E07920: sanitized modifier only valid on incoming function/method parameters

What went wrong

The 'sanitized' modifier can ONLY be used on INCOMING function/method parameters. It cannot be used on:

• Class or record fields (not a parameter - nothing receives them)
• Return parameters (data flows OUT, not IN)
• Local variables (internal - nothing receives them)

Worked examples

Compilable examples demonstrating this error and the correct fix:

• ek9 -q 847 (Where can the sanitized modifier be used in EK9?)

Rationale

The function or method that declares a sanitized parameter cleans it the moment it is entered. This ONLY works for incoming parameters because:

1. FIELDS are not received by anything - they're initialized directly -> No entry point where the cleaning could happen
2. RETURN parameters flow OUT, not IN -> Sanitizing output makes no sense; input is already in the system
3. LOCAL variables are internal - nothing receives them -> No external data entering at declaration point

How to fix it

1. Use 'sanitized' only on incoming function/method parameters
2. For fields, sanitize in constructor via a sanitized parameter
3. For return values, sanitize before returning using InputSanitizer

Common causes

• Trying to mark a field as "always sanitized" (use constructor instead)
• Thinking sanitized affects storage semantics (it cleans a parameter on entry)
• Confusing incoming vs outgoing parameter direction

See also

• E07910: sanitized on wrong TYPE (non-String)
• E07920: sanitized in wrong LOCATION (this error)
• E07930: assignment from sanitized creates hidden aliasing

https://ek9.io/sanitized.html https://ek9.io/forAI.json#$.sanitizedTypes

Examples

Every example is compiled by the EK9 compiler: the first fails exactly as captioned, the others fix it.

Fails with E07920: sanitized modifier only valid on incoming function/method parameters

#!ek9
defines module error.e07920.bad

  defines record

    BadRecordField
      //ERROR: sanitized on record field doesn't make sense
      value as sanitized String?

  defines class

    BadClassField
      //ERROR: sanitized on field doesn't make sense - nothing receives a field, so nothing could clean it
      name as sanitized String?

  defines class

    TestClass

      //ERROR: sanitized on method return parameter
      badMethodReturn()
        -> input as String
        <- result as sanitized String?
        result: input

      //VALID: sanitized on method incoming parameter
      validMethodParam()
        -> input as sanitized String
        <- result as String?
        result: input

  defines function

    //ERROR: sanitized on RETURN parameter - data flows OUT not IN
    badReturnParameter()
      -> input as String
      <- result as sanitized String?
      result: input

    //ERROR: sanitized on RETURN parameter with no incoming params
    badReturnParameterOnly()
      <- result as sanitized String?
      result: "test"

    //VALID: sanitized on incoming parameter - this is correct usage
    validIncomingParameter()
      -> input as sanitized String
      <- result as String?
      result: input

  defines function

    //ERROR: sanitized on LOCAL variable - not a parameter at all
    badLocalVariable()
      -> input as String
      <- result as String?

      //Local variable declaration without initialization (variableOnlyDeclaration)
      localVar as sanitized String?

      localVar: input
      result: localVar

Fixed: Sanitize the incoming parameter

#!ek9
defines module error.e07920.good

  defines class

    UserData
      username as String?

      default private UserData()

      //Sanitize the INCOMING parameter; the field is a plain String
      UserData()
        -> name as sanitized String
        this.username: String(name)

      default operator ?

  defines function

    processInput()
      -> text as sanitized String
      <- rtn as String: text

Questions and answers

These Q&A entries show E07920 and its fix:

• Q847: Where can the sanitized modifier be used in EK9?
• Q950: Where can the 'sanitized' keyword NOT be used in EK9?