Assignment to a method call of a tainted object

[rbonifacio]

In the current implementation, we are not propagating "taint information" when the RHS of an assignment is a method call of a tainted object. For instance, consider the example:

protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
   String str = req.getParameter("name");   /* str is TAINTED */ 
   PrintWriter writer = resp.getWriter();
   String str2 = str.toString();
   writer.println(str2);    /* BAD */
 }

Currently, we don't propagate the tainted information to the statement String str2 = str.toString()