Skip to content

Commit 3dd851f

Browse files
haby0haby0
committed
expected
1 parent c1ada6d commit 3dd851f

File tree

1 file changed

+14
-61
lines changed

1 file changed

+14
-61
lines changed

‎java/ql/test/query-tests/security/CWE-502/UnsafeDeserialization.expected

Lines changed: 14 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,30 @@
11
edges
2-
| A.java:13:31:13:51 | getInputStream(...) : InputStream | A.java:14:50:14:60 | inputStream : InputStream |
32
| A.java:13:31:13:51 | getInputStream(...) : InputStream | A.java:15:12:15:13 | in |
4-
| A.java:14:28:14:61 | new ObjectInputStream(...) : ObjectInputStream | A.java:15:12:15:13 | in |
5-
| A.java:14:50:14:60 | inputStream : InputStream | A.java:14:28:14:61 | new ObjectInputStream(...) : ObjectInputStream |
6-
| A.java:19:31:19:51 | getInputStream(...) : InputStream | A.java:20:50:20:60 | inputStream : InputStream |
73
| A.java:19:31:19:51 | getInputStream(...) : InputStream | A.java:21:12:21:13 | in |
8-
| A.java:20:28:20:61 | new ObjectInputStream(...) : ObjectInputStream | A.java:21:12:21:13 | in |
9-
| A.java:20:50:20:60 | inputStream : InputStream | A.java:20:28:20:61 | new ObjectInputStream(...) : ObjectInputStream |
10-
| A.java:25:31:25:51 | getInputStream(...) : InputStream | A.java:26:35:26:45 | inputStream : InputStream |
11-
| A.java:26:20:26:46 | new XMLDecoder(...) : XMLDecoder | A.java:27:12:27:12 | d |
12-
| A.java:26:35:26:45 | inputStream : InputStream | A.java:26:20:26:46 | new XMLDecoder(...) : XMLDecoder |
13-
| A.java:32:31:32:51 | getInputStream(...) : InputStream | A.java:33:43:33:53 | inputStream : InputStream |
14-
| A.java:33:21:33:54 | new InputStreamReader(...) : InputStreamReader | A.java:34:23:34:28 | reader |
15-
| A.java:33:43:33:53 | inputStream : InputStream | A.java:33:21:33:54 | new InputStreamReader(...) : InputStreamReader |
16-
| A.java:39:19:39:50 | new Input(...) : Input | A.java:40:28:40:32 | input |
17-
| A.java:39:19:39:50 | new Input(...) : Input | A.java:41:34:41:38 | input |
18-
| A.java:39:19:39:50 | new Input(...) : Input | A.java:42:40:42:44 | input |
19-
| A.java:39:29:39:49 | getInputStream(...) : InputStream | A.java:39:19:39:50 | new Input(...) : Input |
4+
| A.java:25:31:25:51 | getInputStream(...) : InputStream | A.java:27:12:27:12 | d |
5+
| A.java:32:31:32:51 | getInputStream(...) : InputStream | A.java:34:23:34:28 | reader |
6+
| A.java:39:29:39:49 | getInputStream(...) : InputStream | A.java:40:28:40:32 | input |
7+
| A.java:39:29:39:49 | getInputStream(...) : InputStream | A.java:41:34:41:38 | input |
8+
| A.java:39:29:39:49 | getInputStream(...) : InputStream | A.java:42:40:42:44 | input |
209
| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:61:26:61:30 | input |
2110
| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:62:30:62:34 | input |
22-
| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:63:50:63:54 | input : InputStream |
11+
| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:63:28:63:55 | new InputStreamReader(...) |
2312
| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:64:24:64:28 | input |
24-
| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:65:46:65:50 | input : InputStream |
25-
| A.java:63:50:63:54 | input : InputStream | A.java:63:28:63:55 | new InputStreamReader(...) |
26-
| A.java:65:46:65:50 | input : InputStream | A.java:65:24:65:51 | new InputStreamReader(...) |
13+
| A.java:60:25:60:45 | getInputStream(...) : InputStream | A.java:65:24:65:51 | new InputStreamReader(...) |
2714
| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:71:26:71:30 | input |
2815
| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:72:30:72:34 | input |
29-
| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:73:50:73:54 | input : InputStream |
16+
| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:73:28:73:55 | new InputStreamReader(...) |
3017
| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:74:24:74:28 | input |
31-
| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:75:46:75:50 | input : InputStream |
32-
| A.java:73:50:73:54 | input : InputStream | A.java:73:28:73:55 | new InputStreamReader(...) |
33-
| A.java:75:46:75:50 | input : InputStream | A.java:75:24:75:51 | new InputStreamReader(...) |
18+
| A.java:70:25:70:45 | getInputStream(...) : InputStream | A.java:75:24:75:51 | new InputStreamReader(...) |
