CodeQL - GitHub Security Lab

Try CodeQL on LGTM.com

UnsafeDeserialization.ql

from DataFlow::PathNode source, DataFlow::PathNode sink, UnsafeDeserializationConfig conf

where conf.hasFlowPath(source, sink)

select sink.getNode().(UnsafeDeserializationSink).getMethodAccess(), source, sink,
    "Unsafe deserialization of $@.", source.getNode(), "user input"

Meet CodeQL

Run real queries on popular open source codebases using the using these instructions.

Step 2: query the code and find vulnerabilities

Clone See the documentation for more info.

$ # Clone the project
$ git clone https://github.com/m-y-mo/struts_9805


$ # Create a CodeQL database
$ codeql database create ./struts_db -s ./struts_9805 \
  -j 0 -l java --command "mvn -B -DskipTests \
  -DskipAssembly"

Query open source codebases

You can create CodeQL databases yourself for any project that's under an OSI-approved open source license. To download CodeQL and get started, Features

Company