private boolean hasCustomReadObject ( Method m , ClassContext classContext , List < String > classesToIgnore ) throws CFGBuilderException , DataflowAnalysisException { ConstantPoolGen cpg = classContext . getConstantPoolGen ( ) ; CFG cfg = classContext . getCFG ( m ) ; int count = 0 ; for ( Iterator < Location > i = cfg . locationIterator ( ) ; i . hasNext ( ) ; ) { Location location = i . next ( ) ; Instruction inst = location . getHandle ( ) . getInstruction ( ) ; //ByteCode.printOpCode(inst,cpg); if ( inst instanceof InvokeInstruction ) { InvokeInstruction invoke = ( InvokeInstruction ) inst ; if ( ! READ_DESERIALIZATION_METHODS . contains ( invoke . getMethodName ( cpg ) ) && ! classesToIgnore . contains ( invoke . getClassName ( cpg ) ) ) { count += 1 ; } } } return count > 3 ; }
Check if the readObject is doing multiple external call beyond the basic readByte readBoolean etc ..