Search

Prototype pollution is a recent vulnerability that affects JavaScript code, leading to high impact attacks such as arbitrary code execution. The vulnerability is rooted in JavaScript's prototype-based inheritance, enabling attackers to inject arbitrary properties into an object's prototype at runtime. The impact of prototype pollution depends on the existence of otherwise benign pieces of code (gadgets), which inadvertently read from attacker-controlled properties to execute security-sensitive operations. While prior works primarily study gadgets in third-party libraries and client-side applications, gadgets in JavaScript runtime environments are arguably more impactful as they affect any application that executes on these runtimes. In this paper we design, implement, and evaluate a pipeline, GHunter, to systematically detect gadgets in V8-based JavaScript runtimes with prime focus on Node.js and Deno. GHunter supports a lightweight dynamic taint analysis to automatically identify gadget candidates which we validate manually to derive proof-of-concept exploits. We implement GHunter by modifying the V8 engine and the targeted runtimes along with features for facilitating manual validation. Driven by the test suites of Node.js and Deno, we use GHunter in a study of gadgets in these runtimes. We identified a total of 56 new gadgets in Node.js and 67 gadgets in Deno, pertaining to vulnerabilities such as arbitrary code execution (19), privilege escalation (31), path traversal (13), and more. Moreover, we systematize, for the first time, existing mitigations for prototype pollution and gadgets in terms of development guidelines. We collect a list of vulnerable applications and revisit the fixes through the lens of our guidelines. Through this exercise, we identified one high-severity CVE leading to remote code execution, which was due to incorrectly fixing a gadget., Comment: 18 pages, 1 figure, 6 tables, 9 listings

Using optical orientation to manipulate magnetic moments in matter with light is a key objective in opto-spintronics, however, realizations of such control on ultrafast timescales are limited. Here, we report ultrafast optical control of magnetic moment orientation in magnetically doped metal halide perovskites. Employing intense pulses of circularly polarized light, we inject populations of spin-polarized charge carriers in pristine and manganese-doped MAPbBr3 thin films. Using transient Faraday rotation spectroscopy, we probe the ultrafast magnetic moment dynamics following photoexcitation and find that light-induced magnetization in doped samples is increased by a factor of 10. We attribute this to photoexcited carriers acting on the magnetic moments of manganese dopant-ions via the sp-d exchange interaction, which forces them to align on picosecond timescales. Our findings open new avenues for device structures that use hybrid metal halide perovskites for ultrafast optical manipulation and read-out of magnetic order with the potential for high switching rates.

Product search is uniquely different from search for documents, Internet resources or vacancies, therefore it requires the development of specialized search systems. The present work describes the H1 embdedding model, designed for an offline term indexing of product descriptions at e-commerce platforms. The model is compared to other state-of-the-art (SoTA) embedding models within a framework of hybrid product search system that incorporates the advantages of lexical methods for product retrieval and semantic embedding-based methods. We propose an approach to building semantically rich term vocabularies for search indexes. Compared to other production semantic models, H1 paired with the proposed approach stands out due to its ability to process multi-word product terms as one token. As an example, for search queries "new balance shoes", "gloria jeans kids wear" brand entity will be represented as one token - "new balance", "gloria jeans". This results in an increased precision of the system without affecting the recall. The hybrid search system with proposed model scores mAP@12 = 56.1% and R@1k = 86.6% on the WANDS public dataset, beating other SoTA analogues., Comment: 10 pages, 4 figures

In an absorbing or an active host medium characterized by a complex refractive index $n_2=n_2'+{\rm i}n_2''$, our previously developed modified dipole long-wave approximation (MLWA) is shown to essentially overly with the exact Mie theory results for spherical nanoparticle with radius $a\lesssim 25$ nm ($a\lesssim 20$ nm) in the case of Ag and Au (Al and Mg) nanoparticles. The agreement for Au and Ag (Al and Mg) nanoparticles, slightly better in the case of Au than Ag, continues to be acceptable up to $a\sim 50$ nm ($a\sim 40$ nm), and can be used, at least qualitatively, up to $a\sim 70$~nm ($a\sim 50$ nm) correspondingly. A first order analytic perturbation theory (PT) in a normalized extinction coefficient, $\bar\kappa=n_2''/n_2'$, around a nonabsorbing host is developed within the dipole MLWA and its properties are investigated. It is shown that, in a suitable parameter range, the PT can reliably capture the effect of host absorption or gain on the extinction efficiency of various plasmonic nanoparticles.

