Posted by John Viega on Sun, Aug 31, 2003 (03:43 PM) GMT

This tool can be used to build analyses that can detect security problems if you annotate your program with type information. For example, it allows you to declare variables as such:

int main(int argc, $tainted argv) {

If we try passing a $tainted variable to a function that takes an $untainted as a parameter, then there's a security violation that the system can determine statically. This tool has also been used to detect format string problems.