Refactor QL to make type check more concise

2026-03-04 22:56:47 +01:00 · 2025-07-11 06:13:01 +01:00
parent 439cf7a659
commit 006d77ffdd
1 changed files with 1 additions and 4 deletions
--- a/java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
+++ b/java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
@@ -149,10 +149,7 @@ predicate unsafeDeserialization(MethodCall ma, Expr sink) {
  exists(Method m | m = ma.getMethod() |
    m instanceof ObjectInputStreamReadObjectMethod and
    sink = ma.getQualifier() and
-    not exists(DataFlow::ExprNode node |
-      node.getExpr() = sink and
-      node.getTypeBound() instanceof SafeObjectInputStreamType
-    )
+    not DataFlow::exprNode(sink).getTypeBound() instanceof SafeObjectInputStreamType
    or
    m instanceof XmlDecoderReadObjectMethod and
    sink = ma.getQualifier()