Input/output stacks in the Trace view

Data Flow

The lower left panel contains the data flow for the selected method. Data can flow through a method call or an assignment. The data flow section displays the line number in the source code where the item and context appear.

Call Graph

The chart is a graphical representation of the call graph. Each method call is a rectangle within the graph showing the class name and the method name:

• Red identifies the method call as a source, sink, or both.
• A lost sink is an API method that can no longer be traced. A virtual lost sink is a lost sink that is also a virtual function (a function that can have more than one implementation). Yellow identifies the method call as a lost sink or virtual lost sink.
• Blue indicates that the method call is not a validation/encoding routine.
• Grey represents all other trace node types.

Each method call is divided into three sections: the class name, the method name, and the tainted argument name. Hover text for the method call provides greater detail.

Lines with arrows represent calls from method to method. An unfilled arrowhead indicates that there was no known tainted data in the call, while a solid arrow indicates tainted data flow. A dashed arrow indicates a return statement.

Symbol	Description
	Method call with no known tainted data
	Method call with tainted data
	Return with tainted data
	Source (red): A method, function, or parameter that is the origin of potentially untrustworthy data.
	Sink (red): A method or function that is potentially vulnerable to tainted data or is potentially dangerous to use.
	Lost sink (yellow): A method/function that is potentially vulnerable to tainted data or is potentially dangerous to use.
	Virtual lost sink (yellow): A type of lost sink that is resolved to more than one concrete implementation.
	Not a validation/encoding routine (blue). Marking an API as not a validation/encoding routine identifies that this API does not validate any data.
	Taint propagator: A function/method that propagates taint to one or more of its parameters, to its return value, or to this pointer.