3419
| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:91:26:91:30 | input |
3520
| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:92:30:92:34 | input |
36-
| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:93:50:93:54 | input : InputStream |
21+
| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:93:28:93:55 | new InputStreamReader(...) |
3722
| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:94:24:94:28 | input |
38-
| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:95:46:95:50 | input : InputStream |
39-
| A.java:93:50:93:54 | input : InputStream | A.java:93:28:93:55 | new InputStreamReader(...) |
40-
| A.java:95:46:95:50 | input : InputStream | A.java:95:24:95:51 | new InputStreamReader(...) |
23+
| A.java:90:25:90:45 | getInputStream(...) : InputStream | A.java:95:24:95:51 | new InputStreamReader(...) |
4124
| B.java:7:31:7:51 | getInputStream(...) : InputStream | B.java:8:29:8:39 | inputStream |
42-
| B.java:12:31:12:51 | getInputStream(...) : InputStream | B.java:14:5:14:15 | inputStream : InputStream |
43-
| B.java:14:5:14:15 | inputStream : InputStream | B.java:14:22:14:26 | bytes [post update] : byte[] |
44-
| B.java:14:22:14:26 | bytes [post update] : byte[] | B.java:15:23:15:27 | bytes |
45-
| B.java:19:31:19:51 | getInputStream(...) : InputStream | B.java:21:5:21:15 | inputStream : InputStream |
46-
| B.java:21:5:21:15 | inputStream : InputStream | B.java:21:22:21:26 | bytes [post update] : byte[] |
47-
| B.java:21:22:21:26 | bytes [post update] : byte[] | B.java:23:29:23:29 | s |
48-
| B.java:27:31:27:51 | getInputStream(...) : InputStream | B.java:29:5:29:15 | inputStream : InputStream |
49-
| B.java:29:5:29:15 | inputStream : InputStream | B.java:29:22:29:26 | bytes [post update] : byte[] |
50-
| B.java:29:22:29:26 | bytes [post update] : byte[] | B.java:31:23:31:23 | s |
25+
| B.java:12:31:12:51 | getInputStream(...) : InputStream | B.java:15:23:15:27 | bytes |
26+
| B.java:19:31:19:51 | getInputStream(...) : InputStream | B.java:23:29:23:29 | s |
27+
| B.java:27:31:27:51 | getInputStream(...) : InputStream | B.java:31:23:31:23 | s |
5128
| C.java:23:17:23:44 | getParameter(...) : String | C.java:24:13:24:16 | data |
5229
| C.java:23:17:23:44 | getParameter(...) : String | C.java:25:19:25:22 | data |
5330
| C.java:23:17:23:44 | getParameter(...) : String | C.java:26:25:26:28 | data |
@@ -69,26 +46,15 @@ edges
6946
| C.java:84:27:84:54 | getParameter(...) : String | C.java:87:3:87:13 | burlapInput |
7047
| C.java:84:27:84:54 | getParameter(...) : String | C.java:91:3:91:14 | burlapInput1 |
7148
| TestMessageBodyReader.java:20:55:20:78 | entityStream : InputStream | TestMessageBodyReader.java:22:18:22:52 | new ObjectInputStream(...) |
72-
| TestMessageBodyReader.java:20:55:20:78 | entityStream : InputStream | TestMessageBodyReader.java:22:40:22:51 | entityStream : InputStream |
73-
| TestMessageBodyReader.java:22:40:22:51 | entityStream : InputStream | TestMessageBodyReader.java:22:18:22:52 | new ObjectInputStream(...) |
7449
nodes
7550
| A.java:13:31:13:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
76-
| A.java:14:28:14:61 | new ObjectInputStream(...) : ObjectInputStream | semmle.label | new ObjectInputStream(...) : ObjectInputStream |
77-
| A.java:14:50:14:60 | inputStream : InputStream | semmle.label | inputStream : InputStream |
7851
| A.java:15:12:15:13 | in | semmle.label | in |
7952
| A.java:19:31:19:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
80-
| A.java:20:28:20:61 | new ObjectInputStream(...) : ObjectInputStream | semmle.label | new ObjectInputStream(...) : ObjectInputStream |
81-
| A.java:20:50:20:60 | inputStream : InputStream | semmle.label | inputStream : InputStream |
8253
| A.java:21:12:21:13 | in | semmle.label | in |
8354
| A.java:25:31:25:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
84-
| A.java:26:20:26:46 | new XMLDecoder(...) : XMLDecoder | semmle.label | new XMLDecoder(...) : XMLDecoder |
85-
| A.java:26:35:26:45 | inputStream : InputStream | semmle.label | inputStream : InputStream |
8655
| A.java:27:12:27:12 | d | semmle.label | d |
8756
| A.java:32:31:32:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
88-
| A.java:33:21:33:54 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader |
89-
| A.java:33:43:33:53 | inputStream : InputStream | semmle.label | inputStream : InputStream |
