Description of the issue
Taint can not flow out of the caught exceptions in catch clauses.
E.g.
try {
} catch(Exception e) {
System.out.println(e.getMessage());
}Here taint will not flow to e.getMessage().
import java
import semmle.code.java.dataflow.TaintTracking
class T extends TaintTracking::Configuration {
T() { this = "T" }
override predicate isSource(DataFlow::Node source) {
exists(CatchClause c | c.getVariable() = source.asExpr())
}
override predicate isSink(DataFlow::Node sink) { any() }
}
from DataFlow::Node source, DataFlow::Node sink, T t
where t.hasFlow(source, sink)
select source, sinkLink to query:
https://lgtm.com/query/3909102737996232443/
Description of the issue
Taint can not flow out of the caught exceptions in catch clauses.
E.g.
Here taint will not flow to
e.getMessage().Link to query:
https://lgtm.com/query/3909102737996232443/