IterationExtension.qll

// Extending taint-tracking to support tracking through iteration is a bit fiddly prior in 1.20 and earlier
// We need to track both getting an item from the iterable *and* the assignment to the target variable.

/* Track the implicit `next` operation */
class NextItemExtension extends DataFlow::Extension {

    ForNode for;

    NextItemExtension() {
        for.iterates(_, this)
    }

    override ControlFlowNode getASuccessorNode(TaintKind fromkind, TaintKind tokind) {
        for.iterates(result, this) and
        (
          fromkind.(SequenceKind).getItem() = tokind
          // Insert any other kinds that you wish to support here. E.g. iterating over a file produces strings.
        )
    }

}

/* Track the assignement to the iteration variable */
class IterAssignmentExtension extends DataFlow::Extension {

    IterationDefinition def;

    IterAssignmentExtension() {
        def.getDefiningNode() = this
    }

    override EssaVariable getASuccessorVariable() {
        result = def.getVariable()
    }

}