Reports cases when a non-safe object is passed to a method with a parameter marked with @Untainted annotations, returned from annotated methods or assigned to annotated fields, parameters, or local variables. Kotlin set and get methods for fields are not supported as entry points.

A safe object (in the same class) is:

Also static final fields are considered as safe.

The analysis is performed only inside one file. To process dependencies from other classes, use options. The analysis extends to private or static methods and has a limit of depth propagation.

Example:


  void doSmth(boolean b) {
    String s = safe();
    String s1 = "other";
    if (b) s1 = s;
    sink(s);
  }

  String sink(@Untainted String s) {}

Here we do not have non-safe string assignments to s so a warning is not produced. On the other hand:


  void doSmth(boolean b) {
    String s = safe();
    String s1 = "other";
    s1 = foo();
    if (b) s = s1;
    sink(s);        // warning here
  }

  String foo();

  String sink(@Untainted String s) {}

Here we have a warning since s1 has an unknown state after foo call result assignment.

New in 2021.2