Python: Add some alert meta queries

Intended for use with dca

Author: RasmusWL

python/ql/src/meta/alerts/RemoteFlowSources.ql

@@ -0,0 +1,18 @@
+/**
+ * @name Remote flow sources
+ * @description Sources of remote user input.
+ * @kind problem
+ * @problem.severity recommendation
+ * @id py/meta/alerts/remote-flow-sources
+ * @tags meta
+ * @precision very-low
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import meta.MetaMetrics
+
+from RemoteFlowSource source
+where not source.getLocation().getFile() instanceof IgnoredFile
+select source, "RemoteFlowSource: " + source.getSourceType()

python/ql/src/meta/alerts/RemoteFlowSourcesReach.ql

@@ -0,0 +1,46 @@
+/**
+ * @name Remote flow sources reach
+ * @description Nodes that can be reached with taint tracking from sources of
+ *   remote user input.
+ * @kind problem
+ * @problem.severity recommendation
+ * @id py/meta/alerts/remote-flow-sources-reach
+ * @tags meta
+ * @precision very-low
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.TaintTracking
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import meta.MetaMetrics
+
+class RemoteFlowSourceReach extends TaintTracking::Configuration {
+  RemoteFlowSourceReach() { this = "RemoteFlowSourceReach" }
+
+  override predicate isSource(DataFlow::Node node) {
+    node instanceof RemoteFlowSource and
+    not node.getLocation().getFile() instanceof IgnoredFile
+  }
+
+  override predicate isSink(DataFlow::Node node) {
+    not node.getLocation().getFile() instanceof IgnoredFile and
+    (
+      node instanceof RemoteFlowSource
+      or
+      this.isAdditionalFlowStep(_, node)
+    ) and
+    // we used to do `obj -> obj.meth` and `obj.meth -> obj.meth()` in two separate
+    // steps, and now do them in one `obj -> obj.meth()`. So we're going to ignore the
+    // fact that we no longer taint the node in the middle.
+    not exists(DataFlow::MethodCallNode c |
+      node = c.getFunction() and
+      this.isAdditionalFlowStep(c.getObject(), node) and
+      this.isAdditionalFlowStep(node, c)
+    )
+  }
+}
+
+from RemoteFlowSourceReach cfg, DataFlow::Node reachable
+where cfg.hasFlow(_, reachable)
+select reachable, "reachable with taint-tracking from RemoteFlowSource"