Cleanup Jackson logic after code review

JLLeitschuh · JLLeitschuh · commit 5a68ac88efdf · 2021-05-11T10:48:22.000-04:00
diff --git a/java/ql/src/semmle/code/java/frameworks/jackson/JacksonSerializability.qll b/java/ql/src/semmle/code/java/frameworks/jackson/JacksonSerializability.qll
@@ -72,18 +72,6 @@ private class ExplicitlyWrittenJacksonSerializableType extends JacksonSerializab
   }
 }
 
-/** A type whose values are explicitly deserialized in a call to a Jackson method. */
-private class ExplicitlyReadJacksonSerializableType extends JacksonDeserializableType {
-  ExplicitlyReadJacksonSerializableType() {
-    exists(MethodAccess ma |
-      // A call to a Jackson read method...
-      ma.getMethod() instanceof JacksonReadValueMethod and
-      // ...where `this` is used in the final argument, indicating that this type will be deserialized.
-      usesType(ma.getArgument(ma.getNumArgument() - 1).getType(), this)
-    )
-  }
-}
-
 /** A type used in a `JacksonSerializableField` declaration. */
 private class FieldReferencedJacksonSerializableType extends JacksonSerializableType {
   FieldReferencedJacksonSerializableType() {
@@ -123,6 +111,13 @@ private class ExplicitlyReadJacksonDeserializableType extends JacksonDeserializa
     exists(TypeLiteralToJacksonDatabindFlowConfiguration conf |
       usesType(conf.getSourceWithFlowToJacksonDatabind().getTypeName().getType(), this)
     )
+    or
+    exists(MethodAccess ma |
+      // A call to a Jackson read method...
+      ma.getMethod() instanceof JacksonReadValueMethod and
+      // ...where `this` is used in the final argument, indicating that this type will be deserialized.
+      usesType(ma.getArgument(ma.getNumArgument() - 1).getType(), this)
+    )
   }
 }
 
diff --git a/java/ql/test/library-tests/dataflow/taint-jackson/dataFlow.ql b/java/ql/test/library-tests/dataflow/taint-jackson/dataFlow.ql
@@ -31,4 +31,4 @@ class HasFlowTest extends InlineExpectationsTest {
       value = ""
     )
   }
-}
+}
diff --git a/java/ql/test/stubs/jackson-databind-2.10/com/fasterxml/jackson/databind/JsonNode.java b/java/ql/test/stubs/jackson-databind-2.10/com/fasterxml/jackson/databind/JsonNode.java
@@ -5,4 +5,4 @@
 public abstract class JsonNode implements Iterable<JsonNode> {
     public JsonNode() {
     }
-}
+}
diff --git a/java/ql/test/stubs/jackson-databind-2.10/com/fasterxml/jackson/databind/MappingIterator.java b/java/ql/test/stubs/jackson-databind-2.10/com/fasterxml/jackson/databind/MappingIterator.java
@@ -25,4 +25,4 @@ public void remove() {
     public void close() throws IOException {
         
     }
-}
+}
diff --git a/java/ql/test/stubs/jackson-databind-2.10/com/fasterxml/jackson/databind/ObjectReader.java b/java/ql/test/stubs/jackson-databind-2.10/com/fasterxml/jackson/databind/ObjectReader.java
@@ -79,4 +79,4 @@ public <T> MappingIterator<T> readValues(Reader src, Class<T> valueType) throws
         return null;
     }
 
-}
+}

Original file line number	Diff line number	Diff line change
`@@ -31,4 +31,4 @@ class HasFlowTest extends InlineExpectationsTest {`
`31`	`31`	`value = ""`
`32`	`32`	`)`
`33`	`33`	`}`
`34`		`-}`
	`34`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -5,4 +5,4 @@`
`5`	`5`	`public abstract class JsonNode implements Iterable<JsonNode> {`
`6`	`6`	`public JsonNode() {`
`7`	`7`	`}`
`8`		`-}`
	`8`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -25,4 +25,4 @@ public void remove() {`
`25`	`25`	`public void close() throws IOException {`
`26`	`26`
`27`	`27`	`}`
`28`		`-}`
	`28`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -79,4 +79,4 @@ public <T> MappingIterator<T> readValues(Reader src, Class<T> valueType) throws`
`79`	`79`	`return null;`
`80`	`80`	`}`
`81`	`81`
`82`		`-}`
	`82`	`+}`