E07942: 'sanitized' is specified in the function/method definition, not at call sites

Category: E07xxx Full resolution · Reported in phase: FULL_RESOLUTION · Classification: SANITIZED_NOT_ALLOWED_AT_CALL_SITE · All error codes

What went wrong

The 'sanitized' keyword CANNOT be used at call sites (function calls, method calls, or constructor calls). The CALLEE (function/method/constructor definition) decides if a parameter is sanitized, NOT the caller.

Worked examples

Compilable examples demonstrating this error and the correct fix:

ek9 -q 828 (Why can't I use sanitized at a call site in EK9?)
ek9 -q 1399 (Is a sanitized parameter still cleaned when my function i...)

Rationale

"Rejection at the Source" Philosophy: Sanitization is a contract specified by the function/method/constructor author at definition time. The author knows what security guarantees are needed for their implementation.

If callers could add 'sanitized', it would create false security:

The function doesn't expect sanitization, won't handle it correctly
Caller thinks data is sanitized, but function logic may bypass it
Split responsibility creates gaps in security coverage

The function/method/constructor author specifies sanitization requirements. The function/method/constructor that declares the parameter cleans it on entry, so every call is covered - whatever route reaches it. Callers don't need to think about it - it's enforced automatically.

How to fix it

REMOVE: 'sanitized' from the call site (function, method, or constructor)
CHECK: Does the target parameter need to be sanitized?
ADD: 'sanitized' to the target function/method/constructor parameter definition
The receiving body cleans it on every route - the caller writes nothing

Examples

Every example is compiled by the EK9 compiler: the first fails exactly as captioned, the others fix it.

Fails with E07942: 'sanitized' is specified in the function/method definition, not at call sites

#!ek9
defines module error.e07942.bad

  defines record

    TestRecord
      value as String?

      default operator ?

  defines class

    TestClass

      //Target method - no sanitization
      handleData()
        -> data as String
        stdout <- Stdout()
        stdout.println(data)

    TestCaller

      //ERROR: sanitized on method call argument
      badMethodCall()
        -> userInput as String
        obj <- TestClass()
        obj.handleData(sanitized userInput)

  defines function

    //Target function - no sanitization
    processInput()
      -> data as String
      stdout <- Stdout()
      stdout.println(data)

    //Target function with multiple parameters
    processMultiple()
      ->
        first as String
        second as String

      stdout <- Stdout()
      stdout.println(first + second)

    //ERROR: sanitized on function call argument
    badFunctionCall()
      -> userInput as String
      //ERROR: Caller cannot specify sanitization - that's callee's responsibility
      processInput(sanitized userInput)

    //ERROR: sanitized on one of multiple arguments
    badMultipleArgs()
      ->
        input1 as String
        input2 as String

      processMultiple(input1, sanitized input2)

    //ERROR: sanitized on first argument of multiple
    badFirstArg()
      ->
        input1 as String
        input2 as String

      processMultiple(sanitized input1, input2)

    //ERROR: sanitized with named parameter
    badNamedArg()
      -> userInput as String
      processInput(data := sanitized userInput)

    //CORRECT: Sanitize in the definition, not at call site
    correctSanitizeInDefinition()
      -> input as sanitized String
      stdout <- Stdout()
      stdout.println(input)

    //CORRECT: Caller just passes data - sanitization automatic
    correctCaller()
      -> userInput as String
      //Compiler automatically sanitizes because definition has 'sanitized'
      correctSanitizeInDefinition(userInput)

  defines function

    //ERROR: sanitized on constructor call argument
    badConstructorCall()
      -> userInput as String
      stdout <- Stdout()
      rec <- TestRecord(sanitized userInput)
      //Use stdout with userInput to avoid cascading errors from rec
      stdout.println(userInput)

Fixed: Declare 'sanitized' on the parameter

#!ek9
defines module error.e07942.good

  defines function

    //The receiving parameter is sanitized
    processInput()
      -> text as sanitized String
      stdout <- Stdout()
      stdout.println(text)

    doWork()
      -> userInput as String

      //The caller just passes the data
      processInput(userInput)

Questions and answers

These Q&A entries show E07942 and its fix: