Taint is stuck in exception variable declaration of a catch clause: catch(Exception e) #3710
Description
Description of the issue
Taint can not flow out of the caught exceptions in catch clauses.
E.g.
try { } catch(Exception e) { System.out.println(e.getMessage()); }Here taint will not flow to e.getMessage().
import java import semmle.code.java.dataflow.TaintTracking class T extends TaintTracking::Configuration { T() { this = "T" } override predicate isSource(DataFlow::Node source) { exists(CatchClause c | c.getVariable() = source.asExpr()) } override predicate isSink(DataFlow::Node sink) { any() } } from DataFlow::Node source, DataFlow::Node sink, T t where t.hasFlow(source, sink) select source, sinkLink to query:
https://lgtm.com/query/3909102737996232443/