Taint analysis: following untrusted data through code finds real vulnerabilities

Multiple outlets explain taint analysis, a static code analysis technique that traces untrusted data from entry points (sources) to dangerous operations (sinks). It catches complex flaws like SQL injection and path traversal that simple pattern-matching tools miss, by proving whether an attacker can actually reach a sensitive function via a complete data path.

Bottom line — Taint analysis confirms attack paths; pattern matching flags suspicious lines that may be false positives.

Go deeper (5)

• Oversecured describes taint analysis as 'the difference between flagging that a file operation exists and proving that an attacker can control which file gets read.' Pattern-matching tools flag isolated function calls blind to context or sanitizers, per the article.
• Taint engines build a dataflow graph across the entire application, including cross-component boundaries. On Android, Oversecured's engine tracks data through Activities, Services, BroadcastReceivers, and ContentProviders — paths most tools miss.
• Oversecured found a real vulnerability in Google's com.google.auth.oauth2 library via taint analysis: attacker-controlled field values in Serializable classes reached Class.forName().newInstance(). Google paid a $3,133.70 bounty and fixed it, the company says.
• JetBrains' Qodana uses the same conceptual model: sources (HTTP parameters), sinks (database queries), and sanitizers that stop taint flow. The engine handles async calls, coroutines, and framework-specific rules for Spring, Ktor, and Micronaut, per the vendor.
• OpenTaint (Seqra, open-source) adds an AI agent that examines one finding and derives a reusable rule; subsequent scans run deterministically without another model call. Documentation names Java, Kotlin, and Spring as supported; Python and Go are on the roadmap.

Read the reporting