Taint Tracking

Taint tracking attaches a label to data according to where it came from and carries that label along as the data is copied, combined and transformed. Before data reaches a sensitive operation, called a sink, the system checks the label and refuses or escalates when untrusted data is where it must not be. The technique is old: Perl’s taint mode marks input from the outside world as tainted and rejects tainted values in operations such as running a shell command, and dynamic taint analysis tools for compiled code do the same at the level of bytes.