# US 12,182,273 B2 · String sanitizer modeling > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,273 B2 - Document ID: US12182273B2 - Status: Granted - Kind: B2 - Application number: 17/665,319 - Filed: 2022-02-04 - Published: 2023-08-10 - Granted: 2024-12-31 - Earliest claimed: 2022-02-04 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Thomas Barber; David Klein; Martin Johns - Web page: https://patentgrep.com/patent/US12182273B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/563: {by source code analysis} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Code injection is a type of security vulnerability in which an attacker injects client-side scripts modifying the content being delivered. A sanitizer function may provide defense against such attacks by removing certain characters (e.g., characters causing state transitions in HTML). A string sanitizer may be modeled in order to determine its effectiveness by obtaining data flow information indicating string operations that used an input string or information derived therefrom, including a string sanitizer function. A deterministic finite automata representing string values of the output parameter may be generated based on a graph generated from the data flow information, where the automata accepts possible output string values of the sanitizer. It can be determined whether there is a non-empty intersection between the automata for the sanitizer output and an automata representing a security exploit, which would indicate that the sanitizer function is vulnerable to the exploit. ## Claims ### Claim 1 A computer system, comprising: one or more processors; one or more machine-readable medium coupled to the one or more processors and storing computer program code comprising sets instructions executable by the one or more processors to: obtain data flow information indicating one or more string operations in source code that used an input string or information derived from the input string as a parameter when executing the source code, the one or more string operations including a string sanitizer function, the string sanitizer function including an input parameter and an output parameter; generate a graph representing the input parameter and the output parameter of the string sanitizer function; generate, based on the graph, a deterministic finite automata representing string values of the output parameter, the deterministic finite automata accepting possible output string values of the string sanitizer function; determine that there is a non-empty intersection between the deterministic finite automata and an exploit automata for a security exploit, the non-empty intersection indicating that the string sanitizer function is vulnerable to a code injection exploit, wherein the string sanitizer function includes at least one of: a replace-once string operation, the replace-once string operation replacing a first instance of matching string matching a target string but not later instances of the matching string, a first substring string operation that returns a first portion of the input string, a slice string operation that returns a second portion of the input string from a start index to a stop index, or a second substring string operation that returns a third portion of the input string from a first index to a second index. ### Claim 2 (depends on 1) The computer storage system of claim 1, wherein the deterministic finite automata sets an accept status or a reject status such that it marks the first occurrence of matching strings in the input string. ### Claim 3 (depends on 1) The computer storage system of claim 1, wherein the computer program code further comprises sets instructions executable by the one or more processors to: execute the source code using a taint tracking mechanism to obtain the obtain data flow information. ### Claim 4 (depends on 3) The computer storage system of claim 3, wherein the source code is executed using a web browser. ### Claim 5 (depends on 1) The computer storage system of claim 1, wherein the source code is in JavaScript format. ### Claim 6 One or more non-transitory computer-readable medium storing computer program code comprising sets of instructions to: obtain data flow information indicating one or more string operations in source code that used an input string or information derived from the input string as a parameter when executing the source code, the one or more string operations including a string sanitizer function, the string sanitizer function including an input parameter and an output parameter; generate a graph representing the input parameter and the output parameter of the string sanitizer function; generate, based on the graph, a deterministic finite automata representing string values of the output parameter, the deterministic finite automata accepting possible output string values of the string sanitizer function; determine that there is a non-empty intersection between the deterministic finite automata and an exploit automata for a security exploit, the non-empty intersection indicating that the string sanitizer function is vulnerable to a code injection exploit, wherein the string sanitizer function includes at least one of: a replace-once string operation, the replace-once string operation replacing a first instance of matching string matching a target string but not later instances of the matching string, a first substring string operation that returns a first portion of the input string, a slice string operation that returns a second portion of the input string from a start index to a stop index, or a second substring string operation that returns a third portion of the input string from a first index to a second index. ### Claim 7 (depends on 6) The non-transitory computer-readable medium of claim 6, wherein the deterministic finite automata sets an accept status or a reject status such that it marks the first occurrence of matching strings in the input string. ### Claim 8 (depends on 6) The non-transitory computer-readable medium of claim 6, wherein the computer program code further comprises sets instructions to: execute the source code using a taint tracking mechanism to obtain the obtain data flow information. ### Claim 9 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the source code is executed using a web browser. ### Claim 10 (depends on 6) The non-transitory computer-readable medium of claim 6, wherein the source code is in JavaScript format. ### Claim 11 A computer-implemented method, comprising: obtaining data flow information indicating one or more string operations in source code that used an input string or information derived from the input string as a parameter when executing the source code, the one or more string operations including a string sanitizer function, the string sanitizer function including an input parameter and an output parameter; generating a graph representing the input parameter and the output parameter of the string sanitizer function; generating a deterministic finite automata for the string sanitizer function based on the graph, the deterministic finite automata accepting possible output string values of the string sanitizer function; determining that there is a non-empty intersection between the deterministic finite automata and an exploit automata for a security exploit, the non-empty intersection indicating that the string sanitizer function is vulnerable to a code injection exploit, wherein the deterministic finite automata sets an accept status or a reject status such that it marks the first occurrence of matching strings in the input string. ### Claim 12 (depends on 11) The computer-implemented method of claim 11, wherein the string sanitizer function includes a replace-once string operation, the replace-once string operation replacing a first instance of matching string matching a target string but not later instances of the matching string. ### Claim 13 (depends on 11) The computer-implemented method of claim 11, further comprising: executing the source code using a taint tracking mechanism to obtain the obtain data flow information. ### Claim 14 (depends on 11) The computer-implemented method of claim 11, wherein the source code is in JavaScript format.