{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,22]],"date-time":"2026-09-22T07:49:08Z","timestamp":1790063348349,"version":"4.0.1"},"publisher-location":"New York, New York, USA","reference-count":33,"publisher":"ACM Press","license":[{"start":{"date-parts":[[2018,1,1]],"date-time":"2018-01-01T00:00:00Z","timestamp":1514764800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2018]]},"DOI":"10.1145\/3184558.3188736","type":"proceedings-article","created":{"date-parts":[[2018,4,18]],"date-time":"2018-04-18T18:04:25Z","timestamp":1524074665000},"page":"753-758","source":"Crossref","is-referenced-by-count":8,"title":["An Empirical Study of the Framework Impact on the Security of JavaScript Web Applications"],"prefix":"10.1145","author":[{"given":"Ksenia","family":"Peguero","sequence":"first","affiliation":[{"name":"George Washington University, Washington, DC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nan","family":"Zhang","sequence":"additional","affiliation":[{"name":"Pennsylvania State University, University Park, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiuzhen","family":"Cheng","sequence":"additional","affiliation":[{"name":"George Washington University, Washington, DC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","reference":[{"key":"key-10.1145\/3184558.3188736-1","unstructured":"AngularJS. 2017. Documentation: $sce. (2017). deftempurl%https:\/\/docs.angularjs.org\/api\/ng\/service\/$sce Retrieved October 15, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-2","unstructured":"ESLint Node.js API. 2017. (2017). deftempurl%http:\/\/eslint.org\/docs\/developer-guide\/nodejs-api Retrieved October 17, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-3","doi-asserted-by":"crossref","unstructured":"S. Artzi, J. Dolby, S. Jensen, A. Moeller, and F. Tip. 2011. A framework for automated testing of JavaScript web applications Proc. of the 33rd International Conference on Software Engineering. 571--580.","DOI":"10.1145\/1985793.1985871"},{"key":"key-10.1145\/3184558.3188736-4","unstructured":"EJS. 2017. (2017). deftempurl%https:\/\/github.com\/mde\/ejs Retrieved October 17, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-5","unstructured":"EJS-Lint. 2017. (2017). deftempurl%https:\/\/github.com\/RyanZim\/EJS-Lint Retrieved October 17, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-6","unstructured":"ESLint. 2017. (2017). deftempurl%https:\/\/github.com\/eslint\/eslint Retrieved October 17, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-7","unstructured":"ESLint-plugin-pug. 2017. (2017). deftempurl%https:\/\/github.com\/myfreeweb\/eslint-plugin-pug Retrieved October 15, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-8","unstructured":"XSS Filter. 2017. (2017). deftempurl%https:\/\/msdn.microsoft.com\/en-us\/library\/dd565647(v=vs.85).aspx Retrieved October 15, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-9","unstructured":"Fis-parser-ejs. 2013. (2013). deftempurl%https:\/\/github.com\/fouber\/fis-parser-ejs Retrieved October 17, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-10","doi-asserted-by":"crossref","unstructured":"A. Gizas, S. Christodoulou, and T. Papatheodorou. 2012. Comparative evaluation of JavaScript frameworks. In Proc. of the 21st International Conference on World Wide Web. 513--514.","DOI":"10.1145\/2187980.2188103"},{"key":"key-10.1145\/3184558.3188736-11","doi-asserted-by":"crossref","unstructured":"D. Graziotin and P. Abrahamsson. 2013. Making sense out of a jungle of JavaScript frameworks: towards a practitioner-friendly comparative analysis. In Proc. of the 14th International Conference on Product-Focused Software Process Improvement (PROFES). 334--337.","DOI":"10.1007\/978-3-642-39259-7_28"},{"key":"key-10.1145\/3184558.3188736-12","unstructured":"C. Heinrich. 2017. Comparison of 2003, 2004, 2007, 2010 and 2013 Releases. (2017). deftempurl%https:\/\/raw.githubusercontent.com\/cmlh\/OWASP-Top-Ten-2010\/Release_Candidate\/OWASP_Top_Ten_-_Comparison_of_2003,_2004,_2007,_2010_and_2013_Releases-RC1.pdf Retrieved October 15, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-13","doi-asserted-by":"crossref","unstructured":"C. Jensen, A. Moeller, and Z. Su. 2013. Server interface descriptions for automated testing of JavaScript web applications Proc. of the 9th Joint Meeting on Foundations of Software Engineering. 510--520.","DOI":"10.1145\/2491411.2491421"},{"key":"key-10.1145\/3184558.3188736-14","doi-asserted-by":"crossref","unstructured":"V. Kashyap et almbox. 2014. JSAI: a static analysis platform for JavaScript. In Proc. of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering. 121--132.","DOI":"10.1145\/2635868.2635904"},{"key":"key-10.1145\/3184558.3188736-15","unstructured":"ksdmitrieva. 2017. Analysis Pipeline. (2017). deftempurl%https:\/\/github.com\/ksdmitrieva\/AnalysisPipeline Retrieved December 10, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-16","doi-asserted-by":"crossref","unstructured":"G. Li, E. Andreasen, and I. Ghosh. 2014. SymJS: automatic symbolic testing of JavaScript web applications Proc. of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering. 449--459.","DOI":"10.1145\/2635868.2635913"},{"key":"key-10.1145\/3184558.3188736-17","unstructured":"Markdown. 