Merge branch 'main' of github.com:github/codeql into python/promote-xpath-injection

python/ql/lib/semmle/python/security/ClearText.qll

@@ -4,7 +4,7 @@ import semmle.python.security.SensitiveData
 import semmle.python.dataflow.Files
 import semmle.python.web.Http
 
-module ClearTextStorage {
+deprecated module ClearTextStorage {
   abstract class Sink extends TaintSink {
     override predicate sinks(TaintKind kind) { kind instanceof SensitiveData }
   }
@@ -26,7 +26,7 @@ module ClearTextStorage {
   }
 }
 
-module ClearTextLogging {
+deprecated module ClearTextLogging {
   abstract class Sink extends TaintSink {
     override predicate sinks(TaintKind kind) { kind instanceof SensitiveData }
   }

python/ql/lib/semmle/python/security/Crypto.qll

@@ -3,12 +3,12 @@ import semmle.python.dataflow.TaintTracking
 private import semmle.python.security.SensitiveData
 private import semmle.crypto.Crypto as CryptoLib
 
-abstract class WeakCryptoSink extends TaintSink {
+abstract deprecated class WeakCryptoSink extends TaintSink {
   override predicate sinks(TaintKind taint) { taint instanceof SensitiveData }
 }
 
 /** Modeling the 'pycrypto' package https://github.com/dlitz/pycrypto (latest release 2013) */
-module Pycrypto {
+deprecated module Pycrypto {
   ModuleValue cipher(string name) { result = Module::named("Crypto.Cipher").attr(name) }
 
   class CipherInstance extends TaintKind {
@@ -58,7 +58,7 @@ module Pycrypto {
   }
 }
 
-module Cryptography {
+deprecated module Cryptography {
   ModuleValue ciphers() {
     result = Module::named("cryptography.hazmat.primitives.ciphers") and
     result.isPackage()
@@ -128,7 +128,7 @@ module Cryptography {
   }
 }
 
-private class CipherConfig extends TaintTracking::Configuration {
+deprecated private class CipherConfig extends TaintTracking::Configuration {
   CipherConfig() { this = "Crypto cipher config" }
 
   override predicate isSource(TaintTracking::Source source) {

python/ql/lib/semmle/python/security/Exceptions.qll

@@ -7,13 +7,15 @@ import python
 import semmle.python.dataflow.TaintTracking
 import semmle.python.security.strings.Basic
 
-private Value traceback_function(string name) { result = Module::named("traceback").attr(name) }
+deprecated private Value traceback_function(string name) {
+  result = Module::named("traceback").attr(name)
+}
 
 /**
  * This represents information relating to an exception, for instance the
  * message, arguments or parts of the exception traceback.
  */
-class ExceptionInfo extends StringKind {
+deprecated class ExceptionInfo extends StringKind {
   ExceptionInfo() { this = "exception.info" }
 
   override string repr() { result = "exception info" }
@@ -23,12 +25,12 @@ class ExceptionInfo extends StringKind {
  * A class representing sources of information about
  * execution state exposed in tracebacks and the like.
  */
-abstract class ErrorInfoSource extends TaintSource { }
+abstract deprecated class ErrorInfoSource extends TaintSource { }
 
 /**
  * This kind represents exceptions themselves.
  */
-class ExceptionKind extends TaintKind {
+deprecated class ExceptionKind extends TaintKind {
   ExceptionKind() { this = "exception.kind" }
 
   override string repr() { result = "exception" }
@@ -44,7 +46,7 @@ class ExceptionKind extends TaintKind {
  * A source of exception objects, either explicitly created, or captured by an
  * `except` statement.
  */
-class ExceptionSource extends ErrorInfoSource {
+deprecated class ExceptionSource extends ErrorInfoSource {
   ExceptionSource() {
     exists(ClassValue cls |
       cls.getASuperType() = ClassValue::baseException() and
@@ -63,7 +65,7 @@ class ExceptionSource extends ErrorInfoSource {
  * Represents a sequence of pieces of information relating to an exception,
  * for instance the contents of the `args` attribute, or the stack trace.
  */
-class ExceptionInfoSequence extends SequenceKind {
+deprecated class ExceptionInfoSequence extends SequenceKind {
   ExceptionInfoSequence() { this.getItem() instanceof ExceptionInfo }
 }
 