Single photon emitters (SPEs) hosted in hexagonal boron nitride (hBN) are essential elementary building blocks for enabling future on-chip quantum photonic technologies that operate at room temperature. However, fundamental challenges, such as managing non-radiative decay, competing incoherent processes, as well as engineering difficulties in achieving deterministic placement and scaling of the emitters, limit their full potential. In this work, we experimentally demonstrate large-area arrays of plasmonic nanoresonators for Purcell-induced site-controlled SPEs by engineering emitter-cavity coupling and enhancing radiative emission at room temperature. The plasmonic nanoresonator architecture consists of gold-coated silicon pillars capped with an alumina spacer layer, enabling a 10-fold local field enhancement in the emission band of native hBN defects. Confocal photoluminescence and second-order autocorrelation measurements show bright SPEs with sub-30 meV bandwidth and a saturated emission rate of more than 3.8 million counts per second. We measure a Purcell factor of 4.9, enabling average SPE lifetimes of 480 ps, a five-fold reduction as compared to emission from gold-free devices, along with an overall SPE yield of 21%. Density functional theory calculations further reveal the beneficial role of an alumina spacer between defected hBN and gold, as an insulating layer can mitigate the electronic broadening of emission from defects proximal to gold. Our results offer arrays of bright, heterogeneously integrated quantum light sources, paving the way for robust and scalable quantum information systems., Comment: 41 pages, 18 figures, supplementary information

The main result of the article says that the formal power series equal to the ratio of two neighboring Chebyshev polynomials, after some renormalization, approximates the generating function of the Catalan numbers. We present a proof of this result using continued fractions. Also, for completeness of the presentation, we recall the basic properties of Chebyshev polynomials and formal power series that we use., Comment: 8 pages, in Russian. Comments are welcome!

On-chip photonic processors for neural networks have potential benefits in both speed and energy efficiency but have not yet reached the scale at which they can outperform electronic processors. The dominant paradigm for designing on-chip photonics is to make networks of relatively bulky discrete components connected by one-dimensional waveguides. A far more compact alternative is to avoid explicitly defining any components and instead sculpt the continuous substrate of the photonic processor to directly perform the computation using waves freely propagating in two dimensions. We propose and demonstrate a device whose refractive index as a function of space, $n(x,z)$, can be rapidly reprogrammed, allowing arbitrary control over the wave propagation in the device. Our device, a 2D-programmable waveguide, combines photoconductive gain with the electro-optic effect to achieve massively parallel modulation of the refractive index of a slab waveguide, with an index modulation depth of $10^{-3}$ and approximately $10^4$ programmable degrees of freedom. We used a prototype device with a functional area of $12\,\text{mm}^2$ to perform neural-network inference with up to 49-dimensional input vectors in a single pass, achieving 96% accuracy on vowel classification and 86% accuracy on $7 \times 7$-pixel MNIST handwritten-digit classification. This is a scale beyond that of previous photonic chips relying on discrete components, illustrating the benefit of the continuous-waves paradigm. In principle, with large enough chip area, the reprogrammability of the device's refractive index distribution enables the reconfigurable realization of any passive, linear photonic circuit or device. This promises the development of more compact and versatile photonic systems for a wide range of applications, including optical processing, smart sensing, spectroscopy, and optical communications.

