How does EK9 detect and report security threats?

← Security and Sanitization · Ref: Q216

EK9 detects common security threats at compile time through sanitized parameter tracking and static analysis.

SQL INJECTION DETECTION

When a sanitized String parameter is used in database contexts, the compiler tracks that untrusted data flows through the system, ensuring copy constructor patterns are used.

XSS DETECTION

Sanitized parameters used in output contexts are tracked. The copy constructor pattern ensures tainted HTML/JavaScript cannot pass through unchecked.

COMMAND INJECTION DETECTION

Sanitized parameters in command execution contexts are flagged. The compiler ensures defensive copies prevent shell injection.

COMPILE-TIME ENFORCEMENT

The compiler enforces the sanitization pattern:

  1. Mark external input as sanitized
  2. Create defensive copies via constructors
  3. Use copies for processing

Violating this pattern produces compile errors.

See Q215 for sanitized parameters. See Q134 for exception handling. See Q218 for security best practices. See Q268 for OWASP vulnerability prevention. See Q272 for defense in depth.

Example

defines module qa.security.threats

  defines function

    // Sanitized parameter with copy constructor pattern
    processUserQuery() as pure
      -> userInput as sanitized String
      <- result as String?

      // Defensive copy — prevents injection
      safeCopy <- String(userInput)
      result: "Safe query: " + safeCopy

    // Passing sanitized to another function
    handleRequest() as pure
      -> requestData as sanitized String
      <- result as String?

      // Pass to helper for processing
      result: processUserQuery(requestData)

  defines program

    ThreatDetectionDemo()
      stdout <- Stdout()

      // === COMPILE-TIME SECURITY ===

      rawInput <- "user-provided data"
      safe <- processUserQuery(rawInput)
      if safe?
        stdout.println(safe)

      // === THREAT CATEGORIES ===

      stdout.println("EK9 detects at compile time:")
      stdout.println("  SQL injection via sanitized tracking")
      stdout.println("  XSS via output context analysis")
      stdout.println("  Command injection via parameter flow")
      stdout.println("Copy constructor pattern prevents all three")

Common mistakes

E50060 — String does not have a clone() method. Use the copy constructor String(value) to create a defensive copy. Calling a non-existent method triggers E50060 — method not resolved. See ek9 -h E50060 for details.

Incorrect:

safeCopy <- userInput.clone()

Correct:

safeCopy <- String(userInput)

Coming from another language?

Java: OWASP ESAPI or FindBugs for taint analysis (external tools). Python: Bandit for security linting. Rust: no taint tracking, but ownership prevents some classes. Go: no built-in, gosec for analysis. EK9: compile-time sanitization tracking detects SQL, XSS, and command injection threats.

Keywords: detection, safe, xss, threat, protect, injection, migrate, sql, report, command, security