How to propogate taint across data casting about mariana-trench

[arthaud]

Hi @chuayupeng,
If you want the return value of getParcelableExtra to be tainted, then you want to use Return instead of Argument(0) for the port.
You might think that using Argument(0) in combination with taint-in-taint-out is equivalent to using Return as the port, but it is not. taint-in-taint-out only affects inferred taint, i.e it won't propagate the user-specified generation.

[arthaud]

generations with Argument(0) means that the source is added on argument 0, i.e the implicit this parameter.
For instance, if foo has a generation on Argument(0) then:

void method(Class x) {
  String y = x.foo();
  // x is now tainted, but y is not tainted

It is the opposite with Return: y would be tainted but x wouldn't be.

[chuayupeng]

Hi @arthaud,

Thanks, it appears to be working now!
But what is the difference between using generations with Argument(0) as opposed to with Return ?

[chuayupeng]

Thanks for the explanation! Cleared my doubts!