String sanitizer modeling

One or more non-transitory computer-readable medium storing computer program code comprising sets of instructions to:

• obtain data flow information indicating one or more string operations in source code that used an input string or information derived from the input string as a parameter when executing the source code, the one or more string operations including a string sanitizer function, the string sanitizer function including an input parameter and an output parameter;
• generate a graph representing the input parameter and the output parameter of the string sanitizer function;
• generate, based on the graph, a deterministic finite automata representing string values of the output parameter, the deterministic finite automata accepting possible output string values of the string sanitizer function;
• determine that there is a non-empty intersection between the deterministic finite automata and an exploit automata for a security exploit, the non-empty intersection indicating that the string sanitizer function is vulnerable to a code injection exploit,
• wherein the string sanitizer function includes at least one of:
• a replace-once string operation, the replace-once string operation replacing a first instance of matching string matching a target string but not later instances of the matching string, a first substring string operation that returns a first portion of the input string, a slice string operation that returns a second portion of the input string from a start index to a stop index, or a second substring string operation that returns a third portion of the input string from a first index to a second index.

A computer-implemented method, comprising:

• obtaining data flow information indicating one or more string operations in source code that used an input string or information derived from the input string as a parameter when executing the source code, the one or more string operations including a string sanitizer function, the string sanitizer function including an input parameter and an output parameter;
• generating a graph representing the input parameter and the output parameter of the string sanitizer function;
• generating a deterministic finite automata for the string sanitizer function based on the graph, the deterministic finite automata accepting possible output string values of the string sanitizer function;
• determining that there is a non-empty intersection between the deterministic finite automata and an exploit automata for a security exploit, the non-empty intersection indicating that the string sanitizer function is vulnerable to a code injection exploit,
• wherein the deterministic finite automata sets an accept status or a reject status such that it marks the first occurrence of matching strings in the input string.