# US 2018/0025161 A1 · Static detection of context-sensitive cross-site scripting vulnerabilities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0025161 A1 - Document ID: US20180025161A1 - Status: Published application - Kind: A1 - Application number: 15/281,447 - Filed: 2016-09-30 - Published: 2018-01-25 - Earliest claimed: 2016-07-19 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Francois Gauthier; Antonin Steinhauser - Web page: https://patentgrep.com/patent/US20180025161A1 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/12: Protecting executable software - H04L 63/1433: {Vulnerability analysis} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for statically analyzing a web application program may include obtaining a control flow graph for the web application program. Each control flow graph node may correspond to a statement in the web application program. The method may further include obtaining a sanitizer sequence including one or more sanitizers followed by an output statement, obtaining a placeholder corresponding to the sanitizer sequence, and generating control flow paths including an output node that corresponds to the output statement. The method may further include generating documents for each control flow path. Each document may include a sanitized value corresponding to the output statement. The method may further include inserting the placeholder into each document at a location of the sanitized value, and reporting a potential cross-site scripting flaw when the sanitizer sequence is insufficient for the output context sequence of the sanitized value. ## Claims ### Claim 1 A method for statically analyzing a web application program, comprising: obtaining a control flow graph for the web application program, wherein the control flow graph comprises a plurality of nodes, wherein each node of the plurality of nodes corresponds to a statement in the web application program; obtaining a sanitizer sequence comprising one or more sanitizers followed by an output statement; obtaining a placeholder corresponding to the sanitizer sequence; generating a plurality of control flow paths from an entry node of the control flow graph to an exit node of the control flow graph, wherein each control flow path of the plurality of control flow paths comprises an output node that corresponds to the output statement; generating, for each control flow path of the plurality of control flow paths, a plurality of documents, wherein each document of the plurality of documents comprises a sanitized value corresponding to the output statement; inserting the placeholder into each document of the plurality of documents at a location of the sanitized value; determining whether the sanitizer sequence is sufficient for an output context sequence of the sanitized value in each document of the plurality of documents; and reporting a potential cross-site scripting flaw when the sanitizer sequence is insufficient for the output context sequence of the sanitized value. ### Claim 2 (depends on 1) The method of claim 1, wherein generating, for each control flow path, the plurality of documents comprises: obtaining a deterministic finite automaton (DFA) mapping that maps each node of the control flow path to a node DFA, wherein the node DFA comprises an alphabet, a plurality of states, and a plurality of state transitions; generating, based on the DFA mapping, a combined DFA comprising a plurality of node DFAs, wherein the combined DFA comprises the plurality of state transitions of each node DFA of the plurality of node DFAs; and generating a document for a plurality of paths in the combined DFA, wherein each path of the plurality of paths prints the placeholder. ### Claim 3 (depends on 2) The method of claim 2, further comprising: reducing the alphabet of each of one or more node DFAs of the combined DFA by merging non-special characters into a single equivalence class to obtain a reduced alphabet; and modifying the plurality of state transitions of each of the one or more node DFAs to be consistent with the reduced alphabet, wherein the plurality of paths in the combined DFA exercises each state transition of the combined DFA at least once. ### Claim 4 (depends on 3) The method of claim 3, wherein modifying the plurality of state transitions of each of the one or more node DFAs is performed only on a node DFA corresponding to the output statement, wherein the method further comprises: forming the plurality of paths of the combined DFA using a shortest path through each of one or more node DFAs of the combined DFA, wherein the shortest path comprises one or more state transitions of the corresponding node DFA. ### Claim 5 (depends on 1) The method of claim 1, wherein determining whether the sanitizer sequence is sufficient for the output context sequence of the sanitized value in each document comprises: identifying the placeholder when parsing the document; determining a plurality of safe output contexts that are sanitized by the sanitizer sequence; and determining whether the plurality of safe output contexts comprises the output context sequence of the sanitized value. ### Claim 6 (depends on 5) The method of claim 5, further comprising determining whether the plurality of safe output contexts comprises a suffix of the output context sequence of the sanitized value. ### Claim 7 A system for statically analyzing a web application program, comprising: a processor; a memory comprising instructions that, when executed by the processor, cause the processor to: obtain a control flow graph for the web application program, wherein the control flow graph comprises a plurality of nodes, wherein each node of the plurality of nodes corresponds to a statement in the web application program; obtain a sanitizer sequence comprising one or more sanitizers followed by an output statement; obtain a placeholder corresponding to the sanitizer sequence; generate a plurality of control flow paths from an entry node of the control flow graph to an exit node of the control flow graph, wherein each control flow path of the plurality of control flow paths comprises an output node that corresponds to the output statement; generate, for each control flow path of the plurality of control flow paths, a plurality of documents, wherein each document of the plurality of documents comprises a sanitized value corresponding to the output statement; insert the placeholder into each document of the plurality of documents at a location of the sanitized value; determine whether the sanitizer sequence is sufficient for an output context sequence