Taint the array a foreach by reference writes into

[danog]

What a foreach (... as &$value) loop writes through $value now flows into the array it iterates over, so it isn't lost:

$values = ["key" => ""];
foreach ($values as &$value) {
    $value = (string) $_GET["value"];
}
unset($value);
echo $values["key"]; // TaintedHtml

The writes are taken from what $value holds at the end of an iteration and where the loop is left (break), and reach the array through an unkeyed arrayvalue-assignment path. When the array iterated over is a property, the property holds them too, so the taint reaches reads in other methods.

Values overwritten before the iteration ends, and writes in a foreach by value, don't taint the array.