1. A method comprising: constructing, with a processing system, one or more security policies for web content by compiling at least one rewriting template that identifies at least one syntactic construct in web content and one or more instructions for rewriting the identified at least one syntactic construct, at least one edit automata policy defined using one or more rewriting templates for defining at least one policy rule, and at least one policy template that comprises a pre-defined edit automata policy, wherein each rewriting template provides at least one corresponding rewriting rule that implements one of the security policies; intercepting, with the processing system configured to execute an instrumentation proxy system, a document during transfer between a content provider system and a user web browser; rewriting, with the processing system configured to execute the instrumentation proxy system, a script program that includes self-modifying code in the document by the instrumentation proxy system, the rewriting comprises the instrumentation proxy system inserting an executable policy module into the document and rewriting content in the script program having a syntactic form matching a rewriting rule in one of the security policies prior to receipt of the document by the user web browser, and wherein the rewritten content in the script program comprises an instance of the rewriting rule added to the script program that redirects actions of self-modified code in the script program having the matching syntactic form, during run-time execution of the script program in the document; and providing, by the processing system, the rewritten document to the user web browser, wherein the rewritten document executes the inserted policy module before execution of the rewritten script program in the user web browser, and wherein the instance of the rewriting rule controls an action performed by self-modified code in the script program by redirecting the action through the policy module during run-time execution of the script program in the document.
1. A method comprising: constructing, with a processing system, one or more security policies for web content by compiling at least one rewriting template that identifies at least one syntactic construct in web content and one or more instructions for rewriting the identified at least one syntactic construct, at least one edit automata policy defined using one or more rewriting templates for defining at least one policy rule, and at least one policy template that comprises a pre-defined edit automata policy, wherein each rewriting template provides at least one corresponding rewriting rule that implements one of the security policies; intercepting, with the processing system configured to execute an instrumentation proxy system, a document during transfer between a content provider system and a user web browser; rewriting, with the processing system configured to execute the instrumentation proxy system, a script program that includes self-modifying code in the document by the instrumentation proxy system, the rewriting comprises the instrumentation proxy system inserting an executable policy module into the document and rewriting content in the script program having a syntactic form matching a rewriting rule in one of the security policies prior to receipt of the document by the user web browser, and wherein the rewritten content in the script program comprises an instance of the rewriting rule added to the script program that redirects actions of self-modified code in the script program having the matching syntactic form, during run-time execution of the script program in the document; and providing, by the processing system, the rewritten document to the user web browser, wherein the rewritten document executes the inserted policy module before execution of the rewritten script program in the user web browser, and wherein the instance of the rewriting rule controls an action performed by self-modified code in the script program by redirecting the action through the policy module during run-time execution of the script program in the document. 10. The method of claim 1 , wherein the rewritten script program is part of an instrumented version of the document.