On the systematic design of web languages

sensitive information, or to limit access to output devices. But such restrictions would likely render many applications useless. For example, a downloaded mail tool would need access to a client's sensitive mailfolder and to a nonsensitive, publicly-writable directory like /tmp for message composition and replies. However, granting such access rights requires care, since a mail tool might now be able to copy a client's entire mailfolder to /tmp. Authors' addresses: D. Volpano : Computer Science Department, Naval Postgraduate School, Monterey, CA 93943, USA; email: [email protected]; G. Smith: School of Computer Science, Florida International University, Miami, FL 33199, USA; email: [email protected]. 1 Java is a registered trademark of Sun Microsystems Inc. There is a form of static analysis, however, that can be applied to programs to protect against disclosure attacks while allowing utilities like mail to