.0 implements mechanisms for preventing JavaScript Hijacking. The rest of the frameworks do not explicitly provide any protection and do not mention any security concerns in their documentations. Even if an application does not use any of the frameworks listed above, it may be vulnerable if it contains AJAX components that use JavaScript as a data transfer format for sensitive data.

http://www.fortifysoftware.com/news-events/releases/2007/2007-04-02.jsp

The latest release of Ruby on Rails, version 1.2, was announced last week to great fanfare. But the announcement might have overshadowed news of a simultaneous release: version 1.5 of Prototype, the popular JavaScript library. Despite the synchronization and developer overlap between the two projects, nothing about Prototype depends on Rails –it’s perfectly suitable for use with any server-side technology. In fact, Prototype has amassed a huge user base beyond the Rails community– from dozens of Web 2.0 startups to household names like Apple, NBC, and Gucci.

The Prototype library is fairly compact (about 15K), and decidedly not a kitchen-sink library. It doesn’t provide custom widgets or elaborate visual effects. Instead, it just strives to make JavaScript more pleasant to work with. In many ways, Prototype acts like the missing standard library for JavaScript— it provides the functionality that arguably ought to be part of the core language.

Scott Raymond

http://www.xml.com/pub/a/2007/01/24/whats-new-in-prototype-15.html