diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll b/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll index 02c43f874bf..2213ff35b1b 100644 --- a/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll +++ b/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll @@ -188,7 +188,9 @@ predicate containerStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) { exists(DataFlow::Content c | c = contentSet.getAReadContent() | c instanceof DataFlow::TupleElementContent or c instanceof DataFlow::DictionaryElementContent or - c instanceof DataFlow::DictionaryElementAnyContent + c instanceof DataFlow::DictionaryElementAnyContent or + c instanceof DataFlow::ListElementContent or + c instanceof DataFlow::SetElementContent ) ) } diff --git a/python/ql/lib/semmle/python/frameworks/Stdlib.qll b/python/ql/lib/semmle/python/frameworks/Stdlib.qll index 014ef4e9f64..9364203436d 100644 --- a/python/ql/lib/semmle/python/frameworks/Stdlib.qll +++ b/python/ql/lib/semmle/python/frameworks/Stdlib.qll @@ -4983,10 +4983,6 @@ module StdlibPrivate { // For code like `" ".join([name])` input = "Argument[0,iterable:].ListElement" and preservesValue = true - or - // For code like `" ".join(name)` - input = "Argument[0,iterable:]" and - preservesValue = false ) and output = "ReturnValue" }