Java/UnsafeDeserializationQuery

java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.ql

java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll

@@ -313,6 +313,8 @@ private module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
+    result = sink.getLocation()
+    or
     result = sink.(UnsafeDeserializationSink).getMethodCall().getLocation()
   }
 }