Update the query and add comments

Author: luchua-bc

java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.ql

@@ -72,23 +72,23 @@ class UnsafeDeserializationConfig extends TaintTracking::Configuration {
         ma.getMethod() instanceof FlexjsonDeserializeMethod or
         ma.getMethod() instanceof JoddJsonParseMethod
       ) and
-      node.asExpr() = ma.getArgument(0) and
+      node.asExpr() = ma.getAnArgument() and
       (
         ma.getArgument(1)
             .(TypeLiteral)
             .getType()
             .(ParameterizedType)
             .getATypeArgument()
             .(Class)
-            .isFinal()
+            .isFinal() // jodd.json.JsonParser parser = new JsonParser(); parser.allowClass("com.example.*"); parser.setClassMetadataName("class"); User obj = parser.parse(json, User.class);
         or
         exists(
           MethodAccess dma // Specified class type
         |
           dma.getMethod() instanceof DeserializerUseMethod and
           (
             ma.getQualifier() = dma or
-            ma.getQualifier().(VarAccess).getVariable().getAnAccess() = dma.getQualifier()
+            ma.getQualifier().(VarAccess).getVariable().getAnAccess() = dma.getQualifier() // new flexjson.JSONDeserializer<Person>().use(null, Person.class).deserialize(json)
           )
         )
       )

java/ql/src/semmle/code/java/frameworks/Flexjson.qll

@@ -19,7 +19,7 @@ class FlexjsonDeserializeMethod extends Method {
   FlexjsonDeserializeMethod() {
     this.getDeclaringType().getSourceDeclaration().getASourceSupertype*() instanceof
       FlexjsonDeserializer and
-    this.getName().matches("deserialize%")
+    this.getName() = ["deserialize", "deserializeInto"]
   }
 }