Module SafeObjectMapperConfig

Tracks flow from calls that set a type validator to a subsequent Jackson deserialization method call, including across builder method calls.

Such a Jackson deserialization method call is safe because validation will likely prevent instantiating unexpected types.

Import path

import semmle.code.java.security.UnsafeDeserializationQuery

isAdditionalFlowStep	Holds if `fromNode` to `toNode` is a dataflow step that configures or creates an `ObjectMapper` via a builder.
isSink	Holds if `sink` is a relevant data flow sink.
isSource	Holds if `source` is a relevant data flow source.