Merge pull request #6325 from smowton/smowton/feature/org-json-models

Java: add models of JSON-java, aka `org.json`

Author: smowton

java/change-notes/2021-07-19-json-java.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added models of the JSON-java library, also known by its package name `org.json`. This may lead to detection of more issues whenever JSON deserialization is involved in a relevant dataflow path.

java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll

@@ -85,6 +85,7 @@ private module Frameworks {
   private import semmle.code.java.frameworks.jackson.JacksonSerializability
   private import semmle.code.java.frameworks.JavaxJson
   private import semmle.code.java.frameworks.JaxWS
+  private import semmle.code.java.frameworks.JsonJava
   private import semmle.code.java.frameworks.Optional
   private import semmle.code.java.frameworks.spring.SpringCache
   private import semmle.code.java.frameworks.spring.SpringHttp