E07941: 'sanitized' cannot be used on captured variables - sanitize at the original entry point

What went wrong

The 'sanitized' keyword CANNOT be used on captured variables in dynamic functions or classes. Captured variables are already in the trusted boundary.

Worked examples

Compilable examples demonstrating this error and the correct fix:

• ek9 -q 950 (Where can the 'sanitized' keyword NOT be used in EK9?)
• ek9 -q 1332 (Why can't I mark a captured variable as 'sanitized' in...)

Rationale

"Rejection at the Source" Philosophy: The 'sanitized' modifier belongs ONLY at entry points where untrusted data first enters the system - function/method parameter definitions. By the time data is captured, it has already passed through the trust boundary.

Security reasoning becomes simpler when sanitization happens at one place:

• Entry points define where untrusted data enters
• Everything inside the trust boundary is already safe
• Captures copy data that's already been sanitized (or was always safe)

Sanitization is a boundary concern. Define it at the boundary (parameter definitions), not at internal points (captures, assignments, call sites).

How to fix it

1. REMOVE: 'sanitized' from the capture
2. ADD: 'sanitized' to the function/method parameter definition instead
3. The captured value will already be sanitized when captured

The [EXAMPLE] section below shows 'sanitized' on a dynamic class's capture, and the parameter made 'sanitized' at the function's entry instead.

See also

• E07910: sanitized on wrong type (must be String)
• E07920: sanitized in wrong location (must be incoming parameter)
• E07941: sanitized on capture (this error)
• E07942: sanitized at call site
• E07943: sanitized on variable declaration

https://ek9.io/sanitized.html https://ek9.io/forAI.json#$.sanitizedTypes

Examples

Every example is compiled by the EK9 compiler: the first fails exactly as captioned, the others fix it.

Fails with E07941: 'sanitized' cannot be used on captured variables - sanitize at the original entry point

#!ek9
defines module error.e07941.bad

  defines trait
    Greeter
      greet()
        -> greeting as String
        <- rtn as String: greeting

  defines function

    //ERROR: sanitized on a dynamic class capture
    badDynamicClassCapture()
      -> userInput as String
      greeter <- (sanitized userInput) with trait of Greeter as class
      stdout <- Stdout()
      stdout.println(greeter.greet(userInput))

Fixed: Sanitize at the entry point

#!ek9
defines module error.e07941.good

  defines trait
    Greeter
      greet()
        -> greeting as String
        <- rtn as String: greeting

  defines function

    //Sanitize at the entry point; the capture receives clean data
    greetUser()
      -> userInput as sanitized String
      greeter <- () with trait of Greeter as class
      stdout <- Stdout()
      stdout.println(greeter.greet(userInput))

Questions and answers

These Q&A entries show E07941 and its fix:

• Q1332: Why can't I mark a captured variable as 'sanitized' in a dynamic function?