Given a real cubic function $f(x)$ with three roots, take an equilateral triangle $ABC$, the projections of which vertices are the roots of $f(x)$. There is a folklore fact that the vertical lines through the extrema of $f(x)$ are tangent to the inscribed circle of $ABC$. We generalise this fact to a regular $n$-gon and the corresponding degree $n$ polynomial., Comment: 7 pages, in Russian, 3 figures. Comments are welcome!

We quantify superdiffusive transience for a two-dimensional random walk in which the vertical coordinate is a martingale and the horizontal coordinate has a positive drift that is a polynomial function of the individual coordinates and of the present time. We describe how the model was motivated through an heuristic connection to a self-interacting, planar random walk which interacts with its own centre of mass via an excluded-volume mechanism, and is conjectured to be superdiffusive with a scale exponent $3/4$. The self-interacting process originated in discussions with Francis Comets., Comment: 26 pages, 4 figures; v2: minor revision

This survey concerns probabilistic models motivated by cooperative sequential adsorption (CSA) models. CSA models are widely used in physics and chemistry for modelling adsorption processes in which adsorption rates depend on the spatial configuration of already adsorbed particles. Corresponding probabilistic models describe random sequential allocation of particles either in a subset of Euclidean space, or at vertices of a graph. Depending on a technical setup these probabilistic models are stated in terms of spatial or integer-valued interacting birth-and-death processes. In this survey we consider several such models that have been studied in recent years.

A two-dimensional (2D) quantum electron system is characterized by the quantized energy levels, or subbands, in the out-of-plane direction. Populating higher subbands and controlling the inter-subband transitions have wide technological applications such as optical modulators and quantum cascade lasers. In conventional materials, however, the tunability of intersubband spacing is limited. Here we demonstrate electrostatic population and characterization of the second subband in few-layer InSe quantum wells, with giant tunability of its energy, population, and spin-orbit coupling strength, via the control of not only layer thickness but also out-of-plane displacement field. A modulation of as much as 350% or over 250 meV is achievable, underscoring the promise of InSe for tunable infrared and THz sources, detectors and modulators.

For better or worse, JavaScript is the cornerstone of modern Web. Prototype-based languages like JavaScript are susceptible to prototype pollution vulnerabilities, enabling an attacker to inject arbitrary properties into an object's prototype. The attacker can subsequently capitalize on the injected properties by executing otherwise benign pieces of code, so-called gadgets, that perform security-sensitive operations. The success of an attack largely depends on the presence of gadgets, leading to high-profile exploits such as privilege escalation and arbitrary code execution (ACE). This paper proposes Dasty, the first semi-automated pipeline to help developers identify gadgets in their applications' software supply chain. Dasty targets server-side Node.js applications and relies on an enhancement of dynamic taint analysis which we implement with the dynamic AST-level instrumentation. Moreover, Dasty provides support for visualization of code flows with an IDE, thus facilitating the subsequent manual analysis for building proof-of-concept exploits. To illustrate the danger of gadgets, we use Dasty in a study of the most dependent-upon NPM packages to analyze the presence of gadgets leading to ACE. Dasty identifies 1,269 server-side packages, of which 631 have code flows that may reach dangerous sinks. We manually prioritize and verify the candidate flows to build proof-of-concept exploits for 49 NPM packages, including popular packages such as ejs, nodemailer and workerpool. To investigate how Dasty integrates with existing tools to find end-to-end exploits, we conduct an in-depth analysis of a popular data visualization dashboard to find one high-severity CVE-2023-31415 leading to remote code execution. For the first time, our results systematically demonstrate the dangers of server-side gadgets and call for further research to solve the problem.

