taintpolicy

What it detects

Tracks values from environment variables and command-line arguments and reports when they reach configured filesystem, process, terminal, or logging operations without passing through a recognized validator or sanitizer.

Checks

Check	What it detects
untrusted-sink*	Reports untrusted input that reaches a configured sensitive sink without validation.

* Opt-in; requires explicit selection.

Why this is flagged

Input from the environment or another external source may contain paths, commands, control characters, or other unexpected data. Passing it directly to a sensitive operation can let that input change what the program does.

Further reading: OWASP input validation cheat sheet, OWASP OS command injection defense.

How to fix it

Validate the value against the small set or format the program actually accepts before using it. Prefer allowlists and structured APIs; when needed, pass the value through a trusted sanitizer designed for that specific sink.

Examples

Flagged code

func runConfiguredTool() error {
  // gohawk: untrusted data reaches process sink exec.Command
  return exec.Command(os.Getenv("TOOL")).Run()
}

Accepted code

func validateTool(tool string) (string, error) {
  if tool != "compiler" {
    return "", errors.New("unsupported tool")
  }
  return tool, nil
}

func runValidatedTool() error {
  tool, err := validateTool(os.Getenv("TOOL"))
  if err != nil {
    return err
  }
  return exec.Command(tool).Run()
}

Options

Knob	Default	Effect
sanitizers	empty	Comma-separated fully-qualified sanitizer functions.
sinks	filesystem,process,terminal,log	Comma-separated sink families: filesystem,process,terminal,log.