codeql/java/ql/test/library-tests/dataflow/taint-format/A.java

import java.util.Formatter;
import java.lang.StringBuilder;



class A {
    public static String taint() { return "tainted"; }

    public static void test1() {
        String bad = taint();
        String good = "hi";

        bad.formatted(good);
        good.formatted("a", bad, "b", good);
        String.format("%s%s", bad, good);
        String.format("%s", good);
        String.format("%s %s %s %s %s %s %s %s %s %s ", "a", "a", "a", "a", "a", "a", "a", "a", "a", bad);
    }

    public static void test2() {
        String bad = taint();
        Formatter f = new Formatter();

        f.toString();
        f.format("%s", bad);
        f.toString();
    }

    public static void test3() {
        String bad = taint();
        StringBuilder sb = new StringBuilder();
        Formatter f = new Formatter(sb);

        sb.toString(); // false positive
        f.format("%s", bad);
        sb.toString();
    }

    public static void test4() {
        String bad = taint();
        StringBuilder sb = new StringBuilder();

        sb.append(bad);

        new Formatter(sb).format("ok").toString();
    }
}