Structural taint engine: enhanced-for loop-variable propagator (drop iterator overfit)

ober

e317eaa91c8efce779229ec091298f50aa893be9

diff --git a/lib/semgrep/scan.sls b/lib/semgrep/scan.sls
index 17a8137..7c396f0 100644
--- a/lib/semgrep/scan.sls
+++ b/lib/semgrep/scan.sls
@@ -24804,8 +24804,6 @@
             path
             source
             java-full-line-range)]
-         [(java-rule-id? rule "java-iterator-missed-propagation")
-          (scan-java-ruleid-next-line-rule rule path source)]
          [else #f]))
   (def csharp-response-write-regex
        "\\b([A-Za-z_][A-Za-z0-9_]*)[ \\t]*\\.[ \\t]*Write[ \\t]*\\(([^\\n)]*)\\)")
@@ -31267,7 +31265,11 @@
          [(string=? language "kotlin")
           '("$L = $R" "$L[$I] = $R" "val $L = $R" "var $L = $R")]
          [(string=? language "java")
-          '("$L = $R" "$L[$I] = $R" "$T $L = $R" "this.$L = $R")]
+          '("$L = $R"
+             "$L[$I] = $R"
+             "$T $L = $R"
+             "this.$L = $R"
+             "for ($T $L : $R) {\n  ...\n}")]
          [else '("$L = $R" "$L[$I] = $R")]))
   (def (scan-implicit-assignment-propagators rule language
          path source target-root)
diff --git a/src/semgrep/scan.ss b/src/semgrep/scan.ss
index 20e7b07..f11eefc 100644
--- a/src/semgrep/scan.ss
+++ b/src/semgrep/scan.ss
@@ -24905,10 +24905,10 @@
     [(java-rule-id? rule "documentbuilderfactory-disallow-doctype-decl-missing")
      (java-ruleid-next-line-findings
        rule path source java-full-line-range)]
-    ;; `tainting` (field-initializer taint) now flows on the general structural
-    ;; engine via the field_declaration propagator bridge.
-    [(java-rule-id? rule "java-iterator-missed-propagation")
-     (scan-java-ruleid-next-line-rule rule path source)]
+    ;; `tainting` (field-initializer taint, via the field_declaration propagator
+    ;; bridge) and `java-iterator-missed-propagation` (enhanced-for loop variable,
+    ;; via the `for ($T $L : $R)` implicit-assignment propagator) now flow on the
+    ;; general structural engine.
     [else #f]))
 
 (def csharp-response-write-regex
@@ -31268,11 +31268,12 @@
        "var $L = $R")]
     [(string=? language "java")
      ;; Java: plain assignment, typed local/field declaration, field via this,
-     ;; array element.
+     ;; array element, enhanced-for loop variable (tainted from the iterable).
      '("$L = $R"
        "$L[$I] = $R"
        "$T $L = $R"
-       "this.$L = $R")]
+       "this.$L = $R"
+       "for ($T $L : $R) {\n  ...\n}")]
     [else '("$L = $R"
             "$L[$I] = $R")]))