io.codemodder.codemods.harden-xstream.yaml Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of core-codemods Show documentation

Codemods for fixing common errors across many Java projects

There is a newer version: 0.97.3

rules:
  - id: harden-xstream
    patterns:
      - pattern: $X = new XStream(...);
      - pattern-not-inside: |
          $RETURNTYPE $METHOD(...) {
            ...
            $X.registerConverter(...);
            ...
          }
      - pattern-not-inside: |
          $RETURNTYPE $METHOD(...) {
            ...
            $X.allowTypes(...);
            ...
          }
      - pattern-not-inside: |
          $RETURNTYPE $METHOD(...) {
            ...
            $X.denyTypes(...);
            ...
          }
      - pattern-not-inside: |
          $RETURNTYPE $METHOD(...) {
            ...
            $X.denyTypesByWildcard(...);
            ...
          }
      - focus-metavariable: $X
    message: Semgrep found a match
    languages:
      - java
    severity: WARNING