Merge pull request #1633 from aschackmull/java/taint-string-concat

Java: Add taint step for String::concat.

java/ql/src/semmle/code/java/dataflow/TaintTracking.qll

@@ -377,6 +377,7 @@ module TaintTracking {
   private predicate taintPreservingQualifierToMethod(Method m) {
     m.getDeclaringType() instanceof TypeString and
     (
+      m.getName() = "concat" or
       m.getName() = "endsWith" or
       m.getName() = "getBytes" or
       m.getName() = "split" or
@@ -481,6 +482,10 @@ module TaintTracking {
       method.getName().matches("to%String") and arg = 0
     )
     or
+    method.getDeclaringType() instanceof TypeString and
+    method.getName() = "concat" and
+    arg = 0
+    or
     (
       method.getDeclaringType().hasQualifiedName("java.lang", "StringBuilder") or
       method.getDeclaringType().hasQualifiedName("java.lang", "StringBuffer")