Static detection of context-sensitive cross-site scripting vulnerabilities

A system for statically analyzing a web application program, comprising:

• a processor;
• a memory comprising instructions that, when executed by the processor, cause the processor to:
• obtain a control flow graph for the web application program, wherein the control flow graph comprises a plurality of nodes, wherein each node of the plurality of nodes corresponds to a statement in the web application program;
• obtain a sanitizer sequence comprising one or more sanitizers followed by an output statement;
• obtain a placeholder corresponding to the sanitizer sequence;
• generate a plurality of control flow paths from an entry node of the control flow graph to an exit node of the control flow graph, wherein each control flow path of the plurality of control flow paths comprises an output node that corresponds to the output statement;
• generate, for each control flow path of the plurality of control flow paths, a plurality of documents, wherein each document of the plurality of documents comprises a sanitized value corresponding to the output statement;
• insert the placeholder into each document of the plurality of documents at a location of the sanitized value;
• determine whether the sanitizer sequence is sufficient for an output context sequence of the sanitized value in each document of the plurality of documents;
• and
• report a potential cross-site scripting flaw when the sanitizer sequence is insufficient for the output context sequence of the sanitized value;
• and
• a repository, configured to store at least the web application program.

A non-transitory computer readable medium comprising instructions that, when executed by a processor, perform a method for statically analyzing a web application program, the method comprising:

• obtaining a control flow graph for the web application program, wherein the control flow graph comprises a plurality of nodes, wherein each node of the plurality of nodes corresponds to a statement in the web application program;
• obtaining a sanitizer sequence comprising one or more sanitizers followed by an output statement;
• obtaining a placeholder corresponding to the sanitizer sequence;
• generating a plurality of control flow paths from an entry node of the control flow graph to an exit node of the control flow graph, wherein each control flow path of the plurality of control flow paths comprises an output node that corresponds to the output statement;
• generating, for each control flow path of the plurality of control flow paths, a plurality of documents, wherein each document of the plurality of documents comprises a sanitized value corresponding to the output statement;
• inserting the placeholder into each document of the plurality of documents at a location of the sanitized value;
• determining whether the sanitizer sequence is sufficient for an output context sequence of the sanitized value in each document of the plurality of documents;
• and
• reporting a potential cross-site scripting flaw when the sanitizer sequence is insufficient for the output context sequence of the sanitized value.