Where can the 'sanitized' keyword NOT be used in EK9?

← Security and Sanitization · Ref: Q950

sanitized keyword can't be on captured variables or declarations.

1. NOT ON CAPTURES (E07941)

When a dynamic function or class captures a variable, the capture cannot be marked sanitized. Sanitization is a property of function parameters, not captures.

2. NOT ON DECLARATIONS (E07943)

Local variable declarations cannot use sanitized. Only function/method parameters can be marked sanitized because sanitized tracks external untrusted input entering a function boundary.

VALID USAGE

  processInput() as pure
    -> input as sanitized String
    <- result as String: String(input)

INVALID USAGE

  localVar as sanitized String    // E07943

WHY RESTRICTED

Sanitization is about trust boundaries. Only parameters represent data crossing a trust boundary. Local variables and captures are already inside the trusted zone.

See Q215 for sanitized parameter basics. See Q217 for pure interaction. See Q269 for input validation.

Example

defines module qa.security.sanitizedrestrictions

  defines function

    <?-
      Valid use: sanitized on function parameter.
    -?>
    validateInput() as pure
      -> userInput as sanitized String
      <- result as String?

      safeCopy <- String(userInput)
      result: "Validated: " + safeCopy

    processQuery() as pure
      -> sql as sanitized String
      <- output as String?

      localCopy <- String(sql)
      output: "Query: " + localCopy

  defines program

    SanitizedRestrictionsDemo()
      stdout <- Stdout()

      r1 <- validateInput("user data")
      if r1?
        stdout.println(r1)

      r2 <- processQuery("SELECT 1")
      if r2?
        stdout.println(r2)

      stdout.println("sanitized only on function parameters")

Common mistakes

E07920 — The sanitized modifier is only valid on incoming function/method parameters, not on a return or local declaration. See ek9 -h E07920 for details.

Incorrect:

      <- result as sanitized String?

Correct:

      <- result as String?

Coming from another language?

Java: no language-level sanitization. Python: no taint tracking. Rust: newtype for manual tracking. EK9: sanitized restricted to function parameters only, enforced at compile time.

Keywords: restriction, trust, captured, boundary, parameter, security, sanitized, E07943, declaration, E07941