I've read some documentation of the Fortify static checking tool. One of the concepts used by this tool are called taints. Some sources, such as web requests, provide data that is tainted in one or more ways and some sinks, such as web responses, require the data to be untainted.
The nice thing about Fortify is that you can have several types of taints. For example, you could tag srand
output with NON_CRYPTO_RAND
and then require that this taint is not present when using the variable for crypto purposes. Other examples include non-bound checked numbers and so on.
Is it possible to model taints with the stronger static type system used in Haskell or other programming languages with even more sophisticated type systems?
In Haskell, I could do types such as Tainted [BadRandom,Unbounded] Int
but computing with them seems quite difficult as this new type constraints also operations that don't restrict the taints.
Are there nicer ways to accomplish this? Any existing work on the topic?