hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-01 05:13:41 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3215 from aibaars/validating-object-input

Browse Source 
Java: teach UnsafeDeserialization about ValidatingObjectInputStream
This commit is contained in:
Anders Schack-Mulligen
2020-05-07 14:57:50 +02:00
committed by GitHub
parent 964b8478dc 39e652b26b
commit 2561ba82db
4 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll
View File

@@ -51,7 +51,14 @@ class SafeKryo extends DataFlow2::Configuration {
predicate unsafeDeserialization(MethodAccess ma, Expr sink) {
exists(Method m | m = ma.getMethod() |
m instanceof ObjectInputStreamReadObjectMethod and
sink = ma.getQualifier()
sink = ma.getQualifier() and
not exists(DataFlow::ExprNode node |
node.getExpr() = sink and
node
.getTypeBound()
.(RefType)
.hasQualifiedName("org.apache.commons.io.serialization", "ValidatingObjectInputStream")
)
or
m instanceof XMLDecoderReadObjectMethod and
sink = ma.getQualifier()