Taint-Style Vulnerability

security

Definition

Taint-Style Vulnerability

A taint-style vulnerability is one in which attacker-controlled (tainted) data flows to a sensitive function or API — a sink — without proper sanitization. The bug is in the data-flow path, not in the sink’s own implementation: the sink receives tainted input when it should have received only trusted input, and does something dangerous with it.

Sources and Sinks

The two ends of a tainted flow

• Source — where tainted data enters the program. Any input-reading function: fgets, scanf, read, recv, command-line argv, an HTTP request body, a database field the user previously wrote. The source is where the data becomes tainted — everything read from an attacker-controlled channel starts tainted.
• Sink — a sensitive code location that does something dangerous with data: the first argument of printf (treated as a format string), a SQL query string, an HTML output template, an eval call, a shell command, a strcpy destination. The sink is where the taint does harm if it reaches it un-sanitized.

A taint vulnerability is a path from a source to a sink with no sanitizer on it.

Examples Across Layers

The same shape at every layer

The source-sink shape crosses layer boundaries — it recurs wherever an input channel reaches a templating or evaluation engine:

• format-string vulnerability — source: any input-reading function (fgets, scanf, …); sink: the first argument of printf. See Format String Vulnerability.
• SQL injection — source: a user-supplied form field; sink: a SQL query string concatenated into. See SQL Injection.
• cross-site scripting — source: stored or reflected user input; sink: an HTML output context. See Cross-Site Scripting.
• template injection — source: user input; sink: a template engine’s render call.

The framing unifies them: in each, the bug is a missing separation of code and data at the sink, exactly as the web-injection insight describes, applied now at the C library layer.

Detection

The next lectures' topic

Taint analysis — tracking tainted data as it propagates from sources, through variables and assignments, until it either reaches a sink (vulnerability found) or is sanitized (flow closed) — is the detection technique the next lecture cluster teaches. The source-sink framing exists in large part to make this analytical approach precise: name the sources, name the sinks, and ask whether any unsanitized path connects them.