new deserialization sink

Author: pwntester

java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll

@@ -414,6 +414,14 @@ private predicate argToMethodStep(Expr tracked, MethodAccess sink) {
  * `arg`th argument is tainted.
  */
 private predicate taintPreservingArgumentToMethod(Method method, int arg) {
+  (
+    method.getDeclaringType().hasQualifiedName("org.apache.wicket.util.crypt", "Base64") and
+    (
+      method.getName().matches("decode%") and arg = 0 or
+      method.getName().matches("encode%") and arg = 0
+    )
+  )
+  or
   (
     method.getDeclaringType().hasQualifiedName("java.util", "Base64$Encoder") or
     method.getDeclaringType().hasQualifiedName("java.util", "Base64$Decoder") or

java/ql/src/semmle/code/java/frameworks/apache/Lang.qll

@@ -10,3 +10,13 @@ class TypeApacheRandomStringUtils extends Class {
     hasQualifiedName("org.apache.commons.lang3", "RandomStringUtils")
   }
 }
+
+class MethodApacheSerializationUtilsDeserialize extends Method {
+  MethodApacheSerializationUtilsDeserialize() {
+    (
+      this.getDeclaringType().hasQualifiedName("org.apache.commons.lang", "SerializationUtils") or
+      this.getDeclaringType().hasQualifiedName("org.apache.commons.lang3", "SerializationUtils")
+    ) and
+    this.hasName("deserialize")
+  }
+}

java/ql/src/semmle/code/java/security/UnsafeDeserialization.qll

@@ -1,6 +1,7 @@
 import semmle.code.java.frameworks.Kryo
 import semmle.code.java.frameworks.XStream
 import semmle.code.java.frameworks.SnakeYaml
+import semmle.code.java.frameworks.apache.Lang
 
 class ObjectInputStreamReadObjectMethod extends Method {
   ObjectInputStreamReadObjectMethod() {
@@ -71,6 +72,9 @@ predicate unsafeDeserialization(MethodAccess ma, Expr sink) {
     sink = ma.getAnArgument() and
     not exists(SafeKryo sk | sk.hasFlowToExpr(ma.getQualifier()))
     or
+    m instanceof MethodApacheSerializationUtilsDeserialize and
+    sink = ma.getArgument(0)
+    or
     ma instanceof UnsafeSnakeYamlParse and
     sink = ma.getArgument(0)
   )