In the context of application security, I often heard the terms entry point, data source and sink. Can you define them for me in simple terms please?
Source and sink are used in a data flow analysis. The source is where data comes from, the sink is where it ends. With regards to application security, source and sink are frequently used for taint analysis.
Data is "tainted" if it comes from an insecure source such as a file, the network, or the user. Any data that touches data also becomes tainted. If tainted data is ever passed to a sensitive sink, then static analysis will flag an issue. For example, if user input from a web form is printed, unescaped, into a log file, then a static analysis tool will report a log forging vulnerability.
I think that entry point is a more general term that refers to the place where a program or event handler begins execution. For example, the
main() function of a C program or the doGet() function of an
HttpServlet. This is the starting point for data flow analysis.