First draft of sinks for unsafe deserialization with Jackson

2025-12-21 19:26:31 +01:00 · 2021-05-02 18:47:24 +02:00
parent 1d56748eed
commit 3eb2af1bc2
2 changed files with 148 additions and 0 deletions
--- a/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.ql
+++ b/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.ql
@@ -40,6 +40,10 @@ class UnsafeDeserializationConfig extends TaintTracking::Configuration {
      ma.getArgument(0) = pred.asExpr() and
      ma.getQualifier() = succ.asExpr()
    )
+    or
+    createJacksonJsonParserStep(pred, succ)
+    or
+    createJacksonTreeNodeStep(pred, succ)
  }

  override predicate isSanitizer(DataFlow::Node node) {