Automatic context-sensitive sanitization

A system, comprising:

• at least one processor;
• and
• at least one memory comprising the following processor-executable modules:
• a code instrumentor that tags input data of a web application as an untrusted input and inserts a special code marker that marks a first sanitizer associated with the untrusted input;
• and
• a context engine that generates a correct sanitizer for the untrusted input when the first sanitizer does not match a browser parsing context of the untrusted input,
• wherein the correct sanitizer is applied during execution of the web application, and
• wherein the browser parsing context is associated with a state of a web browser when the web browser is parsing at a point where the untrusted input is rendered in an output stream.

A device, comprising:

• at least one processor and a memory;
• the at least one processor configured to:
• execute a web application having a marker associated with a first sanitizer applied to an untrusted input;
• track execution of the web application;
• compare the tracked execution of the web application with at least one violating path, the at least one violating path representing an execution trace of the web application that applies an incorrect sanitizer to the untrusted input;
• and
• when the tracked execution of the web application matches the at least one violating path, apply a correct sanitizer to the untrusted input, the correct sanitizer based on a browser parsing context of the untrusted input in the web application, the browser parsing context associated with a state of a web browser when the web browser is parsing at a point where the untrusted input is rendered in an output stream.