Skip to content

[K9VULN-10631] Add taint propagation within return expression#800

Merged
jasonforal merged 1 commit intomainfrom
jf/K9VULN-10631
Jan 7, 2026
Merged

[K9VULN-10631] Add taint propagation within return expression#800
jasonforal merged 1 commit intomainfrom
jf/K9VULN-10631

Conversation

@jasonforal
Copy link
Collaborator

@jasonforal jasonforal commented Jan 2, 2026

What problem are you trying to solve?

Currently, the data flow implementation doesn't properly draw graph edges from the expression of a return statement. For example, in the following, the two references of userInput aren't connected (but should be):

String userInput = params.get("id");
return sqlPrelude + userInput;

What is your solution?

Visit the return_statement but don't propagate from it.

Alternatives considered

N/A

What the reviewer should know

N/A

@jasonforal jasonforal requested a review from a team as a code owner January 2, 2026 23:07
@jasonforal jasonforal merged commit 2168756 into main Jan 7, 2026
81 of 83 checks passed
@jasonforal jasonforal deleted the jf/K9VULN-10631 branch January 7, 2026 20:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants