hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

No need to deprecate classes when module is deprecated

Browse Source
This commit is contained in:
Owen Mansel-Chan
2025-07-17 11:52:31 +01:00
parent b361f76643
commit 6629bd8279
3 changed files with 6 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/lib/change-notes/2025-07-16-unsafe-deserialization-sinks-deprecation.md
View File

@@ -1,8 +1,8 @@
---
category: deprecated
---
* The module `semmle.code.java.frameworks.Castor` has been deprecated and will be removed in a future release, including its two classes `CastorUnmarshaller` and `CastorUnmarshalMethod`.
* The module `semmle.code.java.frameworks.JYaml` has been deprecated and will be removed in a future release, including its two classes `JYamlLoader` and `JYamlLoaderUnsafeLoadMethod`.
* The module `semmle.code.java.frameworks.Castor` has been deprecated and will be removed in a future release.
* The module `semmle.code.java.frameworks.JYaml` has been deprecated and will be removed in a future release.
* The classes `UnsafeHessianInputReadObjectMethod` and `BurlapInputReadObjectMethod` in the module `semmle.code.java.frameworks.HessianBurlap` have been deprecated and will be removed in a future release.
* The class `YamlBeansReaderReadMethod` in the module `semmle.code.java.frameworks.YamlBeans` has been deprecated and will be removed in a future release.
* The class `MethodApacheSerializationUtilsDeserialize` in the module `semmle.code.java.frameworks.apache.Lang` has been deprecated and will be removed in a future release.

8
java/ql/lib/semmle/code/java/frameworks/Castor.qll
View File

@@ -9,20 +9,16 @@ deprecated module;
import java
/**
* DEPRECATED: Now modeled using data extensions instead.
*
* The class `org.exolab.castor.xml.Unmarshaller`.
*/
deprecated class CastorUnmarshaller extends RefType {
class CastorUnmarshaller extends RefType {
CastorUnmarshaller() { this.hasQualifiedName("org.exolab.castor.xml", "Unmarshaller") }
}
/**
* DEPRECATED: Now modeled using data extensions instead.
*
* A method with the name `unmarshal` declared in `org.exolab.castor.xml.Unmarshaller`.
*/
deprecated class CastorUnmarshalMethod extends Method {
class CastorUnmarshalMethod extends Method {
CastorUnmarshalMethod() {
this.getDeclaringType() instanceof CastorUnmarshaller and
this.getName() = "unmarshal"

8
java/ql/lib/semmle/code/java/frameworks/JYaml.qll
View File

@@ -9,20 +9,16 @@ deprecated module;
import java
/**
* DEPRECATED: Now modeled using data extensions instead.
*
* The class `org.ho.yaml.Yaml` or `org.ho.yaml.YamlConfig`.
*/
deprecated class JYamlLoader extends RefType {
class JYamlLoader extends RefType {
JYamlLoader() { this.hasQualifiedName("org.ho.yaml", ["Yaml", "YamlConfig"]) }
}
/**
* DEPRECATED: Now modeled using data extensions instead.
*
* A JYaml unsafe load method, declared on either `Yaml` or `YamlConfig`.
*/
deprecated class JYamlLoaderUnsafeLoadMethod extends Method {
class JYamlLoaderUnsafeLoadMethod extends Method {
JYamlLoaderUnsafeLoadMethod() {
this.getDeclaringType() instanceof JYamlLoader and
this.getName() in ["load", "loadType", "loadStream", "loadStreamOfType"]