thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Static Code Analysis Taint Analysis

A static analysis technique that tracks untrusted data from sources to dangerous sinks to find injection-type flaws.

Definition

Taint analysis marks data from sources (request parameters, files, environment) as tainted and reports when it reaches sinks (SQL execution, OS commands, HTML output) without passing through a sanitizer. It underlies most SAST engines' injection rules; custom sanitizers must be modeled to avoid false positives.

Example

SAST reports a path from request.getParameter('id') to Statement.executeQuery with no sanitizer in between.

Exam tip

Source, sink and sanitizer are the key vocabulary.

Related terms