title: Replicating the 'Taint mode' from 'Fortify static checking tool' in Haskell
body: <p>I've read some documentation of the Fortify static checking tool. One of the concepts used by this tool are called <em>taints</em>. Some sources, such as web requests, provide data that is tainted in one or more ways and some sinks, such as web responses, require the data to be untainted. </p>
  
  <p>The nice thing about Fortify is that you can have several types of taints. For example, you could tag <code>srand</code> output with <code>NON_CRYPTO_RAND</code> and then require that this taint is not present when using the variable for crypto purposes. Other examples include non-bound checked numbers and so on.</p>
  
  <p>Is it possible to model taints with the stronger static type system used in Haskell or other programming languages with even more sophisticated type systems?</p>
  
  <p>In Haskell, I could do types such as <code>Tainted [BadRandom,Unbounded] Int</code> but computing with them seems quite difficult as this new type constraints also operations that don't restrict the taints.</p>
  
  <p>Are there nicer ways to accomplish this? Any existing work on the topic?</p>