python/ruby/javascript: add machinery for simple MaD sanitizers

- add `barrierNode` to ApiGraphModels which takes MaD barreirs into account
- add `sourceNode` and `sinkNode` which operate on `DataFlow::Node`s for convenience
- use the convenience predicates throughout
- add support for parameterized barrier nodes where needed

Author: yoff

javascript/ql/lib/semmle/javascript/dataflow/internal/BarrierGuards.qll

@@ -36,6 +36,30 @@ module MakeBarrierGuard<BarrierGuardSig BaseGuard> {
   }
 }
 
+module ExternalBarrierGuard {
+  private predicate guardCheck(DataFlow::Node g, Expr e, boolean branch, string kind) {
+    exists(API::CallNode call, API::Node parameter |
+      parameter = call.getAParameter() and
+      parameter = ModelOutput::getABarrierGuardNode(kind, branch)
+    |
+      g = call and
+      e = parameter.asSink().asExpr()
+    )
+  }
+
+  class BarrierGuard extends DataFlow::Node {
+    BarrierGuard() { guardCheck(this, _, _, _) }
+
+    predicate blocksExpr(boolean outcome, Expr e, string kind) {
+      guardCheck(this, e, outcome, kind)
+    }
+  }
+
+  DataFlow::Node getAnExternalBarrierNode(string kind) {
+    result = MakeStateBarrierGuard<string, BarrierGuard>::getABarrierNode(kind)
+  }
+}
+
 deprecated private module DeprecationWrapper {
   signature class LabeledBarrierGuardSig extends DataFlow::Node {
     /**

javascript/ql/lib/semmle/javascript/frameworks/Credentials.qll

@@ -29,7 +29,7 @@ module CredentialsExpr {
 private class CredentialsFromModel extends CredentialsNode {
   string kind;
 
-  CredentialsFromModel() { this = ModelOutput::getASinkNode("credentials-" + kind).asSink() }
+  CredentialsFromModel() { ModelOutput::sinkNode(this, "credentials-" + kind) }
 
   override string getCredentialsKind() { result = CredentialsExpr::normalizeKind(kind) }
 }

javascript/ql/lib/semmle/javascript/frameworks/NoSQL.qll

@@ -13,7 +13,7 @@ module NoSql {
   }
 
   private class QueryFromModel extends Query {
-    QueryFromModel() { this = ModelOutput::getASinkNode("nosql-injection").asSink() }
+    QueryFromModel() { ModelOutput::sinkNode(this, "nosql-injection") }
   }
 }
 
@@ -46,7 +46,7 @@ private module MongoDB {
 
     override DataFlow::Node getAQueryArgument() {
       result = [this.getAnArgument(), this.getOptionArgument(_, _)] and
-      result = ModelOutput::getASinkNode("mongodb.sink").asSink()
+      ModelOutput::sinkNode(result, "mongodb.sink")
     }
 
     override DataFlow::Node getAResult() {

javascript/ql/lib/semmle/javascript/frameworks/SQL.qll

@@ -9,7 +9,7 @@ module SQL {
   abstract class SqlString extends DataFlow::Node { }
 
   private class SqlStringFromModel extends SqlString {
-    SqlStringFromModel() { this = ModelOutput::getASinkNode("sql-injection").asSink() }
+    SqlStringFromModel() { ModelOutput::sinkNode(this, "sql-injection") }
   }
 
   /**

javascript/ql/lib/semmle/javascript/frameworks/data/ModelsAsData.qll

@@ -30,7 +30,7 @@ import Shared::ModelOutput as ModelOutput
  * A remote flow source originating from a MaD source row.
  */
 private class RemoteFlowSourceFromMaD extends RemoteFlowSource {
-  RemoteFlowSourceFromMaD() { this = ModelOutput::getASourceNode("remote").asSource() }
+  RemoteFlowSourceFromMaD() { ModelOutput::sourceNode(this, "remote") }
 
   override string getSourceType() { result = "Remote flow" }
 }
@@ -39,9 +39,9 @@ private class RemoteFlowSourceFromMaD extends RemoteFlowSource {
  * A threat-model flow source originating from a data extension.
  */
 private class ThreatModelSourceFromDataExtension extends ThreatModelSource::Range {
-  ThreatModelSourceFromDataExtension() { this = ModelOutput::getASourceNode(_).asSource() }
+  ThreatModelSourceFromDataExtension() { ModelOutput::sourceNode(this, _) }
 
