# Taint analysis capability **URL:** \ **Category:** SonarQube Server / Community Build\ **Created:** [August 29, 2022, 3:32pm UTC](https://community.sonarsource.com/t/taint-analysis-capability/70624 "2022-08-29T15:32:12Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![zacktzeng](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/zacktzeng/32/21195_2.png) [@zacktzeng](https://community.sonarsource.com/u/zacktzeng)\ **Post date:** [August 29, 2022, 3:32pm UTC](https://community.sonarsource.com/t/taint-analysis-capability/70624/1 "2022-08-29T15:32:12Z")
Hello, I read that there is taint analysis starting from the Developer edition. For gitlab integration, if there are variables or functions referenced from another repo, can the taint analysis algorithm catch that too? Or does taint analysis require that these variable / functions be defined and used in the same repo? If inter-repo taint analysis is possible, I assume it’s required that I import all these relevant repo into Sonarqube, right? ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [August 29, 2022, 3:35pm UTC](https://community.sonarsource.com/t/taint-analysis-capability/70624/2 "2022-08-29T15:35:08Z")
SonarQube maintains a list of sources/sinks/sanitizers/validators/passthroughs for common frameworks, and this can be [extended to include custom configuration beginning in Enterprise Edition](https://docs.sonarqube.org/latest/analysis/security_configuration/). What repos you have imported will have no effect on oneanother. ---
**Author:** ![zacktzeng](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/zacktzeng/32/21195_2.png) [@zacktzeng](https://community.sonarsource.com/u/zacktzeng)\ **Post date:** [August 31, 2022, 2:33pm UTC](https://community.sonarsource.com/t/taint-analysis-capability/70624/3 "2022-08-31T14:33:11Z")
Does this mean the sonarqube’s taint analysis works on third party libraries and not codes in my repo? ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [September 14, 2022, 9:40am UTC](https://community.sonarsource.com/t/taint-analysis-capability/70624/4 "2022-09-14T09:40:11Z")
It works on both – but for example, if you’re defining a validator/sanitizer in your own code, or you’ve crafted your own library to execute database queries (the “sink”), you would need features in the Enterprise Edition to let SonarQube know about those functions. ---
**Author:** ![zacktzeng](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/zacktzeng/32/21195_2.png) [@zacktzeng](https://community.sonarsource.com/u/zacktzeng)\ **Post date:** [September 14, 2022, 1:24pm UTC](https://community.sonarsource.com/t/taint-analysis-capability/70624/5 "2022-09-14T13:24:54Z")
Are these features activated by default in the enterprise edition? would be nice if I don’t need to do anything. ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [September 14, 2022, 1:50pm UTC](https://community.sonarsource.com/t/taint-analysis-capability/70624/6 "2022-09-14T13:50:32Z")
It requires additional configuration – it’s a nice idea to be able to do something like automatically detect user-defined validators, and it’s something we might implement in the future, but today configuration is required. ---
**Author:** ![zacktzeng](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/zacktzeng/32/21195_2.png) [@zacktzeng](https://community.sonarsource.com/u/zacktzeng)\ **Post date:** [September 14, 2022, 4:34pm UTC](https://community.sonarsource.com/t/taint-analysis-capability/70624/7 "2022-09-14T16:34:42Z")
Awesome thanks @Colin !