Merge pull request #7259 from RasmusWL/even-more-path-injection-sinks

Python: Add more path-injection sinks from `os` and `tempfile` modules

Author: yoff

python/change-notes/2021-11-16-os-stat.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added modeling of many functions from the `os` module that uses file system paths, such as `os.stat`, `os.chdir`, `os.mkdir`, and so on. All of these are new sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.

python/change-notes/2021-11-26-os-file-access.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added modeling of the `tempfile` module for creating temporary files and directories, such as the functions `tempfile.NamedTemporaryFile` and `tempfile.TemporaryDirectory`. The `suffix`, `prefix`, and `dir` arguments are all vulnerable to path-injection, and these are new sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.