Try Taint Analysis in CodeSonar for Ada

With AI getting better and better at hacking, we need to get better and better at defending our codebases. CodeSonar for Ada (formerly GNAT SAS) can be a huge help for securing software as its SAST (Static Application Security Testing) features, such as Taint Analysis, enable discovering many of the most critical security issues a piece of software can have before exposing said software to the real world.

This article will provide a brief introduction to Taint Analysis, showcase some of the common issues software can have, describe how to run a CodeSonar for Ada’s Taint Analysis on your Ada software and then describe how to mitigate issues and configure Taint Analysis to solve reported problems.

Understanding how Taint Analysis works

Taint Analysis is based on three concepts: Sources, Sinks and Sanitizers. Sources are subprograms that read untrusted data into the program’s memory, Sinks are subprograms that perform sensitive operations and should not receive untrusted data and Sanitizers are subprograms that turn untrusted data into trusted data. Taint Analysis follows the flow of untrusted data from Source subprograms and raises errors when it reaches a Sink.

Security issues

CodeSonar for Ada catches many of MITRE’s 2025 TOP25 CWE list. Let’s focus on one in particular: CWE 89 - SQL Injection. SQL injections happen when attacker-controlled inputs can reach APIs used to communicate with a database without proper sanitization. Here’s an example:

procedure Delete_User
(DB : GNATCOLL.SQL.Exec.Database_Connection; Request : AWS.Status.Data)
is
Name : constant String := AWS.Status.Parameter (Request, "user");
begin
GNATCOLL.SQL.Exec.Execute
(DB, "DELETE FROM users WHERE name = '" & Name & "'");
end Delete_User;

In this code, we use Ada Web Services to retrieve the user parameter of a web request. This parameter is stored in the variable named Name, which is then inserted into a string handed to GNATCOLL.Sql.Exec.Execute. Since we never properly sanitize Name, a malicious attacker could set the value of the user parameter to Robert' OR '1'='1'; DROP TABLE users; --, effectively enabling execution of arbitrary SQL code that would delete every user instead of one.

Running an analysis with CodeSonar for Ada

Once you have CodeSonar for Ada installed on your machine, start a hub (you can refer to the “Installation: Setting Up The Hub” section in the CodeSonar manual for more information):

codesonar hub-start /path/to/hub/data [::]:7340

Perform an analysis:

codesonar analyze /path/to/project localhost:7340 codesonar ada_scan.py project.gpr

And your analysis results should be available in the CodeSonar for Ada hub:

CodeSonar hub showing a CWE-89 taint warning on Delete_User

The CodeSonar hub will provide you with an event trace describing the sequence of events leading to a potential compromise, in this specific case:

1: Name’s value originates from AWS.Status.Parameter, a tainted source

2 and 3: Name is concatenated to an SQL statement string.

4: The SQL statement string is passed to GNATCOLL.SQL.Exec.Execute, which is a sink.
Event 4 also describes the security issue in depth and provides references to further understand the problem.

Solving the problems

In the specific case of this example, the right solution is to use a prepared query. But in some situations, or with other CWEs, changing the APIs in use is not possible. In such cases, the solution is to introduce a new function that will take care of validating inputs before their use and to mark it as a sanitizer, to make the analysis trust its results:

function Escape_Name (Value : String) return String
   with Taint_Sanitizer => (Escape_Name'Result => Sql_Injection);
function Escape_Name (Value : String) return String is
  Result : String (1 .. 2 * Value'Length);
  Last   : Natural := 0;
begin
  for C of Value loop
     Last := Last + 1;
     Result (Last) := C;
     if C = ''' then
        Last := Last + 1;
        Result (Last) := ''';
     end if;
  end loop;
  return Result (1 .. Last);
end Escape_Name;
...
procedure Delete_User
  (DB : GNATCOLL.SQL.Exec.Database_Connection; Request : AWS.Status.Data)
is
   Name : constant String :=
     Escape_Name (AWS.Status.Parameter (Request, "user"));
begin
   GNATCOLL.SQL.Exec.Execute
     (DB, "DELETE FROM users WHERE name = '" & Name & "'");
end Delete_User;

The Taint_Sanitizer annotation names what the subprogram sanitizes, and what kind of taint is being sanitized (some values could carry multiple kinds of taint!).

Going farther

CodeSonar for Ada provides out-of-the-box taint coverage for the Ada runtime, GNATcoll and Ada Web Services libraries. Taint_Source, Taint_Sink and Taint_Sanitizer annotations can be applied similarly to the above sanitizer example to any piece of Ada code to arbitrarily extend the set of covered APIs (see CodeSonar for Ada’s taint documentation for more details). On top of its Taint Analysis, CodeSonar for Ada’s multiple analyses cover more than 70 CWEs, 13 of which are in MITRE’s 2025 Top 25 list. This makes CodeSonar for Ada one of the best tools for detecting security issues in Ada software - give it a try today!