Java: Improve IncorrectSerializableMethods.ql; address review comments

Marcono1234 · Marcono1234 · commit ba0dbd58718e · 2021-10-11T14:29:10.000+02:00
diff --git a/java/ql/src/Likely Bugs/Serialization/IncorrectSerializableMethods.ql b/java/ql/src/Likely Bugs/Serialization/IncorrectSerializableMethods.ql
@@ -15,15 +15,18 @@ import java
 
 from Method m, TypeSerializable serializable, string reason
 where
+  m.fromSource() and
   m.getDeclaringType().hasSupertype+(serializable) and
   (
     m.hasStringSignature("readObject(ObjectInputStream)") or
     m.hasStringSignature("readObjectNoData()") or
-    m.hasName("writeObject(ObjectOutputStream)")
+    m.hasStringSignature("writeObject(ObjectOutputStream)")
   ) and
   (
     not m.isPrivate() and reason = "Method must be private"
-    or m.isStatic() and reason = "Method must not be static"
-    or not m.getReturnType() instanceof VoidType and reason = "Return type must be void"
+    or
+    m.isStatic() and reason = "Method must not be static"
+    or
+    not m.getReturnType() instanceof VoidType and reason = "Return type must be void"
   )
-select m, reason
+select m, "Not recognized by Java serialization framework: " + reason
