Taint Tracking
A core technique in the field of information flow security that tags data with its origin label and propagates the label as data flows through operations, triggering a policy when the data reaches a sensitive sink.
Timeline (last 90 days)
Fixes include: binding approvals to exact parameters (tool, payee, amount, invoice, expiry time, nonce) and re-validating at execution time; taint tracking on egress; showing approvers the original request and parameters; labeling the source of retrieved chunks; running with least privilege per task; testing objects rather than only testing verbs.
Taint tracking originates from information-flow security models; the core idea is to tag data with source-trustworthiness labels and let the labels propagate as the data flows, so that after data from untrusted sources enters a variable or context, operations sending it to external destinations are blocked or downgraded.
AegisKernel's mathematical taint tracking wraps all external data as the TaintedString type, and operations such as slicing, case conversion, and formatting mathematically preserve the taint label.
The effectiveness of taint tracking depends on all external inputs being correctly labeled; if developers bypass the framework to directly read environment variables or network data, the taint chain will break.
All Facts (4)
Fixes include: binding approvals to exact parameters (tool, payee, amount, invoice, expiry time, nonce) and re-validating at execution time; taint tracking on egress; showing approvers the original request and parameters; labeling the source of retrieved chunks; running with least privilege per task; testing objects rather than only testing verbs.
50%UnverifiedTaint tracking originates from information-flow security models; the core idea is to tag data with source-trustworthiness labels and let the labels propagate as the data flows, so that after data from untrusted sources enters a variable or context, operations sending it to external destinations are blocked or downgraded.
50%UnverifiedAegisKernel's mathematical taint tracking wraps all external data as the TaintedString type, and operations such as slicing, case conversion, and formatting mathematically preserve the taint label.
50%UnverifiedThe effectiveness of taint tracking depends on all external inputs being correctly labeled; if developers bypass the framework to directly read environment variables or network data, the taint chain will break.
50%