@@ -548,7 +548,7 @@ def process_flow_for_caller(
548548 if self ._acc_returns_taint :
549549 self ._summaries [caller_qn ] = self ._acc_return_taint
550550
551- # Lean non-Python (JS/TS) straight-line flow (issue #714) below.
551+ # Lean non-Python path-sensitive flow (issue #714) below.
552552 def _process_lean_flow (
553553 self ,
554554 caller_node : Node ,
@@ -580,14 +580,15 @@ def _process_lean_flow(
580580 for node in statements :
581581 tainted = self ._walk_js_stmt (node , tainted , jc )
582582 else :
583- # Go/Java path-sensitive MAY walk (issue #714 follow-up): an
584- # if_statement branches-and-merges like the JS walk (its condition/
585- # consequence/alternative fields are shared across the grammars), and
583+ # Flat-language path-sensitive MAY walk (issue #714 follow-up):
584+ # if/loop/try/switch/match nodes branch-and-merge like the JS walk
585+ # (zero-or-more loops union the skip path and re-walk once for
586+ # loop-carried taint -- do-while/Rust `loop` bodies always run, so
587+ # their pre-state stays out of the merge -- and try seeds each
588+ # handler with union(pre, body_exit)), and
586589 # the live shadow set is snapshotted per branch and restored at the
587- # merge, so a block-scoped Go/Java declaration inside a branch does not
588- # leak its shadow past the join. Loops and try are walked straight-line
589- # (one source-order pass), matching the previous flat behaviour --
590- # loop-carried and per-branch try taint stay a follow-up.
590+ # merge, so a block-scoped Go/Java declaration inside a branch does
591+ # not leak its shadow past the join.
591592 for node in statements :
592593 tainted = self ._walk_flat_stmt (node , tainted , jc )
593594 if self ._acc_returns_taint :
0 commit comments