@@ -71,7 +73,7 @@ class ExceptionInfoSequence extends SequenceKind {
  * Represents calls to functions in the `traceback` module that return
  * sequences of exception information.
  */
-class CallToTracebackFunction extends ErrorInfoSource {
+deprecated class CallToTracebackFunction extends ErrorInfoSource {
   CallToTracebackFunction() {
     exists(string name |
       name in [
@@ -92,7 +94,7 @@ class CallToTracebackFunction extends ErrorInfoSource {
  * Represents calls to functions in the `traceback` module that return a single
  * string of information about an exception.
  */
-class FormattedTracebackSource extends ErrorInfoSource {
+deprecated class FormattedTracebackSource extends ErrorInfoSource {
   FormattedTracebackSource() { this = traceback_function("format_exc").getACall() }
 
   override string toString() { result = "exception.info.source" }

python/ql/lib/semmle/python/security/Paths.qll

@@ -1,6 +1,6 @@
 import semmle.python.dataflow.Implementation
 
-module TaintTrackingPaths {
+deprecated module TaintTrackingPaths {
   predicate edge(TaintTrackingNode src, TaintTrackingNode dest, string label) {
     exists(TaintTrackingNode source, TaintTrackingNode sink |
       source.getConfiguration().hasFlowPath(source, sink) and
@@ -11,6 +11,6 @@ module TaintTrackingPaths {
   }
 }
 
-query predicate edges(TaintTrackingNode fromnode, TaintTrackingNode tonode) {
+deprecated query predicate edges(TaintTrackingNode fromnode, TaintTrackingNode tonode) {
   TaintTrackingPaths::edge(fromnode, tonode, _)
 }

python/ql/lib/semmle/python/security/SensitiveData.qll

@@ -15,7 +15,7 @@ import semmle.python.web.HttpRequest
 import semmle.python.security.internal.SensitiveDataHeuristics
 private import HeuristicNames
 
-abstract class SensitiveData extends TaintKind {
+abstract deprecated class SensitiveData extends TaintKind {
   bindingset[this]
   SensitiveData() { this = this }
 
@@ -23,7 +23,7 @@ abstract class SensitiveData extends TaintKind {
   abstract SensitiveDataClassification getClassification();
 }
 
-module SensitiveData {
+deprecated module SensitiveData {
   class Secret extends SensitiveData {
     Secret() { this = "sensitive.data.secret" }
 
@@ -115,4 +115,4 @@ module SensitiveData {
 }
 
 //Backwards compatibility
-class SensitiveDataSource = SensitiveData::Source;
+deprecated class SensitiveDataSource = SensitiveData::Source;

python/ql/lib/semmle/python/security/dataflow/LdapInjection.qll

@@ -0,0 +1,60 @@
+/**
+ * Provides taint-tracking configurations for detecting LDAP injection vulnerabilities
+ *
+ * Note, for performance reasons: only import this file if
+ * `LdapInjection::Configuration` is needed, otherwise
+ * `LdapInjectionCustomizations` should be imported instead.
+ */
+
+import python
+import semmle.python.Concepts
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.dataflow.new.TaintTracking
+import semmle.python.dataflow.new.RemoteFlowSources
+
+/**
+ * Provides aint-tracking configurations for detecting LDAP injection vulnerabilities.class
+ *
+ * Two configurations are provided. One is for detecting LDAP injection
+ * via the distinguished name (DN). The other is for detecting LDAP injection
+ * via the filter. These require different escapings.
+ */
+module LdapInjection {
+  import LdapInjectionCustomizations::LdapInjection
+
+  /**
+   * A taint-tracking configuration for detecting LDAP injection vulnerabilities
+   * via the distinguished name (DN) parameter of an LDAP search.
+   */
+  class DnConfiguration extends TaintTracking::Configuration {
+    DnConfiguration() { this = "LdapDnInjection" }
+
+    override predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+    override predicate isSink(DataFlow::Node sink) { sink instanceof DnSink }
+
+    override predicate isSanitizer(DataFlow::Node node) { node instanceof DnSanitizer }
+
+    override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+      guard instanceof DnSanitizerGuard
+    }
+  }
+
+  /**
+   * A taint-tracking configuration for detecting LDAP injection vulnerabilities
+   * via the filter parameter of an LDAP search.
+   */
+  class FilterConfiguration extends TaintTracking::Configuration {
+    FilterConfiguration() { this = "LdapFilterInjection" }
+
+    override predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+    override predicate isSink(DataFlow::Node sink) { sink instanceof FilterSink }
+
+    override predicate isSanitizer(DataFlow::Node node) { node instanceof FilterSanitizer }
+
+    override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+      guard instanceof FilterSanitizerGuard
+    }
+  }
+}