-  override string getThreatModel() { this = ModelOutput::getASourceNode(result).asSource() }
+  override string getThreatModel() { ModelOutput::sourceNode(this, result) }
 
   override string getSourceType() {
     result = "Source node (" + this.getThreatModel() + ") [from data-extension]"

javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll

@@ -781,7 +781,7 @@ module ModelOutput {
     }
 
     /**
-     * Holds if a barrier model contributed `barrier` with the given `kind`.
+     * Holds if a barrier model contributed `barrier` with the given `kind` for the given `branch`.
      */
     cached
     API::Node getABarrierGuardNode(string kind, boolean branch, string model) {
@@ -858,6 +858,25 @@ module ModelOutput {
     result = getABarrierGuardNode(kind, branch, _)
   }
 
+  /**
+   * Holds if `node` is specified as a source with the given kind in an external model.
+   */
+  predicate sourceNode(DataFlow::Node node, string kind) { node = getASourceNode(kind).asSource() }
+
+  /**
+   * Holds if `node` is specified as a sink with the given kind in an external model.
+   */
+  predicate sinkNode(DataFlow::Node node, string kind) { node = getASinkNode(kind).asSink() }
+
+  /**
+   * Holds if `node` is specified as a barrier with the given kind in an external model.
+   */
+  predicate barrierNode(DataFlow::Node node, string kind) {
+    node = getABarrierNode(kind).asSink()
+    or
+    node = DataFlow::ExternalBarrierGuard::getAnExternalBarrierNode(kind)
+  }
+
   private module KindValConfig implements SharedModelVal::KindValidationConfigSig {
     predicate summaryKind(string kind) { summaryModel(_, _, _, _, kind, _) }
 

javascript/ql/lib/semmle/javascript/security/CorsPermissiveConfigurationCustomizations.qll

@@ -66,7 +66,7 @@ module CorsPermissiveConfiguration {
    * The value of cors origin when initializing the application.
    */
   class CorsOriginSink extends Sink, DataFlow::ValueNode {
-    CorsOriginSink() { this = ModelOutput::getASinkNode("cors-origin").asSink() }
+    CorsOriginSink() { ModelOutput::sinkNode(this, "cors-origin") }
   }
 
   /**

javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll

@@ -268,6 +268,6 @@ module ClientSideUrlRedirect {
   }
 
   private class SinkFromModel extends Sink {
-    SinkFromModel() { this = ModelOutput::getASinkNode("url-redirection").asSink() }
+    SinkFromModel() { ModelOutput::sinkNode(this, "url-redirection") }
   }
 }

javascript/ql/lib/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll

@@ -436,6 +436,6 @@ module CodeInjection {
   class JsonStringifySanitizer extends Sanitizer, JsonStringifyCall { }
 
   private class SinkFromModel extends Sink {
-    SinkFromModel() { this = ModelOutput::getASinkNode("code-injection").asSink() }
+    SinkFromModel() { ModelOutput::sinkNode(this, "code-injection") }
   }
 }

javascript/ql/lib/semmle/javascript/security/dataflow/CommandInjectionCustomizations.qll

@@ -56,6 +56,6 @@ module CommandInjection {
   }
 
   private class SinkFromModel extends Sink {
-    SinkFromModel() { this = ModelOutput::getASinkNode("command-injection").asSink() }
+    SinkFromModel() { ModelOutput::sinkNode(this, "command-injection") }
   }
 }