Convert BrowserInjectionObjectQuery.ql to use the new dataflow API

Author: Jami Cogswell

javascript/src/audit/browserAPI/BrowserInjectionObjectQuery.ql

@@ -9,55 +9,58 @@
  * @tags security
  */
 
-
  import javascript
- import DataFlow::PathGraph
+ import ConfigFlow::PathGraph
  import browserextension.BrowserInjectionObjectCustomizations::BrowserInjection
  import DataFlow
  private import semmle.javascript.security.dataflow.XssThroughDomCustomizations::XssThroughDom as XssThroughDom
 
 
- class ObjectLabel extends DataFlow::FlowLabel {
-   ObjectLabel() {
-     this = "Object"
-   }
+ class ObjectState extends string {
+   ObjectState() { this = "Object" }
  }
 
    /**
     * Gets either a standard flow label or the partial-taint label.
     */
-   DataFlow::FlowLabel anyLabel() {
-     result.isDataOrTaint()
-   }
+   string anyLabel() { result = ["data", "taint"] }
 
 
-   class Configuration extends TaintTracking::Configuration {
-     Configuration() { this = "BrowserInjection" }
-   
-     override predicate isSource(DataFlow::Node source) { 
-        source instanceof Source // optional: or source instanceof XssThroughDom::Source
+   module Config implements DataFlow::StateConfigSig {
+     class FlowState extends string {
+       FlowState() { this = anyLabel() or this instanceof ObjectState }
+     }
+
+     predicate isSource(DataFlow::Node source, FlowState state) {
+        source instanceof Source and // optional: or source instanceof XssThroughDom::Source
+        (
+          state = anyLabel()
+          or
+          state instanceof ObjectState
+        )
      }
 
-     override predicate isSink(DataFlow::Node sink, DataFlow::FlowLabel lbl) { 
-       sink instanceof Sink and lbl instanceof ObjectLabel
+     predicate isSink(DataFlow::Node sink, FlowState state) {
+       sink instanceof Sink and state instanceof ObjectState
      }
 
-     override predicate isAdditionalFlowStep(
-       DataFlow::Node src, DataFlow::Node trg, DataFlow::FlowLabel inlbl, DataFlow::FlowLabel outlbl
+     predicate isAdditionalFlowStep(
+       DataFlow::Node src, FlowState inState, DataFlow::Node trg, FlowState outState
      ) {
        // writing a tainted value to an object property makes the object tainted with ObjectLabel
        exists(DataFlow::PropWrite write |
          write.getRhs() = src and
-         inlbl = anyLabel() and
+         inState = anyLabel() and
          trg.(DataFlow::SourceNode).flowsTo(write.getBase()) and
-         outlbl instanceof ObjectLabel
+         outState instanceof ObjectState
        )
      }
     }
 
+   module ConfigFlow = TaintTracking::GlobalWithState<Config>;
 
-   from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
-   where cfg.hasFlowPath(source, sink)
+   from ConfigFlow::PathNode source, ConfigFlow::PathNode sink
+   where ConfigFlow::flowPath(source, sink)
    select sink.getNode(), source, sink, sink.getNode() + " depends on a $@.",
      source.getNode(), "user-provided value"