Allow MaD sanitizers for java/ognl-injection

Author: owen-mc

java/ql/lib/semmle/code/java/security/OgnlInjection.qll

@@ -7,6 +7,7 @@ private import semmle.code.java.dataflow.DataFlow
 private import semmle.code.java.dataflow.FlowSinks
 private import semmle.code.java.dataflow.ExternalFlow
 private import semmle.code.java.frameworks.MyBatis
+private import semmle.code.java.security.Sanitizers
 
 /**
  * A data flow sink for unvalidated user input that is used in OGNL EL evaluation.
@@ -15,6 +16,8 @@ private import semmle.code.java.frameworks.MyBatis
  */
 abstract class OgnlInjectionSink extends ApiSinkNode { }
 
+abstract class OgnlInjectionSanitizer extends DataFlow::Node { }
+
 /**
  * A unit class for adding additional taint steps.
  *
@@ -32,6 +35,13 @@ private class DefaultOgnlInjectionSink extends OgnlInjectionSink {
   DefaultOgnlInjectionSink() { sinkNode(this, "ognl-injection") }
 }
 
+private class SimpleTypeOgnlInjectionSanitizer extends OgnlInjectionSanitizer instanceof SimpleTypeSanitizer
+{ }
+
+private class ExternalOgnlInjectionSanitizer extends OgnlInjectionSanitizer {
+  ExternalOgnlInjectionSanitizer() { barrierNode(this, "ognl-injection") }
+}
+
 /** The class `org.apache.commons.ognl.Ognl` or `ognl.Ognl`. */
 private class TypeOgnl extends Class {
   TypeOgnl() { this.hasQualifiedName(["org.apache.commons.ognl", "ognl"], "Ognl") }

java/ql/lib/semmle/code/java/security/OgnlInjectionQuery.qll

@@ -3,7 +3,6 @@
 import java
 import semmle.code.java.dataflow.FlowSources
 import semmle.code.java.security.OgnlInjection
-private import semmle.code.java.security.Sanitizers
 
 /**
  * A taint-tracking configuration for unvalidated user input that is used in OGNL EL evaluation.
@@ -13,7 +12,7 @@ module OgnlInjectionFlowConfig implements DataFlow::ConfigSig {
 
   predicate isSink(DataFlow::Node sink) { sink instanceof OgnlInjectionSink }
 
-  predicate isBarrier(DataFlow::Node node) { node instanceof SimpleTypeSanitizer }
+  predicate isBarrier(DataFlow::Node node) { node instanceof OgnlInjectionSanitizer }
 
   predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
     any(OgnlInjectionAdditionalTaintStep c).step(node1, node2)