On this page:

Target audience:

Users of the extension providing HTML5/JavaScript support for Web applications.

Summary: This document provides basic information about the extension providing HTML5/JavaScript support for Web applications.

What's new in 1.9.0?

Bugs resolution, including support of new expressions in lists.
Better resolution with jsp files.
Support of jsp pager taglib.
Support of struts-jquery-grid-tags taglib.
Resources found in <form> tags have GET as default type (not POST).
Files filtering enhancement (skipped files are no more sent to other extensions).
Issue fixed for the rule "Avoid JavaScript to block page loading"
Issue fixed for the rule "Avoid using unsecured cookies"
Issue fixed for the rule "Avoid creating cookie without setting httpOnly option"
New rules:
- 1020098 Avoid creating cookie with overly broad path (Javascript)
- 1020100 Avoid creating cookie with overly broad domain (Javascript)

Description

In what situation should you install this extension?

The analyzer could be used if your application is a Web Application, has HTML/Javascript/CSS files and/or contains HTML/Javascript fragments embedded into JEE and .NET files (for example).

The analyzer provides the following features:

Automated Function Point counting.
Checksum, number of code lines, number of comment lines, comments are present.
Local and global resolution is done when function is called directly through its name (inference engine resolution is not available).
For global resolution, caller is searched in all .js files. If only one callee is found, a link is created. If several callees are found, the analyzer watches inclusions in html files to see if it can filter the callee. If nothing is found in html files to filter, links are created to all possible callees.

Files analyzed

File	Extension	Note
HTML	.html, .htm, *.xhtml	Supports HTML/XHTML versions 1 - 5. creates one "HTML5 Source Code" object that is the caller of html to js links and a transaction entry point broadcasts tags and attributes/values to other CAST extensions such as AngularJS. Other extensions will not need to analyze the files themselves.
Javascript	.js, .jsx	Supports: JavaScript 1 to 1.8.1. JavaScript ECMA 6 See also HTML5 and JavaScript - 1.9#JavaScript below for more information.
Cascading Style Sheet	*.css	Supports CSS 1 - 3.
Java Server Page	.jsp, .jspx	Supports JSP 1.1 - 2.3. See HTML5 and JavaScript - 1.9#JSP below for more information.
Active Server Page	.asp, .aspx	See (Classic) ASP below for more information.
HTML Components	*.htc	HTC files contain html, javascript fragments that will be parsed. Created objects will be linked to the HTC file.
ASP.NET MVC Razor	*.cshtml	See ASP.NET MVC Razor below for more information.

Note that by default some files are automatically excluded from the analysis, typically third-party frameworks which are not required. Please see the filters.json file located at the root of the extension folder for a complete list of default exclusions.

Technology support notes

(Classic) ASP

ASP.NET MVC Razor

JavaScript

CAST AIP has provided support for analyzing JavaScript via its JEE and .NET analyzers (provided out of box in CAST AIP) for some time now. The HTML5/JavaScript extension also provides support for JavaScript but with a focus on web applications. CAST highly recommends that you use this extension if your Application contains JavaScript and more specifically if you want to analyze a web application, however you should take note of the following when using the extension with CAST AIP ≤ 8.2.x

You should ensure that you configure the extension to NOT analyze the back end web client part of a .NET or JEE application.
You should ensure that you configure the extension to ONLY analyze the front end web application built with the HTML5/JavaScript that communicates with the back end web client part of a .NET or JEE application.
If the back end web client part of a .NET or JEE application is analyzed with the HTML5/JavaScript extension and with the native .NET/JEE analyzers, then your results will reflect this - there will be duplicate objects and links (i.e. from the analyzer and from the extension) therefore impacting results and creating erroneous Function Point data.

Note that in CAST AIP ≥ 8.3.x, support for analyzing JavaScript has been withdrawn from the JEE and .NET analyzers.

Support of JavaScript in this extension

JavaScript (1 to 1.8.1):
- Javascript call(), function(), bind(), prototype and prototype inheritance are supported
- creates Functions, Classes and Constructors
- local call links between function calls and functions inside each JavaScript file are created

JavaScript ECMA 6:
- Supported Object Oriented statements are :
  - arrows (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Functions/Arrow_functions)
  - classes (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Classes)
  - const (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/const)
  - let (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/let)
  - try...catch (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/try...catch)
  - subclassable built-ins
  No explicit support
  - symbols (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol)
  - promises (https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Global_Objects/Promise#Advanced_Example)
  - reflect api (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Reflect)
  - proxies (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Proxy)

JSP

Transaction configuration information

HTML5 source code: it represents the whole HTML file content.

Function Point, Quality and Sizing support

This extension provides the following support:

Function Points (transactions): a green tick indicates that OMG Function Point counting and Transaction Risk Index are supported
Quality and Sizing: a green tick indicates that CAST can measure size and that a minimum set of Quality Rules exist

Function Points (transactions)	Quality and Sizing	Security

CAST AIP compatibility

This extension is compatible with:

CAST AIP release	Supported
8.3.x
8.2.x
8.1.x
8.0.x
7.3.4 and all higher 7.3.x releases

Supported DBMS servers

This extension is compatible with the following DBMS servers:

CAST AIP release	CSS	Oracle	Microsoft
All supported releases

Prerequisites

An installation of any compatible release of CAST AIP (see table above)

Download and installation instructions

Please see:

The latest release status of this extension can be seen when downloading it from the CAST Extend server.

Packaging, delivering and analyzing your source code

Once the extension is downloaded and installed, you can nowpackage your source code and run an analysis. The process of packaging, delivering and analyzing your source code is described below:

What results can you expect?

Once the analysis/snapshot generation has completed, you can view the results in the normal manner:

CAST Enlighten

CAST AIP Extensions > HTML5 and JavaScript - 1.9 > JavascriptInheritanceByClass.PNG

Javascript ECMA6 Classes and Constructors example

CAST Management Studio analysis content

Objects

The following objects are displayed in CAST Enlighten:

Icon	Description
	JavaScript file
	HTML5 Source Code
	HTML5 Source Code Fragment
	HTML5 ASP Content
	HTML5 ASPX Content
	HTML5 CSHTML Content
	HTML5 CSS Source Code
	HTML5 CSS Source Code Fragment
	HTML5 HTC Content
	HTML5 JavaScript Source Code
	HTML5 JSX source code
	HTML5 JavaScript Source Code Fragment
	HTML5 JavaScript Function
	HTML5 Javascript Method
	HTML5 Javascript Class
	HTML5 Javascript Class Constructor
	HTML5 Web Socket Service ASP.NET Any Operation
	HTML5 Get XMLHttpRequest Service HTML5 Get HttpRequest Service ASP.NET Get Operation HTML5 Razor Get service
	HTML5 Update XMLHttpRequest Service HTML5 Update HttpRequest Service ASP.NET Put Operation
	HTML5 Post XMLHttpRequest Service HTML5 Post HttpRequest Service ASP.NET Post Operation HTML5 Razor Post service
	HTML5 Delete XMLHttpRequest Service HTML5 Delete HttpRequest Service ASP.NET Delete Operation