python/ql/lib/semmle/python/security/dataflow/LdapInjectionCustomizations.qll

@@ -0,0 +1,97 @@
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "ldap injection"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.Concepts
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.dataflow.new.BarrierGuards
+
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "ldap injection"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+module LdapInjection {
+  /**
+   * A data flow source for "ldap injection" vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for "ldap injection" vulnerabilities.
+   */
+  abstract class DnSink extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for "ldap injection" vulnerabilities.
+   */
+  abstract class FilterSink extends DataFlow::Node { }
+
+  /**
+   * A sanitizer for "ldap injection" vulnerabilities.
+   */
+  abstract class DnSanitizer extends DataFlow::Node { }
+
+  /**
+   * A sanitizer for "ldap injection" vulnerabilities.
+   */
+  abstract class FilterSanitizer extends DataFlow::Node { }
+
+  /**
+   * A sanitizer guard for "ldap injection" vulnerabilities.
+   */
+  abstract class DnSanitizerGuard extends DataFlow::BarrierGuard { }
+
+  /**
+   * A sanitizer guard for "ldap injection" vulnerabilities.
+   */
+  abstract class FilterSanitizerGuard extends DataFlow::BarrierGuard { }
+
+  /**
+   * A source of remote user input, considered as a flow source.
+   */
+  class RemoteFlowSourceAsSource extends Source, RemoteFlowSource { }
+
+  /**
+   * A logging operation, considered as a flow sink.
+   */
+  class LdapExecutionAsDnSink extends DnSink {
+    LdapExecutionAsDnSink() { this = any(LDAP::LdapExecution ldap).getBaseDn() }
+  }
+
+  /**
+   * A logging operation, considered as a flow sink.
+   */
+  class LdapExecutionAsFilterSink extends FilterSink {
+    LdapExecutionAsFilterSink() { this = any(LDAP::LdapExecution ldap).getFilter() }
+  }
+
+  /**
+   * A comparison with a constant string, considered as a sanitizer-guard.
+   */
+  class StringConstCompareAsDnSanitizerGuard extends DnSanitizerGuard, StringConstCompare { }
+
+  /**
+   * A comparison with a constant string, considered as a sanitizer-guard.
+   */
+  class StringConstCompareAsFilterSanitizerGuard extends FilterSanitizerGuard, StringConstCompare {
+  }
+
+  /**
+   * A call to replace line breaks functions as a sanitizer.
+   */
+  class LdapDnEscapingSanitizer extends DnSanitizer, DataFlow::CallCfgNode {
+    LdapDnEscapingSanitizer() { this = any(LdapDnEscaping ldapDnEsc).getOutput() }
+  }
+
+  /**
+   * A call to replace line breaks functions as a sanitizer.
+   */
+  class LdapFilterEscapingSanitizer extends FilterSanitizer, DataFlow::CallCfgNode {
+    LdapFilterEscapingSanitizer() { this = any(LdapFilterEscaping ldapDnEsc).getOutput() }
+  }
+}

python/ql/lib/semmle/python/security/dataflow/LogInjection.qll

@@ -0,0 +1,35 @@
+/**
+ * Provides a taint-tracking configuration for tracking untrusted user input used in log entries.
+ *
+ * Note, for performance reasons: only import this file if
+ * `LogInjection::Configuration` is needed, otherwise
+ * `LogInjectionCustomizations` should be imported instead.
+ */
+
+import python
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.dataflow.new.TaintTracking
+
+/**
+ * Provides a taint-tracking configuration for tracking untrusted user input used in log entries.
+ */
+module LogInjection {
+  import LogInjectionCustomizations::LogInjection
+
+  /**
+   * A taint-tracking configuration for tracking untrusted user input used in log entries.
+   */
+  class Configuration extends TaintTracking::Configuration {
+    Configuration() { this = "LogInjection" }
+
+    override predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+    override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+    override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
+
+    override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+      guard instanceof SanitizerGuard
+    }
+  }
+}

