taint_flow.scala

//enumerate all routes from attack surface script
val attackerControlledSource = cpg.method.filter(_.annotations.name("@RequestParameter").contains("userName")).parameter

// determine all security sensitive functions
val vulnerableSink = cpg.method.name("find*byUserName*").parameter

//conduct reachibility analysis from attacker controlled vectors to all security sensitive functions
if (vulnerableSink.reachableBy.attackerControlledSource.flows.exist) {
	println("Authentication Bypass Found!")
}