Injection context based static analysis of computer software applications

A method for injection context based static analysis of computer software applications, the method comprising:

• selecting a sink within a computer software application of a computer system, the sink comprising one or more lines of computer code within the computer software application, the one or more lines of code being bound to external data comprising a character output stream received from a data source that is external to the computer system;
• identifying a sink type associated with said sink, the sink type comprising one of hypertext markup language (HTML), structured query language (SQL), and cross-site scripting;
• based on selection of the sink, tracing the character output stream leading to said sink within said computer software application;
• determining an injection context of said character output stream at said sink, wherein said injection context has a predefined association with a state of said character output stream at said sink;
• identifying one or more actions that are associated with said identified injection context;
• and
• providing a report of said one or more actions.

A computer program product for injection context based static analysis of computer software applications, the computer program product comprising:

• a computer-readable storage medium;
• and
• computer-readable program code embodied in said computer-readable storage medium, wherein said computer-readable program code is configured to:
• select a sink within a computer software application of a computer system, the sink comprising one or more lines of computer code within the computer software application, the one or more lines of code being bound to external data comprising a character output stream received from a data source that is external to the computer system;
• identify a sink type associated with said sink, the sink type comprising one of hypertext markup language (HTML), structured query language (SQL), and cross-site scripting;
• based on selection of the sink, trace the character output stream leading to said sink within said computer software application;
• determine an injection context of said character output stream at said sink, wherein said injection context has a predefined association with a state of said character output stream at said sink;
• identify one or more actions associated with said identified injection context;
• and
• provide a report of said one or more actions.