Can an extern function or method declare a sanitized parameter?

← Security and Sanitization · Ref: Q1400

No (E07944). A function or method cleans its own 'sanitized' parameters at the start of the body the compiler generates for it. An extern declaration ('defines extern module') only describes a body implemented somewhere else - for example in Java - so the compiler has nowhere to put the cleaning, and 'sanitized' there would promise cleaning that never happens.

THE TWO CORRECT PATTERNS

1. Clean inside the external implementation. In Java, call InputSanitizer on the incoming value - this is what EK9's own built-in types do.
2. Wrap the extern call in an ordinary EK9 function whose parameter is 'sanitized'. That wrapper's body IS generated, so the value is cleaned before it is passed on:

  cleanThenStore()
    -> input as sanitized String
    <- rtn as Boolean: storeRecord(input)

The extern signature itself stays plain:

  //inside a 'defines extern module ...' declaration
  storeRecord()
    -> recordText as String
    <- rtn as Boolean?

See Q1399 for how the receiver cleans a sanitized parameter on every route. See Q661 for where sanitized is allowed.

Example

defines extern module qa.sanitizeddeep.externstore

  defines function

    <?-
      Implemented outside EK9 (for example in Java). The compiler never generates this body,
      so it cannot clean 'recordText' - the implementation must call InputSanitizer itself.
    -?>
    storeRecord()
      -> recordText as String
      <- rtn as Boolean?

  defines class

    <?-
      An externally implemented class: its methods follow the same rule.
    -?>
    RecordStore
      RecordStore()

      save()
        -> entryText as String
        <- rtn as Boolean?

Common mistakes

E07944 — The compiler never generates an extern body, so it cannot clean the parameter - keep the extern signature plain and clean the input in the implementation, or in an EK9 wrapper with a sanitized parameter. See ek9 -h E07944 for details.

Incorrect:

-> recordText as sanitized String

Correct:

-> recordText as String

Coming from another language?

Java: a native or JNI method can claim anything in its documentation; nothing checks it. Kotlin/Swift: expect/extern declarations carry no security contract. EK9: an extern signature cannot claim 'sanitized' - only a body the compiler generates can keep that promise, so the claim is rejected at compile time (E07944).

Keywords: external, security, wrapper, InputSanitizer, Java, native, E07944, sanitized, extern, injection