Taint not transfered in chained call of StringBuilder.append

[formanek]

In a piece of code like this

StringBuilder builder = new StringBuilder();
builder.append("safe").append(tainted);
// taint sink with builder.toString()

the taint state from variable tainted is not transferred to builder. As a result, there can be false negatives, if this construction is used. In practise, toString methods with false safe taint state were sometimes generated.

This was fixed by proper taint transfer between the stack and local variables.