9057
| A.java:34:23:34:28 | reader | semmle.label | reader |
91-
| A.java:39:19:39:50 | new Input(...) : Input | semmle.label | new Input(...) : Input |
9258
| A.java:39:29:39:49 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
9359
| A.java:40:28:40:32 | input | semmle.label | input |
9460
| A.java:41:34:41:38 | input | semmle.label | input |
@@ -97,39 +63,27 @@ nodes
9763
| A.java:61:26:61:30 | input | semmle.label | input |
9864
| A.java:62:30:62:34 | input | semmle.label | input |
9965
| A.java:63:28:63:55 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
100-
| A.java:63:50:63:54 | input : InputStream | semmle.label | input : InputStream |
10166
| A.java:64:24:64:28 | input | semmle.label | input |
10267
| A.java:65:24:65:51 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
103-
| A.java:65:46:65:50 | input : InputStream | semmle.label | input : InputStream |
10468
| A.java:70:25:70:45 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
10569
| A.java:71:26:71:30 | input | semmle.label | input |
10670
| A.java:72:30:72:34 | input | semmle.label | input |
10771
| A.java:73:28:73:55 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
108-
| A.java:73:50:73:54 | input : InputStream | semmle.label | input : InputStream |
10972
| A.java:74:24:74:28 | input | semmle.label | input |
11073
| A.java:75:24:75:51 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
111-
| A.java:75:46:75:50 | input : InputStream | semmle.label | input : InputStream |
11274
| A.java:90:25:90:45 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
11375
| A.java:91:26:91:30 | input | semmle.label | input |
11476
| A.java:92:30:92:34 | input | semmle.label | input |
11577
| A.java:93:28:93:55 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
116-
| A.java:93:50:93:54 | input : InputStream | semmle.label | input : InputStream |
11778
| A.java:94:24:94:28 | input | semmle.label | input |
11879
| A.java:95:24:95:51 | new InputStreamReader(...) | semmle.label | new InputStreamReader(...) |
119-
| A.java:95:46:95:50 | input : InputStream | semmle.label | input : InputStream |
12080
| B.java:7:31:7:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
12181
| B.java:8:29:8:39 | inputStream | semmle.label | inputStream |
12282
| B.java:12:31:12:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
123-
| B.java:14:5:14:15 | inputStream : InputStream | semmle.label | inputStream : InputStream |
124-
| B.java:14:22:14:26 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
12583
| B.java:15:23:15:27 | bytes | semmle.label | bytes |
12684
| B.java:19:31:19:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
127-
| B.java:21:5:21:15 | inputStream : InputStream | semmle.label | inputStream : InputStream |
128-
| B.java:21:22:21:26 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
12985
| B.java:23:29:23:29 | s | semmle.label | s |
13086
| B.java:27:31:27:51 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
131-
| B.java:29:5:29:15 | inputStream : InputStream | semmle.label | inputStream : InputStream |
132-
| B.java:29:22:29:26 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
13387
| B.java:31:23:31:23 | s | semmle.label | s |
13488
| C.java:23:17:23:44 | getParameter(...) : String | semmle.label | getParameter(...) : String |
13589
| C.java:24:13:24:16 | data | semmle.label | data |
@@ -160,7 +114,6 @@ nodes
160114
| C.java:91:3:91:14 | burlapInput1 | semmle.label | burlapInput1 |
161115
| TestMessageBodyReader.java:20:55:20:78 | entityStream : InputStream | semmle.label | entityStream : InputStream |
162116
| TestMessageBodyReader.java:22:18:22:52 | new ObjectInputStream(...) | semmle.label | new ObjectInputStream(...) |
163-
| TestMessageBodyReader.java:22:40:22:51 | entityStream : InputStream | semmle.label | entityStream : InputStream |
164117
#select
165118
| A.java:15:12:15:26 | readObject(...) | A.java:13:31:13:51 | getInputStream(...) : InputStream | A.java:15:12:15:13 | in | Unsafe deserialization of $@. | A.java:13:31:13:51 | getInputStream(...) | user input |
166119
| A.java:21:12:21:28 | readUnshared(...) | A.java:19:31:19:51 | getInputStream(...) : InputStream | A.java:21:12:21:13 | in | Unsafe deserialization of $@. | A.java:19:31:19:51 | getInputStream(...) | user input |

0 commit comments

Comments
 (0)