Integration with IoC containers

[dridi]

With IoC containers you may not be able to assert implementations behind interfaces. The code using such interfaces wouldn't be marked as tainted even if it uses a tainted implementation (injected with xml configuration for instance).

If Findbugs allows it, a workaround could be :

• execute a first pass
  • find a class with a tainted method
  • mark the interfaces tainted and invalidate the pass
• execute a second pass if the first has been invalidated
  • the code using the tainted interfaces is now marked as such

This could generate a lot of noise if interfaces like Comparable become tainted because of a bad implementation.
It might be a good idea to add configurable include and/or exlude patterns to avoid this.