Download Extending Java for High-Level Web Service Construction

2
·
Christensen, Møller, and Schwartzbach
with a client. With standard technologies, sessions must be encoded by hand,
which is tedious and error-prone. More significantly, it is difficult to understand
the control-flow of an entire service from the program source since the interactions
between the client and the server are distributed among several seemingly unrelated
code fragments. This makes maintenance harder for the programmer if the service
has a complicated control-flow. Also, it prevents compilers from getting a global
view of the code to perform whole-service program analyses.
The dynamic construction of Web pages is typically achieved by print statements
that piece by piece construct HTML fragments from text strings. Java is a generalpurpose language with no inherent knowledge of HTML, so there are no compiletime guarantees that the resulting documents are valid HTML. For static pages,
it is easy to verify validity [Oskoboiny 2001], but for pages that are dynamically
generated with a full programming language, the problem is in general undecidable.
Not even the much simpler property of being well-formed can be guaranteed in
this way. Instead of using string concatenation, document fragments may be built
in a more controlled manner with libraries of tree constructor functions. This
automatically ensures well-formedness, but it is more tedious to use and the problem
of guaranteeing validity is still not solved.
The inability to automatically extract the control-flow of the sessions in a service
raises another problem. Typically, the dynamically generated HTML pages contain
input forms allowing the client to submit information back to the server. However,
the HTML page with the form is constructed by one piece of the service code, while
a different piece takes care of receiving the form input. These two pieces must agree
on the input fields that are transmitted, but when the control-flow is unknown to
the compiler, this property cannot be statically checked. Thorough and expensive
runtime testing is then required, and that still cannot give any guarantees.
The <bigwig> language [Brabrand et al. 2002] is a research language designed to
overcome these problems. Its core is a strongly typed C-like language. On top is
a high-level notion of sessions where client interactions resemble remote procedure
calls such that the control-flow is explicit in the source code [Brabrand et al. 1999].
Also, XHTML [Pemberton et al. 2000], the XML version of HTML, is a built-in
data type with operations for dynamically constructing documents. The values
of this data type are well-formed XHTML fragments which may contain “named
gaps”. Such fragments can be combined with a special “plug” operation which
inserts one fragment into a gap in another fragment. This proves to be a highly
flexible but controlled way of building documents.
In <bigwig>, the client interactions and the dynamic document construction are
checked at compile time using a specialized type system [Sandholm and Schwartzbach
2000] and a program analysis [Brabrand et al. 2001] performing a conservative approximation of the program behavior to attack the problems mentioned above.
More specifically, <bigwig> services are verified at compile time to ensure that (1)
a plug operation always finds a gap with the specified name in the given fragment,
(2) the code that receives form input is presented with the expected fields, and (3)
only valid XHTML 1.0 is ever sent to the clients.