11. An apparatus, comprising: at least one memory comprising computer code; and at least one processor, wherein the computer code, when executed by the at least one processor, cause the apparatus to perform at least the following: performing a static analysis on a program having sources and sinks to track string flow from the sources to the sinks, comprising: for string variables in the program that begin at sources, computing grammar of possible string values for each of the string variables; for methods in the program operating on any of the string variables, computing grammar of string variables returned by the methods; determining that one of the string variables reaches a sink that performs a security-sensitive operation; determining that one of methods in a path from a source to the sink that performs the security-sensitive operation is one of a user-defined sanitizer or a user-defined validator; in response to the one of the string variables reaching the sink and to the one of the methods in the path being one of a user-defined sanitizer or a user-defined validator, comparing current grammar of the one of the string variables with a policy corresponding to the security-sensitive operation and determining based on the comparing whether the one of the user-defined sanitizer or the user-defined validator presents or does not present a possible security problem; and performing a reporting operation based on the comparing, wherein performing the reporting operation further comprises reporting, in response to the comparing, whether the one of the user-defined sanitizer or the user-defined validator presents or does not present the possible security problem, wherein the performing the reporting operation further comprises declaring the sink safe with respect to the security-sensitive operation in response to the one of the user-defined sanitizer or the user-defined validator not presenting the possible security problem and outputting indicia indicating the one of the user-defined sanitizer or the user-defined validator appears safe, and wherein the performing the reporting operation further comprises declaring the sink unsafe with respect to the security-sensitive operation in response to the one of the user-defined sanitizer or the user-defined validator presenting the possible security problem and outputting indicia indicating the one of the user-defined sanitizer or the user-defined validator has a possible security problem.
15. The apparatus of claim 11 , wherein the current grammar of the one string variable does not meet the policy, and the reporting operation declares that a potential security problem exists for the sink and the corresponding security-sensitive operation.