Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update tests for
server-dangerous-object-deserialization
rule
I'm making a change to the Semgrep Pro Engine which will correctly model the fact that `java.lang.Object` is at the top of any inheritance hierarchy in Java. As such, the pattern `Object $X` will match any object type, including the `String` types previously used in the tests here. I'm removing those types so that this test has the same behavior in OSS and Pro. In general, we do want the Pro Engine, when presented with a pattern `(Foo $X)`, to also match any subtypes of `Foo`. According to Pieter, this is desired behavior for this rule. If that turns out to be incorrect, we could use `metavariable-regex` to match only parameters that take exactly `Object`, instead of parameters that take any subtype of `Object`.
- Loading branch information