What Is a Vulnerability, Really? Source, Sink, and Taint
Two Java methods. One of them will let an attacker delete your entire products table. The other is completely safe. public int deleteA ( HttpServletRequest request , Connection conn ) { String id = request . getParameter ( "id" ); String sql = "DELETE FROM products WHERE id = " + id ; return conn . createStatement (). executeUpdate ( sql ); } public int deleteB ( HttpServletRequest request ,…
A vulnerability occurs when input provided by a user is used in a dangerous way by a program, without being properly cleaned or validated first. To understand vulnerabilities, think of three key concepts: source, sink, and taint.
The source is where the outside input enters the program. In the example code, this is the HttpServletRequest object's getParameter method, which reads a user-typed value.
The sink is an operation within the program where the input can cause harm if it's malicious. In the examples, the executeUpdate method of the Connection object is the sink, as it sends the user-supplied input directly to the database for execution.
Taint refers to the concept that untrusted data "stains" everything it touches as it travels through the program. Input arrives tainted, and any operation that incorporates this tainted data also becomes tainted.
In the first method (deleteA), the path from source to sink is direct: the user-supplied input is fed straight into the database without any filtering. This is a vulnerability, as demonstrated by an attacker who could delete the entire products table by injecting malicious SQL code.
In the second method (deleteB), however, the input is first filtered to ensure it only contains numeric characters. Only after this filtering does the tainted data proceed to the sink. This filtering acts as a safeguard, preventing the vulnerability from being exploited.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
