Class SanitizeInstr

java.lang.Object

org.ek9lang.compiler.ir.instructions.IRInstr

org.ek9lang.compiler.ir.instructions.SanitizeInstr

All Implemented Interfaces:

INode

public final class SanitizeInstr
extends IRInstr

IR instruction for sanitizing string values to prevent injection attacks.

Creates a NEW sanitized string from the source operand and stores it in the destination. Format: SANITIZE destination = source

The sanitization ALWAYS creates a new object - either:

• A sanitized copy if the source contained potentially dangerous content
• A clean copy of the source if no sanitization was needed

This ensures consistent copy semantics for the 'sanitized' parameter modifier: a threat becomes an unset String, and a safe value becomes the receiver's own copy, so the caller's String is never shared.

It is emitted ONLY by the receiver prologue (SanitizedParameterPrologue) - the receiving callable cleans each of its own 'sanitized' parameters right after declaring it, never a call site:

REFERENCE input, org.ek9.lang::String
_temp1 = SANITIZE input              ; +1: the receiver's own copy, or unset
SCOPE_REGISTER _temp1, _scope_1      ; balances that +1 at scope exit
STORE input, _temp1                  ; rebind the parameter - NO RELEASE (the caller owns the argument), NO RETAIN

JVM backend: Ignores SCOPE_REGISTER (GC handles memory). LLVM backend: Uses SCOPE_REGISTER for ARC memory management; see EK9_BACKEND_IR_CONTRACTS.md.

Method Summary

Modifier and Type	Method	Description
String	getDestination()	Get the destination variable name where the sanitized result is stored.
String	getSource()	Get the source variable name being sanitized.
static SanitizeInstr	sanitize(String destination, String source)	Create instruction to sanitize a string and store in destination (no debug info).
static SanitizeInstr	sanitize(String destination, String source, DebugInfo debugInfo)	Create instruction to sanitize a string and store in destination.

Methods inherited from class IRInstr

accept, addOperand, addOperands, equals, getDebugInfo, getEscapeMetaData, getOpcode, getOperands, getResult, hasEscapeMetaData, hashCode, hasResult, isControlFlow, isLabel, isMemoryManagement, isMethodCall, setEscapeMetaData, toString

Methods inherited from class Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Method Details

sanitize

public static SanitizeInstr sanitize(String destination,
 String source,
 DebugInfo debugInfo)

Create instruction to sanitize a string and store in destination.

Pattern: SANITIZE destination = source

ALWAYS creates a new object. The destination receives either:

• A sanitized copy if source contained dangerous content
• A clean copy of source if no sanitization was needed

Parameters:

destination - The variable to store the sanitized result

source - The variable containing the string to sanitize

debugInfo - Debug information for source mapping (can be null)

Returns:

SANITIZE instruction

sanitize

public static SanitizeInstr sanitize(String destination,
 String source)

Create instruction to sanitize a string and store in destination (no debug info).

Parameters:

destination - The variable to store the sanitized result

source - The variable containing the string to sanitize

Returns:

SANITIZE instruction

getDestination

public String getDestination()

Get the destination variable name where the sanitized result is stored. This is also available via getResult().

getSource

public String getSource()

Get the source variable name being sanitized.