hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 19:26:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

JacksonCreateParserMethod converted to CSV summay model

Browse Source
This commit is contained in:
Tony Torralba
2021-07-29 15:19:30 +02:00
parent b20d53cfd4
commit d9fb650dfb
1 changed files with 4 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
java/ql/src/semmle/code/java/frameworks/jackson/JacksonSerializability.qll
View File

@@ -67,23 +67,6 @@ private class JacksonReadValueMethod extends Method, TaintPreservingCallable {
override predicate returnsTaintFrom(int arg) { arg = 0 } override predicate returnsTaintFrom(int arg) { arg = 0 }
} }
/**
* A method used for creating a `JsonParser` object using Jackson. The first parameter is the object to
* create the `JsonParser` from.
*/
private class JacksonCreateParserMethod extends Method, TaintPreservingCallable {
JacksonCreateParserMethod() {
(
getDeclaringType().hasQualifiedName("com.fasterxml.jackson.core", "JsonFactory") or
getDeclaringType().hasQualifiedName("com.fasterxml.jackson.databind", "ObjectMapper") or
getDeclaringType().hasQualifiedName("com.fasterxml.jackson.databind", "ObjectReader")
) and
hasName("createParser")
}
override predicate returnsTaintFrom(int arg) { arg = 0 }
}
/** A type whose values are explicitly serialized in a call to a Jackson method. */ /** A type whose values are explicitly serialized in a call to a Jackson method. */
private class ExplicitlyWrittenJacksonSerializableType extends JacksonSerializableType { private class ExplicitlyWrittenJacksonSerializableType extends JacksonSerializableType {
ExplicitlyWrittenJacksonSerializableType() { ExplicitlyWrittenJacksonSerializableType() {
@@ -302,7 +285,10 @@ private class JacksonModel extends SummaryModelCsv {
[ [
"com.fasterxml.jackson.databind;ObjectMapper;true;valueToTree;;;Argument[0];ReturnValue;taint", "com.fasterxml.jackson.databind;ObjectMapper;true;valueToTree;;;Argument[0];ReturnValue;taint",
"com.fasterxml.jackson.databind;ObjectMapper;true;valueToTree;;;MapValue of Argument[0];ReturnValue;taint", "com.fasterxml.jackson.databind;ObjectMapper;true;valueToTree;;;MapValue of Argument[0];ReturnValue;taint",
"com.fasterxml.jackson.databind;ObjectMapper;true;convertValue;;;Argument[0];ReturnValue;taint" "com.fasterxml.jackson.databind;ObjectMapper;true;convertValue;;;Argument[0];ReturnValue;taint",
"com.fasterxml.jackson.databind;ObjectMapper;false;createParser;;;Argument[0];ReturnValue;taint",
"com.fasterxml.jackson.databind;ObjectMapper;false;createParser;;;Argument[0];ReturnValue;taint",
"com.fasterxml.jackson.core;JsonFactory;false;createParser;;;Argument[0];ReturnValue;taint"
] ]
} }
} }