Java/UnsafeDeserializationQuery

d10c · d10c · commit de517aee99a1 · 2025-10-09T14:38:37.000+02:00
java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.ql
diff --git a/java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll b/java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
@@ -313,6 +313,8 @@ private module UnsafeDeserializationConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
+    result = sink.getLocation()
+    or
     result = sink.(UnsafeDeserializationSink).getMethodCall().getLocation()
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -313,6 +313,8 @@ private module UnsafeDeserializationConfig implements DataFlow::ConfigSig {`
`313`	`313`	`predicate observeDiffInformedIncrementalMode() { any() }`
`314`	`314`
`315`	`315`	`Location getASelectedSinkLocation(DataFlow::Node sink) {`
	`316`	`+ result = sink.getLocation()`
	`317`	`+ or`
`316`	`318`	`result = sink.(UnsafeDeserializationSink).getMethodCall().getLocation()`
`317`	`319`	`}`
`318`	`320`	`}`