1. A method, comprising: performing by a computer system a static analysis on a program having sources and sinks to track string flow from the sources to the sinks, comprising: for string variables in the program that begin at sources, computing by the computer system grammar of possible string values for each of the string variables; for methods in the program operating on any of the string variables, computing by the computer system grammar of string variables returned by the methods; determining by the computer system that one of the string variables reaches a sink that performs a security-sensitive operation; determining by the computer system that one of methods in a path from a source to the sink that performs the security-sensitive operation is one of a user-defined sanitizer or a user-defined validator; in response to the one of the string variables reaching the sink and to the one of the methods in the path being one of a user-defined sanitizer or a user-defined validator, comparing by the computer system current grammar of the one of the string variables with a policy corresponding to the security-sensitive operation and determining by the computer system based on the comparing whether the one of the user-defined sanitizer or the user-defined validator presents or does not present a possible security problem; and performing by the computer system a reporting operation based on the comparing, wherein performing the reporting operation further comprises reporting, in response to the comparing, whether the one of the user-defined sanitizer or the user-defined validator presents or does not present the possible security problem, wherein the performing the reporting operation further comprises declaring the sink safe with respect to the security-sensitive operation in response to the one of the user-defined sanitizer or the user-defined validator not presenting the possible security problem and outputting indicia indicating the one of the user-defined sanitizer or the user-defined validator appears safe, and wherein the performing the reporting operation further comprises declaring the sink unsafe with respect to the security-sensitive operation in response to the one of the user-defined sanitizer or the user-defined validator presenting the possible security problem and outputting indicia indicating the one of the user-defined sanitizer or the user-defined validator has a possible security problem.
1. A method, comprising: performing by a computer system a static analysis on a program having sources and sinks to track string flow from the sources to the sinks, comprising: for string variables in the program that begin at sources, computing by the computer system grammar of possible string values for each of the string variables; for methods in the program operating on any of the string variables, computing by the computer system grammar of string variables returned by the methods; determining by the computer system that one of the string variables reaches a sink that performs a security-sensitive operation; determining by the computer system that one of methods in a path from a source to the sink that performs the security-sensitive operation is one of a user-defined sanitizer or a user-defined validator; in response to the one of the string variables reaching the sink and to the one of the methods in the path being one of a user-defined sanitizer or a user-defined validator, comparing by the computer system current grammar of the one of the string variables with a policy corresponding to the security-sensitive operation and determining by the computer system based on the comparing whether the one of the user-defined sanitizer or the user-defined validator presents or does not present a possible security problem; and performing by the computer system a reporting operation based on the comparing, wherein performing the reporting operation further comprises reporting, in response to the comparing, whether the one of the user-defined sanitizer or the user-defined validator presents or does not present the possible security problem, wherein the performing the reporting operation further comprises declaring the sink safe with respect to the security-sensitive operation in response to the one of the user-defined sanitizer or the user-defined validator not presenting the possible security problem and outputting indicia indicating the one of the user-defined sanitizer or the user-defined validator appears safe, and wherein the performing the reporting operation further comprises declaring the sink unsafe with respect to the security-sensitive operation in response to the one of the user-defined sanitizer or the user-defined validator presenting the possible security problem and outputting indicia indicating the one of the user-defined sanitizer or the user-defined validator has a possible security problem. 4. The method of claim 1 , wherein the current grammar of the one string variable meets the policy, the comparing is performed for all of the sinks that perform security sensitive operations, and the performing the reporting operation comprises declaring the program safe with respect to the security-sensitive operations and outputting indicia corresponding to the declaring.