Building a moderately complex Web page requires understanding a whole stack of technologies, from HTML to JavaScript. Now a researcher from the Massachusetts Institute of Technology (MIT) has wrapped these technologies into a single language that could streamline development, speed up performance and better secure Web sites.
The language, called Ur/Web, provides a way for developers to write pages as self-contained programs. It incorporates many of the most widely used Web technologies, freeing the developer from working with each language individually.
“I think this is a language with potential broad applicability to reduce costs of Web development in many different settings,” said Ur/Web’s author, Adam Chlipala, an MIT computer science assistant professor. “It brings some well-ad understood software engineering advantages to aspects of the Web that have been handled in more ad hoc ways.”
Chlipala will present his work next month at the Association for Computing Machinery’s Symposium on Principles of Programming Languages.
Developing a Web site requires understanding a range of different languages, as well as how they interact.
Hypertext Markup Language (HTML) offers basic formatting for the Web page, but there is a whole range of adjoining Web technologies that are usually deployed as well: Cascading Style Sheets (CSS) provides a way to modify the look of a Web page, and the Extensible Markup Language (XML) structures data for additional processing and classification. JavaScript provides the foundation for writing the business logic for user interactions. And if data is stored in a database, a developer will need to know SQL (Structured Query Language) as well.
Ur/Web encapsulates all the capabilities of such Web development tools within a single language, which is compiled into machine executable code.
Because Ur/Web code is compiled, it can be substantially more efficient to run than code from commonly used Web development languages, Chlipala said.
“In Ur/Web, everything is based on transactions, where a single client request is handled by what looks like an uninterrupted execution of a single function,” Chlipala said. “The language implementation has optimizations in it to support running many requests in parallel, on real servers. But the programmer can pretend everything is a transaction and think in a simpler concurrency model.”
In addition to potentially lessening the cognitive burden for developers, Ur/Web’s top-down approach offers some safety mechanisms that could make Web sites more secure.
The language prohibits unintended interactions among different page elements. With this limit in place, embedded code for supplying ads could not interfere with a calendar widget elsewhere on the page, for example.
Also, like traditional programming languages such as C and Java—and unlike Web languages such as JavaScript—Ur/Web is strongly typed. This means all variables and functions must conform to a preset data type, which limits the ability of an attacker to send maliciously formatted data through a Web form. Ur/Web also supports variable scoping, or the ability to limit where a variable can be called within a program.
The language does have a potential downside. For the average Web developer, Ur/Web could require a “very steep” learning curve, Chlipala admitted. It is what is known as a functional programming language, a style of programming that treats programs as a series of functions, which can be computationally more efficient but harder to learn for a programmer versed in more widely used procedural or object-oriented languages.
Chlipala compared Ur/Web to Haskell, a functional programming language considered esoteric by many programmers yet loved by a dedicated community that praises its computational functionality.
Chlipala is one of a number of MIT researchers who have been pushing the frontiers of software programming languages of late. Another MIT researcher is designing a language called Sketch that can automatically complete sections of code for a program being written. Another MIT effort, dubbed Stack, is designed to identify parts of code that compilers routinely disregard but that nonetheless could be useful.