hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 01:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3215 from aibaars/validating-object-input

Browse Source 
Java: teach UnsafeDeserialization about ValidatingObjectInputStream
This commit is contained in:
Anders Schack-Mulligen
2020-05-07 14:57:50 +02:00
committed by GitHub
parent 964b8478dc 39e652b26b
commit 2561ba82db
4 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
java/ql/test/library-tests/UnsafeDeserialization/Test.java Normal file
View File

@@ -0,0 +1,12 @@
import java.io.IOException;
import java.io.ObjectInputStream;
import org.apache.commons.io.serialization.ValidatingObjectInputStream;
class Test {
public void test() throws IOException, ClassNotFoundException {
ObjectInputStream objectStream = new ObjectInputStream(null);
ObjectInputStream validating = new ValidatingObjectInputStream(null);
objectStream.readObject();
validating.readObject();
}
}

1
java/ql/test/library-tests/UnsafeDeserialization/unsafeDeserialization.expected Normal file
View File

@@ -0,0 +1 @@
| Test.java:9:3:9:27 | readObject(...) | ObjectInputStream |

6
java/ql/test/library-tests/UnsafeDeserialization/unsafeDeserialization.ql Normal file
View File

@@ -0,0 +1,6 @@
import default
import semmle.code.java.security.UnsafeDeserialization
from Method m, MethodAccess ma
where ma.getMethod() = m and unsafeDeserialization(ma, _)
select ma, m.getDeclaringType().getName()