Merge branch 'unsafe-jackson-deserialization' of github.com:artem-smotrakov/ql into unsafe-jackson-deserialization

Author: artem-smotrakov

java/ql/src/semmle/code/java/frameworks/JacksonQuery.qll

@@ -64,15 +64,15 @@ private class ObjectMapperReadQualifier extends DataFlow::ExprNode {
 /** A source that sets a type validator. */
 private class SetPolymorphicTypeValidatorSource extends DataFlow::ExprNode {
   SetPolymorphicTypeValidatorSource() {
-    exists(MethodAccess ma, Method m, Expr q | m = ma.getMethod() and q = ma.getQualifier() |
+    exists(MethodAccess ma, Method m | m = ma.getMethod() |
       (
         m.getDeclaringType() instanceof ObjectMapper and
         m.hasName("setPolymorphicTypeValidator")
         or
         m.getDeclaringType() instanceof MapperBuilder and
         m.hasName("polymorphicTypeValidator")
       ) and
-      this.asExpr() = q
+      this.asExpr() = ma.getQualifier()
     )
   }
 }
@@ -120,7 +120,7 @@ class EnableJacksonDefaultTypingConfig extends DataFlow2::Configuration {
 }
 
 /**
- * Tracks flow from calls, which set a type validator, to a subsequent Jackson deserialization method call,
+ * Tracks flow from calls which set a type validator to a subsequent Jackson deserialization method call,
  * including across builder method calls.
  *
  * Such a Jackson deserialization method call is safe because validation will likely prevent instantiating unexpected types.