Predicate createJacksonJsonParserStep

Holds if fromNode to toNode is a dataflow step that creates a Jackson parser.

For example, a createParser(userString) call yields a JsonParser, which becomes dangerous if passed to an unsafely-configured ObjectMapper’s readValue method.

Import path


                                import semmle.code.java.frameworks.Jackson


                            
                                
                                    predicate
                                
                                 
                            
                            
                                createJacksonJsonParserStep
                            
                            
                                (
                                
                                    
                                        Node
                                    
                                     
                                    fromNode
                                
                                , 
                                
                                    
                                        Node
                                    
                                     
                                    toNode
                                
                                )