add mkdirp as a sink for tainted-path

Author: erik-krogh

javascript/change-notes/2021-07-14-mkdirp.md

@@ -0,0 +1,4 @@
+lgtm,codescanning
+* The `js/tainted-path` now recognizes the `mkdirp` library as a sink.
+  Affected packages are
+    [mkdirp](https://www.npmjs.com/package/mkdirp)

javascript/ql/src/semmle/javascript/frameworks/Files.qll

@@ -470,3 +470,16 @@ class Chokidar extends FileNameProducer, FileSystemAccess, API::CallNode {
     )
   }
 }
+
+/**
+ * A call to the [`mkdirp`](https://www.npmjs.com/package/mkdirp) library.
+ */
+private class Mkdirp extends FileSystemAccess, API::CallNode {
+  Mkdirp() {
+    this = API::moduleImport("mkdirp").getACall()
+    or
+    this = API::moduleImport("mkdirp").getMember("sync").getACall()
+  }
+
+  override DataFlow::Node getAPathArgument() { result = getArgument(0) }
+}