Where can the 'sanitized' keyword NOT be used in EK9?

← Security and Sanitization · Ref: Q950

sanitized keyword can't be on captured variables or declarations.

1. NOT ON CAPTURES (E07941)

When a dynamic function or class captures a variable, the capture cannot be marked sanitized. Sanitization is a property of function parameters, not captures.

2. NOT ON DECLARATIONS (E07943)

Local variable declarations cannot use sanitized. Only function/method parameters can be marked sanitized because sanitized tracks external untrusted input entering a function boundary.

VALID USAGE

  processInput() as pure
    -> input as sanitized String
    <- result as String: String(input)

INVALID USAGE

  localVar as sanitized String: "x"    // E07943

WHY RESTRICTED

Sanitization is about trust boundaries. Only parameters represent data crossing a trust boundary. Local variables and captures are already inside the trusted zone.

See Q215 for sanitized parameter basics. See Q217 for pure interaction. See Q269 for input validation.

Example

#!ek9
defines module qa.security.sanitizedrestrictions

  defines function

    <?-
      Valid use: sanitized on function parameter.
    -?>
    validateInput() as pure
      -> userInput as sanitized String
      <- result as String?

      safeCopy <- String(userInput)
      result: "Validated: " + safeCopy

    processQuery() as pure
      -> sql as sanitized String
      <- output as String?

      localCopy <- String(sql)
      output: "Query: " + localCopy

  defines program

    SanitizedRestrictionsDemo()
      stdout <- Stdout()

      r1 <- validateInput("user data")
      if r1?
        stdout.println(r1)

      r2 <- processQuery("SELECT 1")
      if r2?
        stdout.println(r2)

      stdout.println("sanitized only on function parameters")

Common mistakes

E07920 — The sanitized modifier is only valid on incoming function/method parameters, not on a return or local declaration. See ek9 -h E07920 for details.

Incorrect:

      <- result as sanitized String?

Correct:

      <- result as String?

Coming from another language?

Java: no language-level sanitization. Python: no taint tracking. Rust: newtype for manual tracking. EK9: sanitized restricted to function parameters only, enforced at compile time.

Keywords: E07941, E07943, boundary, captured, declaration, parameter, restriction, sanitized, security, trust