Where can the sanitized modifier be used in EK9?

← Security and Sanitization · Ref: Q847

The 'sanitized' modifier can only be applied to incoming function or method parameters. Fields, return values, and local variables cannot be marked as sanitized.

WHY ONLY PARAMETERS

Sanitization is a boundary concern. Input enters the system through function and method parameters. Once input has been sanitized at the boundary, the sanitized value can be stored normally. Marking fields or locals as sanitized would be meaningless because they are already inside the trusted boundary.

CORRECT PATTERN

Apply sanitized to the incoming parameter, then store the result:

  processInput() as pure
    -> userInput as sanitized String
    <- rtn as String: userInput

INCORRECT PATTERNS

- Field: name as sanitized String (E07920)
- Return: <- rtn as sanitized String (E07920)
- Local: cleaned as sanitized String (E07920)

See Q844 for sanitized overview. See Q845 for sanitized with records.

Example

defines module qa.sanitizeddeep.parameter.only

  defines function

    <?-
      Correct use of sanitized on an incoming parameter.
      The sanitized value is returned as a normal String.
    -?>
    processInput() as pure
      -> userInput as sanitized String
      <- rtn as String: userInput

  defines program

    SanitizedDemo()
      stdout <- Stdout()

      cleaned <- processInput("hello<script>")
      stdout.println(cleaned)

Common mistakes

E07920 — The sanitized modifier can only appear on incoming function or method parameters. Fields cannot be sanitized because sanitization is a boundary concern. See ek9 -h E07920 for details.

Incorrect:

    SomeClass
      name as sanitized String?

Correct:

    processInput() as pure
      -> userInput as sanitized String
      <- rtn as String: userInput

Coming from another language?

Java: no language-level sanitization (relies on libraries like OWASP). Python: no sanitization concept. Rust: no built-in sanitization. Go: no sanitization. EK9: compile-time sanitized modifier on parameters only, E07920 if misplaced.

Keywords: E07920, field, boundary, parameter, local, security, return, sanitized, validation, input