1. A method, comprising: performing by a computer system a static analysis on a program having sources and sinks to track string flow from the sources to the sinks, comprising: for string variables in the program that begin at sources, computing by the computer system grammar of possible string values for each of the string variables; for methods in the program operating on any of the string variables, computing by the computer system grammar of string variables returned by the methods; determining by the computer system that one of the string variables reaches a sink that performs a security-sensitive operation; determining by the computer system that one of methods in a path from a source to the sink that performs the security-sensitive operation is one of a user-defined sanitizer or a user-defined validator; in response to the one of the string variables reaching the sink and to the one of the methods in the path being one of a user-defined sanitizer or a user-defined validator, comparing by the computer system current grammar of the one of the string variables with a policy corresponding to the security-sensitive operation and determining by the computer system based on the comparing whether the one of the user-defined sanitizer or the user-defined validator presents or does not present a possible security problem; and performing by the computer system a reporting operation based on the comparing, wherein performing the reporting operation further comprises reporting, in response to the comparing, whether the one of the user-defined sanitizer or the user-defined validator presents or does not present the possible security problem, wherein the performing the reporting operation further comprises declaring the sink safe with respect to the security-sensitive operation in response to the one of the user-defined sanitizer or the user-defined validator not presenting the possible security problem and outputting indicia indicating the one of the user-defined sanitizer or the user-defined validator appears safe, and wherein the performing the reporting operation further comprises declaring the sink unsafe with respect to the security-sensitive operation in response to the one of the user-defined sanitizer or the user-defined validator presenting the possible security problem and outputting indicia indicating the one of the user-defined sanitizer or the user-defined validator has a possible security problem.