FilesExpand file tree

main

/

Flexjson.qll

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

36 lines (31 loc) · 1.18 KB

main

/

Flexjson.qll

Copy path

Top

File metadata and controls

• Code
• Blame

36 lines (31 loc) · 1.18 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

/**

* Provides classes for working with the Flexjson framework.

*/

overlay[local?]

module;

import java

/** The class `flexjson.JSONDeserializer`. */

class FlexjsonDeserializer extends RefType {

FlexjsonDeserializer() { this.hasQualifiedName("flexjson", "JSONDeserializer") }

}

/** The class `flexjson.ObjectFactory`. */

class FlexjsonObjectFactory extends RefType {

FlexjsonObjectFactory() { this.hasQualifiedName("flexjson", "ObjectFactory") }

}

/** The deserialization method `deserialize`. */

class FlexjsonDeserializeMethod extends Method {

FlexjsonDeserializeMethod() {

this.getDeclaringType().getSourceDeclaration().getASourceSupertype*() instanceof

FlexjsonDeserializer and

this.getName() = "deserialize" and

not this.getAParameter().getType() instanceof FlexjsonObjectFactory // deserialization method with specified class types in object factory is unlikely to be vulnerable

}

}

/** The method `use` to configure allowed class type. */

class FlexjsonDeserializerUseMethod extends Method {

FlexjsonDeserializerUseMethod() {

this.getDeclaringType().getSourceDeclaration().getASourceSupertype*() instanceof

FlexjsonDeserializer and

this.hasName("use")

}

}