Taint is stuck in exception variable declaration of a catch clause: `catch(Exception e)`

[intrigus-lgtm]

Description of the issue
Taint can not flow out of the caught exceptions in catch clauses.
E.g.

try {
} catch(Exception e) {
System.out.println(e.getMessage());
}

Here taint will not flow to e.getMessage().

import java
import semmle.code.java.dataflow.TaintTracking

class T extends TaintTracking::Configuration {
  T() { this = "T" }

  override predicate isSource(DataFlow::Node source) {
    exists(CatchClause c | c.getVariable() = source.asExpr())
  }

  override predicate isSink(DataFlow::Node sink) { any() }
}

from DataFlow::Node source, DataFlow::Node sink, T t
where t.hasFlow(source, sink)
select source, sink

Link to query:
https://lgtm.com/query/3909102737996232443/

[aschackmull]

Thanks for reporting this. We are indeed missing a flow-edge here. In the meantime you may use an access of the variable as your source definition instead to get the relevant flow:

exists(CatchClause c | c.getVariable().getAnAccess() = source.asExpr())