Discovering contextualized placeholder variables in template code

1. A method, comprising:

invoking, a first render call to render an input template;

receiving, a first message identifying a first placeholder variable within the input template in response to invoking the first render call;

generating, a first rendered template by rendering the input template based on a unique value for the first placeholder variable;

generating, a second rendered template by rendering the input template based on a modified unique value for the first placeholder variable, wherein the modified unique value comprises a trigger string concatenated with the unique value, and wherein the generating the second rendered template comprises changing a context of the unique value in a syntactic structure of the first rendered template based on the trigger string, wherein the context corresponds to a location of the unique value within the syntactic structure of the first rendered template; and

storing, by at least one computer processor, an identity of the first placeholder variable in a security vulnerability data structure in response to detecting a change in the context associated with the first placeholder variable between the first rendered template and the second rendered template.

2. The method of claim 1 , further comprising:

adding a first field corresponding to the first placeholder variable to a discovered variable (DV) data structure in response to receiving the first message;

invoking a second render call to render the input template, wherein the second render call comprises the DV data structure;

receiving a second message identifying a second placeholder variable within the input template in response to invoking the second render call; and

adding a second field corresponding to the second placeholder variable to the DV data structure.

3. The method of claim 2 , wherein the first render call comprises the DV data structure, wherein the DV data structure comprises a callback function, and wherein the first message is generated by the callback function when a template engine accesses the DV data structure while attempting to expand the first placeholder variable in the input template.

4. The method of claim 2 , wherein the first message is an error message generated after attempting to expand the first placeholder variable in the input template.

5. The method of claim 2 , wherein the first field corresponding to the first placeholder variable is populated with an object configured to record an attempt by a template engine to access the first field.

6. The method of claim 1 , wherein the context is one or more of a lexical context, a syntactic context, and a semantic context.

7. The method of claim 6 , wherein the syntactic context corresponds to the location of the unique value in a syntactic structure of the first rendered template.

8. The method of claim 1 , further comprising:

executing a tainted-flow analysis with the first placeholder variable as a sink based on the security vulnerability data structure.

9. A non-transitory computer readable medium comprising stored instructions, which when executed by a processor, cause the processor to:

invoke a first render call to render an input template;

receive a first message identifying a first placeholder variable within the input template in response to invoking the first render call;

generate a first rendered template by rendering the input template based on a unique value for the first placeholder value;

generate a second rendered template by rendering the input template based on a modified unique value for the first placeholder variable, wherein the modified unique value comprises a trigger string concatenated with the unique value, and wherein the generating the second rendered template comprises changing a context of the unique value in a syntactic structure of the first rendered template based on the trigger string, wherein the context corresponds to a location of the unique value within the syntactic structure of the first rendered template; and

store an identity of the first placeholder variable in a security vulnerability data structure in response to detecting a change in the context associated with the first placeholder variable between the first rendered template and the second rendered template.

10. The non-transitory computer readable medium of claim 9 , wherein the stored instructions, when executed, further cause the processor to:

add a first field corresponding to the first placeholder variable to a discovered variable (DV) data structure in response to receiving the first message;

invoke a second render call to render the input template, wherein the second render call comprises the DV data structure;

receive a second message identifying a second placeholder variable within the input template in response to invoking the second render call; and

add a second field corresponding to the second placeholder variable to the DV data structure.

11. The non-transitory computer readable medium of claim 10 , wherein the first render call comprises the DV data structure, wherein the DV data structure comprises a callback function, and wherein the first message is generated by the callback function when a template engine accesses the DV data structure while attempting to expand the first placeholder variable in the input template.

12. The non-transitory computer readable medium of claim 10 , wherein the first message is an error message generated after attempting to expand the first placeholder variable in the input template.

13. The non-transitory computer readable medium of claim 9 , wherein the context is one or more of a lexical context, a syntactic context, and a semantic context.

14. The non-transitory computer readable medium of claim 9 , wherein the stored instructions, when executed, further cause the processor to execute a tainted-flow analysis with the first placeholder viable as a sink based on the security vulnerability data structure.

15. A system, comprising:

a memory storing instructions; and

a processor, coupled with the memory and to execute the instructions, the instructions when executed cause the processor to:

invoke a first render call to render an input template;

receive a first message identifying a first placeholder variable within the input template in response to invoking the first render call;

generate a first rendered template by rendering the input template based on a unique value for the first placeholder value;

generate a second rendered template by rendering the input template based on a modified unique value for the first placeholder variable, wherein the modified unique value comprises a trigger string concatenated with the unique value, and wherein the generating the second rendered template comprises changing a context of the unique value in a syntactic structure of the first rendered template based on the trigger string, wherein the context corresponds to a location of the unique value within the syntactic structure of the first rendered template;

store the first placeholder variable in a security vulnerability data structure in response to detecting a change in the context associated with the first placeholder variable between the first rendered template and the second rendered template.

16. The system of claim 15 , wherein the instructions when executed further cause the processor to:

add a first field corresponding to the first placeholder variable to a discovered variable (DV) data structure in response to receiving the first message;

invoke a second render call to render the input template, wherein the second render call comprises the DV data structure;

receive a second message identifying a second placeholder variable within the input template in response to invoking the second render call; and

add a second field corresponding to the second placeholder variable to the DV data structure.

17. The system of claim 16 , wherein the first render call comprises the DV data structure, wherein the DV data structure comprises a callback function, and wherein the first message is generated by the callback function when a template engine accesses the DV data structure while attempting to expand the first placeholder variable in the input template.

18. The system of claim 16 , wherein the first message is an error message generated by the template engine after attempting to expand the first placeholder variable in the input template.

19. The system of claim 15 , wherein the context is one or more of a lexical context, a syntactic context, and a semantic context.

20. The system of claim 19 , wherein the syntactic context corresponds to the location of the unique value in a syntactic structure of the first rendered template.