CodeQL Docs: SnakeYaml is now secure by default

[JLLeitschuh]

trafficstars

https://codeql.github.com/codeql-query-help/java/java-unsafe-deserialization/

This query currently documents that SnakeYaml is currently insecure by default. As of 2.0, this is no longer the case. It's now secure by default. This should be updated in the documentation, and the query, if relevant, should also be updated.

[hvitved]

Thanks for reporting. @github/codeql-java this is one for you.

[JLLeitschuh]

If you want the full story of how this vulnerability got resolved, here's the link: https://medium.com/bugbountywriteup/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c

[owen-mc]

That seems to be correct. We will try to get around to it, though fixing FPs are not a priority at the moment. Or perhaps you could submit a PR to fix it yourself, @JLLeitschuh ?

[owen-mc]

Looking at this in more detail, it says here that in SnakeYaml 2.0 all constructors now extend SafeConstructor. Looking through the SnakeYaml documentation online, this seems to be correct. In this case, java/unsafe-deserialization should correctly not alert for any constructors for 2.0 onwards. I've made https://github.com/github/codeql/pull/20018 to update the query help.