import java import semmle.code.java.dataflow.TaintTracking module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node n) { n.asExpr().(Argument).getCall().getCallee().hasName("taint") } predicate isSink(DataFlow::Node n) { n.asExpr().(Argument).getCall().getCallee().hasName("sink") } } module Flow = TaintTracking::Global; from DataFlow::Node src, DataFlow::Node sink where Flow::flow(src, sink) select src, sink