PS: Don't implicitly read any element. Instead, only read positional contents.

MathiasVP · MathiasVP · commit 05a7cfd264b4 · 2025-06-20T14:54:15.000+01:00
diff --git a/powershell/ql/lib/semmle/code/powershell/dataflow/internal/TaintTrackingPrivate.qll b/powershell/ql/lib/semmle/code/powershell/dataflow/internal/TaintTrackingPrivate.qll
@@ -18,7 +18,7 @@ predicate defaultTaintSanitizer(DataFlow::Node node) { none() }
 bindingset[node]
 predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::ContentSet c) {
   node instanceof ArgumentNode and
-  c.isAnyElement()
+  c.isAnyPositional()
 }
 
 cached

Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,7 @@ predicate defaultTaintSanitizer(DataFlow::Node node) { none() }`
`18`	`18`	`bindingset[node]`
`19`	`19`	`predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::ContentSet c) {`
`20`	`20`	`node instanceof ArgumentNode and`
`21`		`- c.isAnyElement()`
	`21`	`+ c.isAnyPositional()`
`22`	`22`	`}`
`23`	`23`
`24`	`24`	`cached`