Predicate createJacksonTreeNodeStep
Holds if fromNode
to toNode
is a dataflow step that creates a Jackson TreeNode
.
These are parse trees of user-supplied JSON, which may lead to arbitrary code execution
if passed to an unsafely-configured ObjectMapper
’s treeToValue
method.
Import path
import semmle.code.java.frameworks.Jackson
predicate
createJacksonTreeNodeStep
(
Node
fromNode
,
Node
toNode
)