diff --git a/java/ql/src/Likely Bugs/Serialization/IncorrectSerializableMethods.ql b/java/ql/src/Likely Bugs/Serialization/IncorrectSerializableMethods.ql index 60c5ac30523..815245d1a7d 100644 --- a/java/ql/src/Likely Bugs/Serialization/IncorrectSerializableMethods.ql +++ b/java/ql/src/Likely Bugs/Serialization/IncorrectSerializableMethods.ql @@ -15,15 +15,18 @@ import java from Method m, TypeSerializable serializable, string reason where + m.fromSource() and m.getDeclaringType().hasSupertype+(serializable) and ( m.hasStringSignature("readObject(ObjectInputStream)") or m.hasStringSignature("readObjectNoData()") or - m.hasName("writeObject(ObjectOutputStream)") + m.hasStringSignature("writeObject(ObjectOutputStream)") ) and ( not m.isPrivate() and reason = "Method must be private" - or m.isStatic() and reason = "Method must not be static" - or not m.getReturnType() instanceof VoidType and reason = "Return type must be void" + or + m.isStatic() and reason = "Method must not be static" + or + not m.getReturnType() instanceof VoidType and reason = "Return type must be void" ) -select m, reason +select m, "Not recognized by Java serialization framework: " + reason