Chapter 5. Languages

The secret of eternal youth is arrested development.

Alice Roosevelt Longworth (1884 1980)

By now you should have noticed a theme there is more than meets the eye when considering wireless systems. So, too, is the case with wireless languages. Wired languages and wireless languages do not differ in many ways, but in their differences lies dangerous ground. If developers are not aware of the differences, applications can be wide open to attack. Wireless application languages are specially designed to accommodate smaller display screens, slower networks, and devices with less memory. Typically, intensive processes are run on servers, rarely on devices themselves. Although this applies more to applications that will be run on PDAs or cell phones instead of wireless laptops, it is the focus of this chapter. The languages we cover are Java 2 Micro Edition (J2ME), Wireless Markup Language (WML), and its partner script, WMLScript. (Both WML and WMLScript are used in WAP systems.)

Now, if you are a project manager or anyone whose job function is at a higher level technically than a developer, this chapter may seem irrelevant for your security planning purposes. The devil is in the details here, and someone on a development team has to be responsible for expertise in wireless languages. This is a good chapter to refer a colleague and developer to you can combine your recently acquired expertise in security principles as they apply to wireless systems with that developer's knowledge of wireless programming.

This chapter does not teach the languages to the extent that you can become proficient, or even to the extent that you can use it as a primary resource in learning about the languages. This chapter is included for completeness. It is our firm belief that understanding the ramifications of the programming language you choose for development is an important part in developing a holistic security solution for a given project or environment. To this end, we describe the languages in their most basic forms, discuss notable details, and provide insight into their security features and drawbacks. A background in programming languages such as HTML, Java, C, or C++ is necessary to achieve competency in the languages discussed here.

J2ME, WML, and WMLScript have several things in common. They are all subsets (whether or not directly derived) of traditional programming and Internet languages. J2ME is a subset of Java 2, WML is based on both HTML and XML, and WMLScript is based on JavaScript's earliest version, ECMAScript. They differ in their scope, functionality, and common uses. First, we will take a look at WML.