diff --git a/java/ql/src/semmle/code/java/dataflow/internal/ContainerFlow.qll b/java/ql/src/semmle/code/java/dataflow/internal/ContainerFlow.qll index be642e2397c..fe74a1b5e3b 100644 --- a/java/ql/src/semmle/code/java/dataflow/internal/ContainerFlow.qll +++ b/java/ql/src/semmle/code/java/dataflow/internal/ContainerFlow.qll @@ -181,9 +181,10 @@ private predicate qualifierToMethodStep(Expr tracked, MethodAccess sink) { private predicate qualifierToArgumentStep(Expr tracked, RValue sink) { exists(MethodAccess ma | - ma.getMethod().(CollectionMethod).hasName("toArray") and + // java.util.Vector, java.util.concurrent.BlockingQueue, java.util.Collection + ma.getMethod().(CollectionMethod).hasName(["copyInto", "drainTo", "toArray"]) and tracked = ma.getQualifier() and - sink = ma.getArgument(1) + sink = ma.getArgument(0) ) }