CodeQL library for Java/Kotlin
codeql/java-all 0.9.0 (changelog, source)
Search

Predicate createJacksonTreeNodeStep

Holds if fromNode to toNode is a dataflow step that creates a Jackson TreeNode.

These are parse trees of user-supplied JSON, which may lead to arbitrary code execution if passed to an unsafely-configured ObjectMapper’s treeToValue method.

Import path

import semmle.code.java.frameworks.Jackson
predicate createJacksonTreeNodeStep(Node fromNode, Node toNode)