hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Cleanup Jackson logic after code review

Browse Source
This commit is contained in:
Jonathan Leitschuh
2021-05-11 10:48:22 -04:00
parent bacc3ef5b3
commit 5a68ac88ef
5 changed files with 11 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
java/ql/src/semmle/code/java/frameworks/jackson/JacksonSerializability.qll
View File

@@ -72,18 +72,6 @@ private class ExplicitlyWrittenJacksonSerializableType extends JacksonSerializab
}
}
/** A type whose values are explicitly deserialized in a call to a Jackson method. */
private class ExplicitlyReadJacksonSerializableType extends JacksonDeserializableType {
ExplicitlyReadJacksonSerializableType() {
exists(MethodAccess ma |
// A call to a Jackson read method...
ma.getMethod() instanceof JacksonReadValueMethod and
// ...where `this` is used in the final argument, indicating that this type will be deserialized.
usesType(ma.getArgument(ma.getNumArgument() - 1).getType(), this)
)
}
}
/** A type used in a `JacksonSerializableField` declaration. */
private class FieldReferencedJacksonSerializableType extends JacksonSerializableType {
FieldReferencedJacksonSerializableType() {
@@ -123,6 +111,13 @@ private class ExplicitlyReadJacksonDeserializableType extends JacksonDeserializa
exists(TypeLiteralToJacksonDatabindFlowConfiguration conf |
usesType(conf.getSourceWithFlowToJacksonDatabind().getTypeName().getType(), this)
)
or
exists(MethodAccess ma |
// A call to a Jackson read method...
ma.getMethod() instanceof JacksonReadValueMethod and
// ...where `this` is used in the final argument, indicating that this type will be deserialized.
usesType(ma.getArgument(ma.getNumArgument() - 1).getType(), this)
)
}
}