[RESOLVED] Difference between DataFlow::Configuration and TaintTracking::Configuration?

[CaledoniaProject]

What's the difference between DataFlow::Configuration and TaintTracking::Configuration? They both have a isSource and isSink method.

[hvitved]

DataFlow::Configuration will preserve the value that is being tracked, while TaintTracking::Configuration does not. For example, in

x = "tainted";
y = "still " +  x;
sink(y)

there is taint-flow from "tainted" to y in sink(y), but there is not data-flow, since the value of y is not exactly "tainted".

[CaledoniaProject]

Understood. DataFlow is only able to track sink(x) not sink(x + "string").