Correcting workflow security vulnerabilities via static analysis and virtual patching

1. A system comprising:

a first processor and memory configured to initiate executable operations comprising:

determining an order in which client side workflows are intended to be implemented by the computer program by performing a static analysis of client side code of a computer program;

based on the static analysis, generating a virtual patch configured to, when executed by the first processor or a second processor, perform executable operations comprising:

tracking web service calls from a client to the computer program;

determining whether the order of the web service calls from the client to the computer program correlate to the order in which client side workflows are intended to be implemented by the computer program; and

responsive to determining that the order of the web service calls from the client to the computer program do not correlate to the order in which client side workflows are intended to be implemented by the computer program, generating an alert indicating that the web service calls from the client do not correlate to the order in which client side workflows are intended to be implemented by the computer program; and

configuring the virtual patch to be applied to a processing system hosting the computer program and applying the patch to the processing system hosting the computer program;

identifying a safe set of candidates of the client side workflows; and

automatically synthesizing metadata that records sensitive execution paths and including the metadata in the virtual patch.

2. The system of claim 1 , wherein the processor further is configured to initiate executable operations comprising:

determining whether at least one security vulnerabilities exists in the client side code of the computer program by performing a static analysis of the client side code of the computer program;

wherein determining an order in which client side workflows are intended to be implemented by the computer program is responsive to determining the at least one security vulnerability exists in the client side code of the computer program.

3. The system of claim 1 , wherein determining the order in which client side workflows are intended to be implemented by the computer program comprises:

performing a static analysis on web pages configured for presentation by the computer program via a client device.

4. The system of claim 1 , wherein the processor further is configured to initiate executable operations comprising:

responsive to the alert being generated, invalidating the client session.

5. The system of claim 4 , wherein invalidating the client session comprises:

blocking web service calls generated in the client session from being communicated to the computer program.

6. The system of claim 4 , wherein invalidating the client session comprises:

terminating the client session.

7. computer program product for correcting workflow security vulnerabilities, the computer program product comprising:

a computer-readable storage device, wherein the computer-readable storage device is not a transitory, propagating signal per se, having stored thereon program code that, when executed, configures a first processor to perform executable operations comprising:

determining an order in which client side workflows are intended to be implemented by the computer program by performing a static analysis of client side code of a computer program; and

based on the static analysis, generating a virtual patch configured to, when executed by the first processor or a second processor, perform executable operations comprising:

tracking web service calls from a client to the computer program;

determining whether the order of the web service calls from the client to the computer program correlate to the order in which client side workflows are intended to be implemented by the computer program; and

responsive to determining that the order of the web service calls from the client to the computer program do not correlate to the order in which client side workflows are intended to be implemented by the computer program, generating an alert indicating that the web service calls from the client do not correlate to the order in which client side workflows are intended to be implemented by the computer program; and

configuring the virtual patch to be applied to a processing system hosting the computer program and applying the patch to the processing system hosting the computer program;

identifying a safe set of candidates of the client side workflows; and

automatically synthesizing metadata that records sensitive execution paths and including the metadata in the virtual patch.

8. The computer program product of claim 7 , wherein the executable operations further comprise:

determining whether at least one security vulnerability exists in the client side code of the computer program by performing a static analysis of the client side code of the computer program;

wherein determining an order in which client side workflows are intended to be implemented by the computer program is responsive to determining the at least one security vulnerability exists in the client side code of the computer program.

9. The computer program product of claim 7 , wherein determining an order in which client side workflows are intended to be implemented by the computer program comprises:

performing a static analysis on web pages configured for presentation by the computer program via a client device.