Topic · taint analysis

Taint analysis

Gist

Taint analysis is who authored the value that reaches a trusted output. Proof runs proof audit --check trusted_outputs_from_untrusted_inputs. LDRA and Sonar walk the Go. Proof reads trust: client on the FRETish variables. Direct edges only. Jama still authors.

proof audit --check trusted_outputs_from_untrusted_inputs

Keep LDRA if you already run taint on C. Keep Sonar or Semgrep if you already track sources to sinks in the AST. Proof will not infer a source you did not declare.

Request demo Last sanitizer list vs this annotation

01 · The missed provenance

The shall is green. The money still comes from the client.

Consistency, gaps, and table proofs all reason about what values do. None of them ask who authored the input.

Wikipedia, LDRA, JetBrains, Sonar, and Semgrep will tell you taint analysis is a dataflow: mark untrusted sources, follow them through assignments, fail if they reach a sink. That is not this URL. Proof's check is a two-line path on authored facts: a trust: client variable in the FRETish antecedent, a direction: output in the consequent, no declared sanitizer on the requirement.

The motivating miss is mechanical. A safety or billing shall says revenue = sum(event_properties). Every other gate is green. The variable is an input. Direction describes dataflow role, not authority. The client submitted the properties. The output is money. Nobody recorded that the source was attacker-authorable.

The check does not walk the Go. It does not invent sources and sinks. You annotate with proof var set. Once any variable in the component is trust: client, every input and mode variable in that component must carry a trust fact or proof validate hard-fails. Partial annotation is refused rather than guessed.

proof var set analytics event_properties --trust client
proof var list analytics
proof audit --check trusted_outputs_from_untrusted_inputs --verbose

The first command is the fact. The audit is that fact contradicting the shall. A green sanitizer list next to an unannotated client input is how the money stayed client-authored.

02 · The exhibit

Same shall. A sanitizer list, or this annotation.

The output is trusted. The input is the client's. Click the tabs.

The run

Ask OWASP / LDRA / Sonar / Semgrep sources and sinks
Exit 0 if the AST path is clean
Why the engine did not see a tainted hop

Engine green

This hop

No trust fact on the FRETish variable. The shall still sums client-authored properties into revenue.

No provenance

The run

Keep the engine. It still owns inferred sources and sinks in the Go. That is not this hop.

Keep the engine

Proof

Ask trust: client in the antecedent, output in the consequent, no sanitizer
Out a two-line path a reviewer reads in one vars file

A green engine is not a trust fact

Same shall. A sanitizer list, or this annotation. Click the tabs.

Surface	What they do	What Proof does	What we lose
LDRA taint	A dataflow walk of the C. Sources, sinks, and hops in the qualified toolchain.	Authored `trust:` on FRETish variables. Direct edges only.	Not the engine. Keep LDRA on the C they already instrument. Proof vs LDRA.
Sonar / Semgrep / Qodana	Inferred sources and sinks in the AST. Taint mode on the function body.	A closed enum: client, server, operator, derived. Coverage rule once any client variable exists.	Not inferred taint. No source/sink catalogue.
Snyk	Security findings on dependencies and some dataflow rules. Proof vs Snyk.	Provenance on the shall, not a CVE on the lockfile.	Not the scanner. A trust miss is not a CVE.
Jama	The authoring programme. Trust lives on the item if you put it there.	Fail the missing sanitizer on the files. The two-line path in the log.	Not Jama's field. Jama still authors.

The teaching graph is still a trusted output next to an unannotated client input. Declare the fact before you trust the green. Three honest fixes, in order: recompute server-side and re-annotate trust: server; declare a sanitizer variable and register it under project.checks.trust.sanitizers; or waive with a reason if the output may carry client data (a display-only echo).

proof var set analytics event_properties --trust client
proof var set analytics server_validated_totals --trust server
proof audit --check trusted_outputs_from_untrusted_inputs --verbose
proof workflow check --stage verify --only trusted_outputs_from_untrusted_inputs

The sanitizer list is a closed inventory, not a naming convention. A derived variable whose inputs are client does not become client on its own. Annotate the intermediate if the taint survives. See Proof vs LDRA if the failure is MC/DC on C, not provenance. See Proof vs SonarQube if the failure is a quality gate, not a trust fact. See Proof vs Snyk if the failure is a CVE, not who authored the input.

03 · The honest loss

Proof names the fact. It does not walk the Go.

A two-line path is not a taint engine. Jama still authors.

Proof does not implement LDRA taint analysis, Sonar taint mode, Semgrep taint-mode, or Qodana's dataflow. It does not infer sources and sinks. Direct dependencies only: antecedent references and data_constraint.depends_on. Transitive hops across requirement chains are a recorded follow-up, not this check. Scope is project vocabulary: safety category, or the financial-tag set. A money flow tagged with neither fires nothing. Annotations are authored facts. The check is only as good as the inventory. We have not scored this against a frozen LDRA or Semgrep corpus. The loss is named, not scored.

MC/DC on C stays on Proof vs LDRA. The quality gate stays on Proof vs SonarQube. CVE findings stay on Proof vs Snyk. Jama still authors.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What is taint analysis? Same question. Same URL.

What is taint checking? Same cluster. The Wikipedia name for marking untrusted data and watching it reach a sink. This URL is the hop Proof can fail.

What is input validation? OWASP sanitizer lists. Keep them. They do not record who authored the FRETish variable.

How does Proof compare to LDRA? LDRA walks C in a qualified toolchain. This URL is provenance on the shall. Proof vs LDRA.

Is Proof an alternative to SonarQube taint? No. Keep the engine. Proof vs SonarQube.

Is Proof a Snyk alternative for taint? No. A trust miss is not a CVE. Proof vs Snyk.

Is Proof a Jama alternative for trust fields? No. Jama still authors. Proof vs Jama.