Taint Analysis
Taint analysis is a security technique that tracks untrusted 'tainted' data from where it enters a program (a source, such as user input) to sensitive operations (a sink, such as a database query), flagging a vulnerability when tainted data reaches a sink without proper sanitization.
Taint analysis models the flow of untrusted data through a program. Inputs that an attacker can control — HTTP parameters, request bodies, file contents, environment variables — are marked as tainted sources. Sensitive operations that can be abused, such as SQL execution, command execution, or writing to a web page, are treated as sinks.
The analysis follows tainted values as they are assigned, concatenated, and passed between variables and functions. If tainted data reaches a dangerous sink without passing through a sanitizer or validator, the tool reports a potential injection flaw — for example SQL injection, command injection, or cross-site scripting (XSS). Sanitizers are functions recognized as neutralizing the taint, which stop the flow.
Taint analysis can be static (examining code without running it) or dynamic (observing a running program). For developers, it is the core engine behind detecting injection-class vulnerabilities, because those flaws are fundamentally about untrusted input reaching a powerful operation. Its accuracy depends on correctly modeling sources, sinks, and sanitizers, so tuning these definitions is what separates precise findings from noise.