Promoto cookie injection query

python/ql/src/Security/CWE-614/CookieInjection.ql

@@ -0,0 +1,20 @@
+/**
+ * @name Construction of a cookie using user-supplied input.
+ * @description Constructing cookies from user input may allow an attacker to perform a Cookie Poisoning attack.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id py/cookie-injection
+ * @tags security
+ *       external/cwe/cwe-614
+ */
+
+import python
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.security.dataflow.CookieInjectionQuery
+import CookieInjectionFlow::PathGraph
+
+from CookieInjectionFlow::PathNode source, CookieInjectionFlow::PathNode sink
+where CookieInjectionFlow::flowPath(source, sink)
+select sink.getNode(), source, sink, "Cookie is constructed from a $@.", source.getNode(),
+  "user-supplied input"