Papers for

web developers

Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.

ReDoS vulnerabilities grow and detection tools often disagree

An Empirical Analysis of ReDoS Vulnerabilities and ReDoS Detection Tools

Abstract: ReDoS vulnerabilities are a type of denial of service software weakness that occurs when a regex is used to validate user-supplied input. In some cases, the regex matching process can take exponential time, leading to a denial of service. In this study, we examine and compare the effectiveness of five publicly-available regex detection tools, and one regex correction tool, using three datasets. We further perform an empirical analysis of all ReDoS vulnerabilities reported to the NVD database in order to understand how they differ from non-ReDoS vulnerabilities and glean insights about this type of weakness. We find that ReDoS vulnerabilities are becoming more prevalent and are much more likely to be exploited than non-ReDoS vulnerabilities. We further find that detection tools exhibit substantial disagreement on whether or not a given regex is vulnerable.

Wed 9 SeptCryptography and Security
The gist
ReDoS vulnerabilities happen when a special search pattern called a regex takes a very long time to check bad input, causing websites or services to slow down or stop. The authors studied several tools that try to find these slow regexes and found that the tools often disagree about which ones are risky. They also looked at real cases from a security database and found that ReDoS problems are becoming more common and are more likely to be attacked than other problems. This shows that spotting these vulnerabilities is important but still challenging.
Open → 2609.10294v1

Plain language makes cookie banners easier to understand for everyone

Senseful Consense: Towards Simplified Cookie Banners using Plain Language

Abstract: While the GDPR and ePrivacy Directive mandate that consent information must be clear and accessible, most modern cookie banners remain obscured by technical jargon, vague phrasing, and frequent content overload or underload. This feasibility study investigates the impact of applying plain language (Einfache Sprache) to cookie banners within the IAB Transparency & Consent Framework (TCF). In our study, we analysed cookie banner texts from 200 websites, using AI-based mapping to categorise extracted content into standardised processing purposes. By substituting complex legal terms with simplified descriptions, we successfully demonstrated that the comprehension barrier can be lowered from a college-graduate level to a 7th-grade level. However, the effectiveness of plain language is inherently constrained by the informativeness of the original content; it cannot compensate for banners that omit legally required details. We conclude that while plain language is a vital tool for digital accessibility, it must be paired with standardised implementation guidelines to ensure that cookie banners are both readable and informative.

Wed 9 SeptComputers and SocietyHuman-Computer Interaction
The gist
Many cookie banners that ask for consent use complicated legal language that is hard for most people to understand. The authors studied 200 websites and changed their cookie banners into simpler language that matches a 7th-grade reading level instead of college-level. This makes the banners easier to read, but it can’t fix banners that leave out important information. The authors say that simple language should be combined with clear rules so banners are both easy to read and contain the right information.
Open → 2609.10271v1

Agentic tools improve web accessibility audits for specific guidelines

Agentic Web Accessibility Auditing: Authoring and Evaluating Per-Criterion Worker Agents for WCAG

Abstract: Automated accessibility assessments differ in the evidence they collect and the requirements they address. We present a framework that combines shared browser tools with criterion-specific worker agents, implementing 39 WCAG 2.1 Level A and AA criteria and one additional WCAG 2.2 criterion. We analyze archived predictions on 250 page-criterion records derived from professional audits of scholarly platforms. Workers recover 0.86 of positive reference labels, compared with 0.36 for axe-core and 0.67 for an uncued vision-language model, with lower precision. Criterion-level results, abstentions, development-exposure sensitivities, and separately instrumented runs qualify these comparisons. Inferred negative labels and differences between evaluated configurations limit conclusions about true accuracy and causal effects. We contribute the framework, its criterion-specific implementation, and an evaluation account that distinguishes detection, evidence availability, and resource use, motivating further study of inspectable automated assessments within professional auditing.

Tue 8 SeptHuman-Computer Interaction
The gist
Checking websites to make sure they work well for everyone, including people with disabilities, can be hard because automated tools don’t always catch all problems. The authors created a system that uses specialized agents, each focusing on a different accessibility rule from recognized guidelines, to better find issues on websites. Their system was tested on real audits and found more true problems than existing tools, though sometimes with less accuracy. This approach helps auditors see what evidence each agent uses and could make automated website accessibility checking more reliable.
Open → 2609.09379v1