public class CollectionTaintTracking { public void ImplicitCollectionReadAtSink() { var tainted = Source(1); var arr = new object[] { tainted }; Sink(arr); // $ hasTaintFlow=1 } static T Source(object source) => throw null; public static void Sink(T t) { } }