Code & applications
ImplementedSource code
Vulnerabilities in the code: injection, taint / dataflow, secrets, cryptography and TLS, and supply chain.
Family facts
- Code
- FAM-CODE-SRC
- Status
- ready — code maturity
- Availability
- available — whether it is offerable
- Ingest
- pull — how a target enters
- Rules of Engagement
- Not required
- Kind
- Family (a selectable assessment)
What it decides
Whether untrusted input actually reaches a dangerous sink along a real, reachable path — not merely that a sink exists.
How it works
It runs a real definition-use dataflow analysis: sources (untrusted input), sinks (dangerous operations), and sanitizers, tracked across the program’s structure, producing the actual source-to-sink path as evidence. A taint finding is promoted only when the path provenance is marked proven; a route that is merely co-located stays UNKNOWN.
The verifier re-reads the source so a finding is re-derivable rather than a cached rule hit, and reachability into the real deployment is expressed through attack-surface invariants such as “a critical asset must not be reachable from untrusted input”.
A worked example
A request parameter flowing through assignments into a shell call yields a proven source-to-sink path; the verifier settles “tainted data must not reach a sensitive tool” and the membrane marks it SUPPORTED, with a sandbox proof turning it CONFIRMED.
Declared limits
Native taint with provenance is strongest for Python and the common injection classes; it is single-pass and straight-line (interprocedural, alias and branch precision are future work). Other languages are presence-based rather than full taint.
References
- [1]MITRE CWE Top 25
- [2]Sabelfeld & Myers, language-based information-flow security
- [3]Code Property Graph (Yamaguchi et al.)
References point to public, well-known technical sources for further study.
Related articles