hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 11:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4603 from pwntester/new_deser_sink

Browse Source 
New UnsafeDeserialization sink and improvements to SnakeYaml sink
This commit is contained in:
Anders Schack-Mulligen
2020-11-05 13:09:15 +01:00
committed by GitHub
parent 89a808cafe f103955f38
commit 45d117b68e
4 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
java/change-notes/2020-11-04-commonslang-unsafe-deserialization-sinks.md Normal file
View File

@@ -0,0 +1,3 @@
lgtm,codescanning
* The query "Deserialization of user-controlled data" (`java/unsafe-deserialization`) has been improved to recognize unsafe Apache Commons Lang(3) methods.
* The SnakeYAML Unsafe Deserialization sink has been improved to recognize `compose` and `composeAll` unsafe methods.