CodeQL library for Java/Kotlin
codeql/java-all 1.1.0 (changelog, source)

Predicate createJacksonTreeNodeStep

Holds if fromNode to toNode is a dataflow step that creates a Jackson TreeNode.

These are parse trees of user-supplied JSON, which may lead to arbitrary code execution if passed to an unsafely-configured ObjectMapper’s treeToValue method.

Import path

predicate createJacksonTreeNodeStep(Node fromNode, Node toNode)