Low-symmetry van der Waals materials have enabled strong confinement of mid-infrared light through hyperbolic phonon polaritons (HPhPs) at the nanoscale. Yet, the bottleneck persists in manipulating the intrinsic polaritonic dispersion to drive further progress in phonon-polaritonics. Here, we present a thermomechanical strategy to manipulate the HPhPs in $\alpha$-MoO$_3$ using high pressure and temperature treatment. The hot pressing engineers the stoichiometry of $\alpha$-MoO$_3$ by controllably introducing oxygen vacancy defects (OVDs), which cause a semiconductor-to-semimetal transition. Our density functional theory and finite-difference time-domain results, combined with experimental studies show that the OVDs induce a metastable metallic state by reducing the bandgap while modifying the intrinsic dielectric permittivity of $\alpha$-MoO$_3$. Photo-induced force microscopy confirms an average dielectric permittivity tunability of $|\Delta\varepsilon/\varepsilon|\approx0.35$ within a Reststrahlen band of $\alpha$-MoO$_3$, resulting in drastic shifts in the HPhP dispersion. The polariton lifetimes for pristine and hot-pressed flakes were measured as $0.92 \pm 0.06$ and $0.86 \pm 0.11$ ps, respectively, exhibiting a loss of only 7%, while the group velocity exhibited an increase of $38.8 \pm 0.2$%. The OVDs in $\alpha$-MoO$_3$ provide a low-loss platform that enables active tuning of mid-infrared HPhPs and have a profound impact on applications in super-resolution imaging, nanoscale thermal manipulation, boosted molecular sensing, and on-chip photonic circuits., Comment: 42 pages, 13 figures, supporting information

The control of light through all-optical means is a fundamental challenge in nanophotonics and a key effect in optical switching and logic. The optical bistability effect enables this control and can be observed in various planar photonic systems such as microdisk and photonic crystal cavities and waveguides. However, the recent advancements in flat optics with wavelength-thin optical elements require nonlinear elements based on metastructures and metasurfaces. The performance of these systems can be enhanced with high-Q bound states in the continuum (BIC), which leads to intense harmonic generation, improved light-matter coupling, and pushes forward sensing limits. In this study, we report on the enhanced thermo-optical nonlinearity and the observation of optical bistability in an all-dielectric metasurface membrane with BICs. Unlike many other nanophotonic platforms, metasurfaces allow for fine control of the quality factor of the BIC resonance by managing the radiative losses. This provides an opportunity to control the parameters of the observed hysteresis loop and even switch from bistability to optical discrimination by varying the angle of incidence. Additionally, we propose a mechanism of nonlinear critical coupling that establishes the conditions for maximal hysteresis width and minimal switching power, which has not been reported before. Our work suggests that all-dielectric metasurfaces supporting BICs can serve as a flat-optics platform for optical switching and modulation based on strong thermo-optical nonlinearity.

We obtain sharp Hardy inequalities on antisymmetric functions where antisymmetry is understood for multi-dimensional particles. Partially it is an extension of the previously published paper \cite{HL}, where Hardy's inequalities were considered for the antisymmetric functions in the case of the 1D particles. As a byproduct we obtain some Sobolev and Gagliardo-Nirenberg type inequalities that are applied to the study of spectral properties of Schr\"odinger operators., Comment: 19 pages, 1 figure

Due to their long-lived nature, vortex rings are highly promising for non-contact transportation of colloidal microparticles. However, they are complex structures, and their description using rigorous, closed-form mathematical expressions is challenging, particularly in the presence of strongly inhomogeneous colloidal suspensions. This study presents straightforward analytical approximations that reveal the dynamics of vortex rings transporting microparticles. Our results were validated using comprehensive simulations and experimental measurements., Comment: 8 pages, 12 figures

This paper concerns a local volatility model in which volatility takes two possible values, and the specific value depends on whether the underlying price is above or below a given threshold value. The model is known, and a number of results have been obtained for it. In particular, option pricing formulas and a power law behaviour of the implied volatility skew have been established in the case when the threshold is taken at the money. In this paper we derive an alternative representation of option pricing formulas. In addition, we obtain an approximation of option prices by the corresponding Black-Scholes prices. Using this approximation streamlines obtaining the aforementioned behaviour of the skew. Our approach is based on the natural relationship of the model with Skew Brownian motion and consists of the systematic use of the joint distribution of this stochastic process and some of its functionals., Comment: To appear in Finance and Stochastics