In the context of application security, I often heard the terms entry point, data source and sink. Can you define them for me in simple terms please?


Source and sink are used in a data flow analysis. The source is where data comes from, the sink is where it ends. With regards to application security, source and sink are frequently used for taint analysis.

Data is "tainted" if it comes from an insecure source such as a file, the network, or the user. Any data that touches data also becomes tainted. If tainted data is ever passed to a sensitive sink, then static analysis will flag an issue. For example, if user input from a web form is printed, unescaped, into a log file, then a static analysis tool will report a log forging vulnerability.

I think that entry point is a more general term that refers to the place where a program or event handler begins execution. For example, the main() function of a C program or the doGet() function of an HttpServlet. This is the starting point for data flow analysis.

  • Thank you sir for your answer. If data is passed between multiple functions func1 -> func2 -> func3. Are all functions in this path, sinks? – Othman May 22 '16 at 2:59
  • Generally, sink is the end of the data flow. In the context of security static analysis, sinks are the operations that must have clean data. A sink could be a database call or returning data to the browser. Anything that you wouldn't want an attacker to be able to fully manipulate. You use sanitizing operations to escape or filter tainted data. After sanitization, tainted data becomes clean and can safely enter a sink – Neil Smithline May 22 '16 at 3:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.