Glossary: taint tracking, sources, sinks and the terms around them

Taint tracking is a runtime technique that marks data from untrusted sources and follows it through every transformation until it reaches a dangerous operation.

Untrusted data, also called tainted data or taint, is any data a program received from outside, such as a network request or a file.

A source is a place where untrusted data enters a program, such as a network socket, a file, standard input or an environment variable.

A sink is a dangerous operation where untrusted data can do harm, such as running a shell command, sending a database query or evaluating code.

An event is EyalSec's record that untrusted data reached a sink, with the operation, the line of code, the value and its origin.

es-python is the EyalSec Python runtime: you run your programs with es-python instead of python, and it reports untrusted data reaching a sink.

Report mode records each flow of untrusted data into a sink as an event on the dashboard and lets the program keep running.

Report and Raise mode records the event and also stops the operation, raising a Python RuntimeError instead of running it.

A sanitizer is a step that makes untrusted data safe for one particular operation, such as binding it as a query parameter or escaping it for the context it will be used in, so it reaches the sink as a value rather than as code.

Runtime detection is finding a vulnerability by watching the program as it runs on real input, so a finding is an operation that actually happened, with the data that really reached it.

es-chromium is the EyalSec browser, a desktop browser for security testing that follows page input through the page's JavaScript and reports the DOM-based cross-site scripting flows that really happened in the page.

SQL injection is a flaw where data an attacker controls becomes part of the text of a SQL statement, so the database runs a query the developer never wrote.

Command injection is a flaw where data an attacker controls ends up in an operating-system command the program runs, so the attacker gets to run commands of their own with the program's privileges.

Code injection is a flaw where data an attacker controls is run as Python code, through eval(), exec(), a dynamic import or a name-based lookup, so the attacker can do anything the program can.

Insecure deserialization is a flaw where a program rebuilds Python objects from bytes an attacker controls, and the rebuilding itself runs attacker-chosen code, before the program ever looks at the result.

Path traversal is a flaw where data an attacker controls decides which file the program opens, letting them escape the directory the program meant to stay in and read or write files elsewhere.

Server-side request forgery is a flaw where an attacker makes the server itself send a request to a destination of their choosing, reaching internal services and cloud metadata that the attacker could never reach directly.

ReDoS is a flaw where a regular expression takes time that grows explosively on certain inputs, so an attacker can hang a request, or a whole worker, with a short string.

Server-side template injection is a flaw where data an attacker controls becomes part of a template's source instead of its data, so the template engine evaluates the attacker's expressions on the server.

A WAF (web application firewall) is a filter that inspects HTTP requests at the network edge and blocks the ones that match known attack patterns before they reach the application.

RASP (runtime application self-protection) is a category of security agent that runs with an application and watches the requests it handles for attacks as they happen.

SAST (static application security testing) analyses source code without running it, to find patterns that can lead to vulnerabilities while the code is still being written.

DAST (dynamic application security testing) tests a running application from the outside, sending crafted requests and judging from the responses whether an attack succeeded.

SCA (software composition analysis) inventories the third-party packages an application depends on and matches their versions against known vulnerabilities.

IAST (interactive application security testing) instruments an application while tests or a scanner exercise it, so it can watch data move through the code during that run.