Patent ID: 8539466

Claim:
A method comprising: obtaining: (i) a computer code associated with a data flow of externally supplied data, from one or more sources to one or more sinks, (ii) locations of the sources, and (iii) locations of the sinks; building a graph representing at least one of: control paths, data paths, and semantic relationships between the control paths and the data paths of the computer code; associating all tainted data paths on the graph, being data paths that go from sources to sinks and do not include a sanitizer; determining, on the tainted data paths, locations along the control paths suitable for sanitizer insertion, wherein a suitable location is a location that is associated with data that originates only from the source of respective tainted data paths, and a determined location in a specific tainted data path is regarded as the suitable location for inserting a sanitizer only if one or more operations selected from a predefined list of operations has been applied to data originating from a source associated with the specific tainted data path; cloning a data path associated with external data to enable locating a sanitizer farther from the sink in a case in which the determined location results in a loss of data, wherein at least one of: the obtaining, the building, the associating, the determining, and the cloning, is carried out in operative association with at least one processor.