mirror of
https://github.com/github/codeql.git
synced 2025-12-28 14:46:33 +01:00
a6e039b284
Add stubs for jackson-databind-2.10. Based on http://fasterxml.github.io/jackson-databind/javadoc/2.10. Test taint through Jackson serialization APIs.
18 lines
526 B
Plaintext
18 lines
526 B
Plaintext
import semmle.code.java.dataflow.DataFlow
|
|
import semmle.code.java.dataflow.TaintTracking
|
|
import semmle.code.java.dataflow.FlowSources
|
|
|
|
class Conf extends TaintTracking::Configuration {
|
|
Conf() { this = "qltest:dataflow:jackson" }
|
|
|
|
override predicate isSource(DataFlow::Node source) {
|
|
source.asExpr().(MethodAccess).getMethod().hasName("taint")
|
|
}
|
|
|
|
override predicate isSink(DataFlow::Node sink) { any() }
|
|
}
|
|
|
|
from DataFlow::Node source, DataFlow::Node sink, Conf config
|
|
where config.hasFlow(source, sink)
|
|
select sink
|