hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

add change note

Browse Source
This commit is contained in:
Alvaro Muñoz
2021-02-15 14:53:16 +01:00
parent 00a0b12dad
commit 3d3f4ba797
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
java/change-notes/2021-02-15-snakeyaml-fn-fix.md Normal file
View File

@@ -0,0 +1,5 @@
lgtm,codescanning
* The query "Unsafe Deserialization" (`java/unsafe-deserialization`) has been
improved to report those cases where SnakeYaml `Constructor` is used to fix
the unmarshaled object graph root's type but injection is still possible in
nested nodes of the object graph.