suggestions in list format

Author: coadaflorin

java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp

@@ -37,55 +37,43 @@ protection measures.
 <p>
 Recommendations specific to particular frameworks supported by this query:
 </p>
-<table>
-    <tbody>
-        <tr>
-            <th>Project</th>
-            <th>Maven Coordinates</th>
-            <th>Secure by Default</th>
-            <th>Recommendation</th>
-        </tr>
-            <tr>
-            <td>XMLDecoder</td>
-            <td>Java Standard Library</td>
-            <td>No</td>
-            <td>Do not use with untrusted user input.</td>
-        </tr>
-        <tr>
-            <td>ObjectInputStream</td>
-            <td>Java Standard Library</td>
-            <td>No</td>
-            <td>Use a validating input stream, such as  <code>org.apache.commons.io.serialization.ValidatingObjectInputStream</code>.</td>
-        </tr>
-            <tr>
-            <td>FastJson</td>
-            <td>com.alibaba:fastjson</td>
-            <td>Partially</td>
-            <td>Call <code>com.alibaba.fastjson.parser.ParserConfig#setSafeMode</code> with the argument <code>true</code> before deserializing untrusted data.</td>
-        </tr>
-        <tr>
-            <td>SnakeYAML</td>
-            <td>org.yaml:snakeyaml</td>
-            <td><a href="https://bitbucket.org/snakeyaml/snakeyaml/wiki/CVE%20&amp;%20NIST.md">No</a> (<a href="https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in">maintainer response</a>)</td>
-            <td>Pass an instance of <code>org.yaml.snakeyaml.constructor.SafeConstructor</code> to  <code>org.yaml.snakeyaml.Yaml</code>'s constructor before using it to deserialize untrusted data.</td>
-        </tr>
-        <tr>
-            <td>FasterXML jackson-databind</td>
-            <td>com.fasterxml.jackson.core:jackson-databind</td>
-            <td>Yes</td>
-            <td>
-                Don't call <code>com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping</code> and don't annotate any object fields with <code>@JsonTypeInfo(CLASS) or @JsonTypeInfo(MINIMAL_CLASS)</code> if untrusted data may be deserialized.
-                Read <a href="https://cowtowncoder.medium.com/jackson-2-10-safe-default-typing-2d018f0ce2ba">this guide</a>.
-            </td>
-        </tr>
-        <tr>
-            <td>Kryo</td>
-            <td>com.esotericsoftware:kryo and com.esotericsoftware:kryo5</td>
-            <td>com.esotericsoftware:kryo >= 5.0.0 and com.esotericsoftware:kryo5 Yes</td>
-            <td>Don't call <code>com.esotericsoftware.kryo(5).Kryo#setRegistrationRequired</code> with the argument <code>false</code> on any <code>Kryo</code> instance that may deserialize untrusted data.</td>
-        </tr>
-    </tbody>
-</table>
+<p><b>FastJson</b> - <code>com.alibaba:fastjson</code></p>
+    <ul>
+        <li><b>Secure by Default</b>: Partially</li>
+        <li><b>Recommendation</b>: Call <code>com.alibaba.fastjson.parser.ParserConfig#setSafeMode</code> with the argument <code>true</code> before deserializing untrusted data.</li>
+    </ul>
+<p></p>
+<p><b>FasterXML</b> -  <code>com.fasterxml.jackson.core:jackson-databind</code></p>
+    <ul>
+        <li><b>Secure by Default</b>: Yes</li>
+        <li><b>Recommendation</b>: Don't call <code>com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping</code> and don't annotate any object fields with <code>com.fasterxml.jackson.annotation.JsonTypeInfo</code> passing either the <code>CLASS</code> or <code>MINIMAL_CLASS</code> values to the annotation.
+            Read <a href="https://cowtowncoder.medium.com/jackson-2-10-safe-default-typing-2d018f0ce2ba">this guide</a>.</li>
+    </ul>
+<p></p>
+<p><b>Kryo</b> - <code>com.esotericsoftware:kryo</code> and <code>com.esotericsoftware:kryo5</code></p>
+    <ul>
+        <li><b>Secure by Default</b>: Yes for <code>com.esotericsoftware:kryo5</code> and for <code>com.esotericsoftware:kryo</code> >= v5.0.0</li>
+        <li><b>Recommendation</b>: Don't call <code>com.esotericsoftware.kryo(5).Kryo#setRegistrationRequired</code> with the argument <code>false</code> on any <code>Kryo</code> instance that may deserialize untrusted data.</li>
+    </ul>
+<p></p>
+<p><b>ObjectInputStream</b> -  <code>Java Standard Library</code></p>
+    <ul>
+        <li><b>Secure by Default</b>: No</li>
+        <li><b>Recommendation</b>: Use a validating input stream, such as  <code>org.apache.commons.io.serialization.ValidatingObjectInputStream</code>.</li>
+    </ul>
+<p></p>
+<p><b>SnakeYAML</b> - <code>org.yaml:snakeyaml</code></p>
+    <ul>
+        <li><b>Secure by Default</b>: No</li>
+        <li><b>Recommendation</b>: Pass an instance of <code>org.yaml.snakeyaml.constructor.SafeConstructor</code> to  <code>org.yaml.snakeyaml.Yaml</code>'s constructor before using it to deserialize untrusted data.</li>
+    </ul>
+<p></p>
+<p><b>XML Decoder</b> - <code>Standard Java Library</code></p>
+    <ul>
+        <li><b>Secure by Defauly</b>: No</li>
+        <li><b>Recommendation</b>: Do not use with untrusted user input.</li>
+    </ul>
+<p></p>
 </recommendation>
 
 <example>