-
Notifications
You must be signed in to change notification settings - Fork 1.9k
[Java] Fix Kryo FP & Kryo 5 Support #5843
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Java] Fix Kryo FP & Kryo 5 Support #5843
Conversation
fdbd9c3 to
73787ac
Compare
73787ac to
67e9f06
Compare
| private import semmle.code.java.dataflow.FlowSteps | ||
|
|
||
| /** | ||
| * The type `com.esotericsoftware.kryo.Kryo`. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should the other package name be mentioned here as well, or should the package name could just be removed?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@smowton what do you think? I could go either way on this. But in general, this sounds like just duplicate information. Thoughts?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For reference, the kryo and kryo5 packages seem to contain exactly the same content, see EsotericSoftware/kryo#652.
java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll
Outdated
Show resolved
Hide resolved
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
Closes #4992