diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll b/java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll index b275c381150..af8f2273cbe 100644 --- a/java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll +++ b/java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll @@ -255,6 +255,7 @@ private class BulkData extends RefType { * status of its argument. */ private predicate inputStreamWrapper(Constructor c, int argi) { + not c.fromSource() and c.getParameterType(argi) instanceof BulkData and c.getDeclaringType().getASourceSupertype+().hasQualifiedName("java.io", "InputStream") }