2017. (2017). deftempurl%https:\/\/github.com\/evilstreak\/markdown-js Retrieved October 15, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-18","doi-asserted-by":"crossref","unstructured":"N. Nikiforakis et almbox. 2012. You are what you include: large-scale evaluation of remote JavaScript inclusions Proc. of the ACM Conference on Computer and Communications Security. 736--747.","DOI":"10.1145\/2382196.2382274"},{"key":"key-10.1145\/3184558.3188736-19","unstructured":"NoScript. 2017. (2017). deftempurl%https:\/\/noscript.net\/ Retrieved October 15, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-20","doi-asserted-by":"crossref","unstructured":"F. Ocariza, K. Bajaj, K. Pattabiraman, and A. Mesbah. 2013. An empirical study of client-side JavaScript bugs. In IEEE International Symposium on Empirical Software Engineering and Measurement.","DOI":"10.1109\/ESEM.2013.18"},{"key":"key-10.1145\/3184558.3188736-21","doi-asserted-by":"crossref","unstructured":"F. Ocariza, K. Bajaj, K. Pattabiraman, and A. Mesbah. 2015. Detecting inconsistencies in JavaScript MVC applications ACM 37th IEEE International Conference on Software Engineering (ICSE).","DOI":"10.1109\/ICSE.2015.52"},{"key":"key-10.1145\/3184558.3188736-22","unstructured":"OWASP. 2017 a. Top 10 - 2017 Release Candidate. (2017). deftempurl%https:\/\/github.com\/OWASP\/Top10\/raw\/master\/2017\/OWASP%20Top%2010%20-%202017%20RC1-English.pdf Retrieved May 15, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-23","unstructured":"OWASP. 2017 b. Top Ten Project. (2017). deftempurl%https:\/\/www.owasp.org\/index.php\/Category:OWASP_Top_Ten_Project Retrieved September 29, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-24","doi-asserted-by":"crossref","unstructured":"I. Parameshvaran, E. Budianto, and S. Shinde. 2015. Auto-patching DOM-based XSS at scale. In Proc. of the 10th Joint Meeting on Foundations of Software Engineering. 272--283.","DOI":"10.1145\/2786805.2786821"},{"key":"key-10.1145\/3184558.3188736-25","unstructured":"Pug-lexer. 2016. (2016). deftempurl%https:\/\/github.com\/pugjs\/pug-lexer Retrieved October 15, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-26","unstructured":"Pug-parser. 2017. (2017). deftempurl%https:\/\/github.com\/pugjs\/pug-parser Retrieved October 15, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-27","unstructured":"Donald Ray and Jay Ligatti. 2012. Defining Code-injection Attacks. In Proceedings of the 39th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL '12). ACM, New York, NY, USA, 179--190. deftempurl%https:\/\/doi.org\/10.1145\/2103656.2103678showDOItempurl"},{"key":"key-10.1145\/3184558.3188736-28","unstructured":"Caja HTML Sanitizer. 2017. (2017). deftempurl%https:\/\/github.com\/theSmaw\/Caja-HTML-Sanitizer Retrieved October 15, 2017 from tempurl"},{"key":"key-10.1145\/3184558.3188736-29","doi-asserted-by":"crossref","unstructured":"P. Saxena et almbox. 2010. A symbolic execution framework for JavaScript. In Proc. of the IEEE Symposium on Security and Privacy. 513--528.","DOI":"10.1109\/SP.2010.38"},{"key":"key-10.1145\/3184558.3188736-30","doi-asserted-by":"crossref","unstructured":"A. Taly, U. Erlingsson, J. Mitchell, M. Miller, and J. Nagra. 2011. Automated analysis of security-critical JavaScript APIs Proc. of the IEEE Symposium on Security and Privacy. 363--378.","DOI":"10.1109\/SP.2011.39"},{"key":"key-10.1145\/3184558.3188736-31","unstructured":"Weinberger et almbox. 2011 a. An empirical analysis of XSS sanitization in web application frameworks EECS Department, University of California, Berkeley, Technical Report No. UCB\/EECS-2011--11."},{"key":"key-10.1145\/3184558.3188736-32","doi-asserted-by":"crossref","unstructured":"Weinberger et almbox. 2011 b. A systematic analysis of XSS sanitization in web application frameworks Proc. of the 16th European Conference on Research in Computer Security. 150--171.","DOI":"10.1007\/978-3-642-23822-2_9"},{"key":"key-10.1145\/3184558.3188736-33","doi-asserted-by":"crossref","unstructured":"C. Yue and H. Wang. 2009. Characterizing insecure JavaScript practices on the web Proc. of the 18th International Conference on World Wide Web. 961--970.","DOI":"10.1145\/1526709.1526838"}],"event":{"name":"Companion of the The Web Conference 2018","location":"Lyon, France","acronym":"WWW '18","number":"2018","sponsor":["IW3C2, International World Wide Web Conference Committee","SIGWEB, ACM Special Interest Group on Hypertext, Hypermedia, and Web"],"start":{"date-parts":[[2018,4,23]]},"end":{"date-parts":[[2018,4,27]]}},"container-title":["Companion of the The Web Conference 2018 on The Web Conference 2018 - WWW '18"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3184558.3188736","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/dl.acm.org\/ft_gateway.cfm?id=3188736&ftid=1958265&dwn=1","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T01:08:24Z","timestamp":1750208904000},"score":1,"resource":{"primary":{"URL":"http:\/\/dl.acm.org\/citation.cfm?doid=3184558.3188736"}},"subtitle":[],"proceedings-subject":"The Web Conference 2018","short-title":[],"issued":{"date-parts":[[2018]]},"references-count":33,"URL":"https:\/\/doi.org\/10.1145\/3184558.3188736","relation":{},"subject":[],"published":{"date-parts":[[2018]]}}}