Taint Analysis
Taint analysis tracks how untrusted data (taint sources) propagates through a program, checking whether it reaches dangerous operations (taint sinks).
Purpose
Detect injection vulnerabilities (SQLi/XSS/command injection), ensuring user input is sanitized before reaching dangerous operations.
Mechanism
Marks user input as taint sources and traces propagation through assignments/operations. Alerts if tainted data reaches a sink (SQL query, exec, innerHTML) unsanitized. Implemented statically (FlowDroid) or dynamically (TaintTrace).
Use cases
- Injection vulnerability detection
- Security auditing
- Data flow tracking