of the sanitized value in each document of the plurality of documents; and report a potential cross-site scripting flaw when the sanitizer sequence is insufficient for the output context sequence of the sanitized value; and a repository, configured to store at least the web application program. ### Claim 8 (depends on 7) The system of claim 7, wherein generating, for each control flow path, the plurality of documents comprises: obtaining a DFA mapping that maps each node of the control flow path to a node DFA, wherein the node DFA comprises an alphabet, a plurality of states, and a plurality of state transitions; generating, based on the DFA mapping, a combined DFA comprising a plurality of node DFAs, wherein the combined DFA comprises the plurality of state transitions of each node DFA of the plurality of node DFAs; and generating a document for a plurality of paths in the combined DFA, wherein each path of the plurality of paths prints the placeholder. ### Claim 9 (depends on 8) The system of claim 8, further comprising: reducing the alphabet of each of one or more node DFAs of the combined DFA by merging non-special characters into a single equivalence class to obtain a reduced alphabet; and modifying the plurality of state transitions of each of the one or more node DFAs to be consistent with the reduced alphabet, wherein the plurality of paths in the combined DFA exercises each state transition of the combined DFA at least once. ### Claim 10 (depends on 9) The system of claim 9, wherein modifying the plurality of state transitions of each of the one or more node DFAs is performed only on a node DFA corresponding to the output statement, wherein the method further comprises: forming the plurality of paths of the combined DFA using a shortest path through each of one or more node DFAs of the combined DFA, wherein the shortest path comprises one or more state transitions of the corresponding node DFA. ### Claim 11 (depends on 7) The system of claim 7, wherein determining whether the sanitizer sequence is sufficient for the output context sequence of the sanitized value in each document comprises: identifying the placeholder when parsing the document; determining a plurality of safe output contexts that are sanitized by the sanitizer sequence; and determining whether the plurality of safe output contexts comprises the output context sequence of the sanitized value. ### Claim 12 (depends on 11) The system of claim 11, further comprising determining whether the plurality of safe output contexts comprises a suffix of the output context sequence of the sanitized value. ### Claim 13 A non-transitory computer readable medium comprising instructions that, when executed by a processor, perform a method for statically analyzing a web application program, the method comprising: obtaining a control flow graph for the web application program, wherein the control flow graph comprises a plurality of nodes, wherein each node of the plurality of nodes corresponds to a statement in the web application program; obtaining a sanitizer sequence comprising one or more sanitizers followed by an output statement; obtaining a placeholder corresponding to the sanitizer sequence; generating a plurality of control flow paths from an entry node of the control flow graph to an exit node of the control flow graph, wherein each control flow path of the plurality of control flow paths comprises an output node that corresponds to the output statement; generating, for each control flow path of the plurality of control flow paths, a plurality of documents, wherein each document of the plurality of documents comprises a sanitized value corresponding to the output statement; inserting the placeholder into each document of the plurality of documents at a location of the sanitized value; determining whether the sanitizer sequence is sufficient for an output context sequence of the sanitized value in each document of the plurality of documents; and reporting a potential cross-site scripting flaw when the sanitizer sequence is insufficient for the output context sequence of the sanitized value. ### Claim 14 (depends on 13) The non-transitory computer readable medium of claim 13, wherein generating, for each control flow path, the plurality of documents comprises: obtaining a DFA mapping that maps each node of the control flow path to a node DFA, wherein the node DFA comprises an alphabet, a plurality of states, and a plurality of state transitions; generating, based on the DFA mapping, a combined DFA comprising a plurality of node DFAs, wherein the combined DFA comprises the plurality of state transitions of each node DFA of the plurality of node DFAs; and generating a document for a plurality of paths in the combined DFA, wherein each path of the plurality of paths prints the placeholder. ### Claim 15 (depends on 14) The non-transitory computer readable medium of claim 14, further comprising: reducing the alphabet of each of one or more node DFAs of the combined DFA by merging non-special characters into a single equivalence class to obtain a reduced alphabet; and modifying the plurality of state transitions of each of the one or more node DFAs to be consistent with the reduced alphabet, wherein the plurality of paths in the combined DFA exercises each state transition of the combined DFA at least once. ### Claim 16 (depends on 15) The non-transitory computer readable medium of claim 15, wherein modifying the plurality of state transitions of each of the one or more node DFAs is performed only on a node DFA corresponding to the output statement, wherein the method further comprises: forming the plurality of paths of the combined DFA using a shortest path through each of one or more node DFAs of the combined DFA, wherein the shortest path comprises one or more state transitions of the corresponding node DFA. ### Claim 17 (depends on 13) The non-transitory computer readable medium of claim 13, wherein determining whether the sanitizer sequence is sufficient for the output context sequence of the sanitized value in each document comprises: identifying the placeholder when parsing the document; determining a plurality of safe output contexts that are sanitized by the sanitizer sequence; and determining whether the plurality of safe output contexts comprises the output context sequence of the sanitized value. ### Claim 18 (depends on 17) The non-transitory computer readable medium of claim 17, further comprising determining whether the plurality of safe output contexts comprises a suffix of the output context sequence of the sanitized value.