Patent ID: 8646088

Claim:
A method, comprising: tracking, using a computer system, untrusted inputs through an executing program into a sink that performs a security-sensitive operation using the inputs, the tracking including maintaining context of the sink as strings based on the untrusted inputs flow into the sink, wherein maintaining the context of the sink further comprises maintaining a context mapping comprising contexts of the sink and transitions between contexts, the transitions corresponding to string input at the contexts, and wherein there are a plurality of different context mappings based on a plurality of different types of sinks, wherein the tracking untrusted inputs is performed by an instrumented runtime previously modified to provide untrusted input flow tracking at least by modifications to a string library so that elements in the string library expose to the instrumented runtime when strings have been modified and how, and while tracking, in response to a string based on an untrusted input being about to flow into the sink and a determination the string could lead to an attack if the string flows into a current context of the sink, endorsing by the computer system the string using an endorser selected based at least on the current context of the sink, and providing the endorsed string to the sink, wherein the determination is made using a corresponding one of the context mappings for the type of the sink and wherein the selected endorser is one of a plurality of endorsers and is further selected based on the corresponding one of the context mappings for the type of sink, wherein the endorsing and providing are performed by the instrumented runtime at least by interleaving endorsement steps into execution of the program based on the context.