Update ZipSlip.qll

Author: ahmed-farid-dev

python/ql/src/experimental/semmle/python/security/ZipSlip.qll

@@ -8,7 +8,8 @@ class ZipSlipConfig extends TaintTracking::Configuration {
   ZipSlipConfig() { this = "ZipSlipConfig" }
 
   override predicate isSource(DataFlow::Node source) { 
-    source = API::moduleImport("zipfile").getMember("ZipFile").getACall() or 
+    source.asCfgNode().(CallNode).getFunction().(AttrNode).getObject("open").pointsTo().getClass() = Module::named("zipfile").attr("ZipFile") or 
+    source.asCfgNode().(CallNode).getFunction().(AttrNode).getObject("namelist").pointsTo().getClass() = Module::named("zipfile").attr("ZipFile") or
     source = API::moduleImport("tarfile").getMember("open").getACall() or 
     source = API::moduleImport("tarfile").getMember("TarFile").getACall() or  
     source = API::moduleImport("bz2").getMember("open").getACall() or
@@ -20,6 +21,7 @@ class ZipSlipConfig extends TaintTracking::Configuration {
   }
 
   override predicate isSink(DataFlow::Node sink) { 
-     sink = any(CopyFile copyfile).getAPathArgument()
+     sink = any(CopyFile copyfile).getAPathArgument() or
+     sink = any(CopyFile copyfile).getfsrcArgument()
   }
 }