Why can't I use sanitized at a call site in EK9?

← Code Quality · Ref: Q828

EK9 enforces that the sanitized keyword is only used in parameter declarations, not at call sites. Sanitization is the callee's responsibility, not the caller's.

THE RULE

Sanitized goes on the parameter declaration:

  processInput()
    -> data as sanitized String    // CORRECT: callee declares sanitization

Not at the call site:

  processInput(sanitized userInput)  // ERROR: caller cannot specify

WHY THIS MATTERS

Sanitization is a contract between the function and its callers. The function declares that it sanitizes its input — this is enforced at compile time. If callers could specify sanitization, it would be ambiguous: does the caller sanitize, the callee, or both?

EK9's rule: the function that receives the data is responsible for declaring and performing sanitization. The caller just passes the data.

See Q127 for sanitized parameters. See Q310 for code quality.

Example

defines module qa.quality.sanitized.callsite

  defines function

    processInput()
      -> rawInput as sanitized String
      <- rtn as String: rawInput

  defines program

    SanitizedCallSiteDemo()
      stdout <- Stdout()
      userInput <- "hello <script>alert('xss')</script>"

      // === CORRECT: just pass the data, callee sanitizes ===
      result <- processInput(userInput)
      stdout.println(result)

Common mistakes

E07942 — The sanitized keyword belongs on the parameter declaration, not at the call site. The callee decides what to sanitize. See ek9 -h E07942 for details.

Incorrect:

      result <- processInput(sanitized userInput)

Correct:

      result <- processInput(userInput)

Coming from another language?

Java: no built-in sanitization — developers use @Valid, @Sanitize annotations. Python: no enforcement. Rust: no built-in concept. Go: no enforcement. EK9: sanitized keyword on parameter declarations enforced at compile time, rejected at call sites.

Keywords: site, security, call, validation, E07942, sanitized, input, parameter