#!ek9
<?-
{
  "site": {
    "pages": ["sanitized.html"],
    "title": "Assigning a sanitized parameter directly to a local",
    "kind": "bad"
  },
  "keywords": ["sanitized", "E07930", "alias", "defensive copy"],
  "primaryTopics": ["security"],
  "seeAlso": [1399]
}
-?>
defines module bad.site.sanitized.alias

  defines function

    processInput()
      -> userInput as sanitized String
      @Error: FULL_RESOLUTION: CANNOT_ASSIGN_FROM_SANITIZED
      local <- userInput       //'local' would be an alias of 'userInput'
      local += " modified"     //...and this would modify 'userInput' too
      Stdout().println(local)

//EOF