Propagate taint through field reads

owen-mc · owen-mc · commit 711d8daee0b3 · 2025-11-28T09:59:08.000Z
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
@@ -141,6 +141,8 @@ private module Cached {
       (
         containerContent(f)
         or
+        f instanceof DataFlow::FieldContent
+        or
         f instanceof TaintInheritingContent
       )
     )

Original file line number	Diff line number	Diff line change
`@@ -141,6 +141,8 @@ private module Cached {`
`141`	`141`	`(`
`142`	`142`	`containerContent(f)`
`143`	`143`	`or`
	`144`	`+ f instanceof DataFlow::FieldContent`
	`145`	`+ or`
`144`	`146`	`f instanceof TaintInheritingContent`
`145`	`147`	`)`
`146`	`148`	`)`