Abstract: A method for statically analyzing a web application program may include obtaining a control flow graph for the web application program. Each control flow graph node may correspond to a statement in the web application program. The method may further include obtaining a sanitizer sequence including one or more sanitizers followed by an output statement, obtaining a placeholder corresponding to the sanitizer sequence, and generating control flow paths including an output node that corresponds to the output statement. The method may further include generating documents for each control flow path. Each document may include a sanitized value corresponding to the output statement. The method may further include inserting the placeholder into each document at a location of the sanitized value, and reporting a potential cross-site scripting flaw when the sanitizer sequence is insufficient for the output context sequence of the sanitized value.

Abstract: The disclosed embodiments provide a system for processing data. During operation, the system generates, from a set of traces of an asynchronous workflow, a graph-based representation of the asynchronous workflow. Next, the system uses a set of causal relationships in the asynchronous workflow to update the graph-based representation. The system then analyzes the updated graph-based representation to identify a set of high-latency paths in the asynchronous workflow. Finally, the system uses the set of high-latency paths to output an execution profile for the asynchronous workflow, wherein the execution profile includes a subset of tasks associated with the high-latency paths in the asynchronous workflow.

Abstract: A method for statically analyzing a web application program may include obtaining a control flow graph for the web application program. Each control flow graph node may correspond to a statement in the web application program. The method may further include obtaining a sanitizer sequence including one or more sanitizers followed by an output statement, obtaining a placeholder corresponding to the sanitizer sequence, and generating control flow paths including an output node that corresponds to the output statement. The method may further include generating documents for each control flow path. Each document may include a sanitized value corresponding to the output statement. The method may further include inserting the placeholder into each document at a location of the sanitized value, and reporting a potential cross-site scripting flaw when the sanitizer sequence is insufficient for the output context sequence of the sanitized value.