org.checkerframework.checker.tainting.qual.Untainted
.
Safe string is:
@Untainted
@Untainted
and does not have non-safe methods calls assignedExample:
void doSmth(boolean b) {
String s = safe();
String s1 = "other";
if (b) s1 = s;
sink(s);
}
String sink(@Untainted String s) {}
Here we do not have non-safe string assignments to s
so warning is not produced. On the other hand:
void doSmth(boolean b) {
String s = safe();
String s1 = "other";
s1 = foo();
if (b) s = s1;
sink(s); // warning here
}
String foo();
String sink(@Untainted String s) {}
Here we have a warning since s1
has an unknown state after foo
call result assignment.
New in 2021.2