python/ql/lib/semmle/python/security/dataflow/LogInjectionCustomizations.qll

@@ -0,0 +1,73 @@
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "log injection"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.Concepts
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.dataflow.new.BarrierGuards
+
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "log injection"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+module LogInjection {
+  /**
+   * A data flow source for "log injection" vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for "log injection" vulnerabilities.
+   */
+  abstract class Sink extends DataFlow::Node { }
+
+  /**
+   * A sanitizer for "log injection" vulnerabilities.
+   */
+  abstract class Sanitizer extends DataFlow::Node { }
+
+  /**
+   * A sanitizer guard for "log injection" vulnerabilities.
+   */
+  abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
+
+  /**
+   * A source of remote user input, considered as a flow source.
+   */
+  class RemoteFlowSourceAsSource extends Source, RemoteFlowSource { }
+
+  /**
+   * A logging operation, considered as a flow sink.
+   */
+  class LoggingAsSink extends Sink {
+    LoggingAsSink() { this = any(Logging write).getAnInput() }
+  }
+
+  /**
+   * A comparison with a constant string, considered as a sanitizer-guard.
+   */
+  class StringConstCompareAsSanitizerGuard extends SanitizerGuard, StringConstCompare { }
+
+  /**
+   * A call to replace line breaks, considered as a sanitizer.
+   */
+  class ReplaceLineBreaksSanitizer extends Sanitizer, DataFlow::CallCfgNode {
+    // Note: This sanitizer is not 100% accurate, since:
+    // - we do not check that all kinds of line breaks are replaced
+    // - we do not check that one kind of line breaks is not replaced by another
+    //
+    // However, we lack a simple way to do better, and the query would likely
+    // be too noisy without this.
+    //
+    // TODO: Consider rewriting using flow states.
+    ReplaceLineBreaksSanitizer() {
+      this.getFunction().(DataFlow::AttrRead).getAttributeName() = "replace" and
+      this.getArg(0).asExpr().(StrConst).getText() in ["\r\n", "\n"]
+    }
+  }
+}

python/ql/lib/semmle/python/security/flow/AnyCall.qll

@@ -2,7 +2,7 @@ import python
 import semmle.python.security.strings.Basic
 
 /** Assume that taint flows from argument to result for *any* call */
-class AnyCallStringFlow extends DataFlowExtension::DataFlowNode {
+deprecated class AnyCallStringFlow extends DataFlowExtension::DataFlowNode {
   AnyCallStringFlow() { any(CallNode call).getAnArg() = this }
 
   override ControlFlowNode getASuccessorNode() { result.(CallNode).getAnArg() = this }

python/ql/lib/semmle/python/security/injection/Command.qll

@@ -11,18 +11,18 @@ import semmle.python.dataflow.TaintTracking
 import semmle.python.security.strings.Untrusted
 
 /** Abstract taint sink that is potentially vulnerable to malicious shell commands. */
-abstract class CommandSink extends TaintSink { }
+abstract deprecated class CommandSink extends TaintSink { }
 
-private ModuleObject osOrPopenModule() { result.getName() = ["os", "popen2"] }
+deprecated private ModuleObject osOrPopenModule() { result.getName() = ["os", "popen2"] }
 
-private Object makeOsCall() {
+deprecated private Object makeOsCall() {
   exists(string name | result = ModuleObject::named("subprocess").attr(name) |
     name = ["Popen", "call", "check_call", "check_output", "run"]
   )
 }
 
 /**Special case for first element in sequence. */
-class FirstElementKind extends TaintKind {
+deprecated class FirstElementKind extends TaintKind {
   FirstElementKind() { this = "sequence[" + any(ExternalStringKind key) + "][0]" }
 
   override string repr() { result = "first item in sequence of " + this.getItem().repr() }
@@ -31,7 +31,7 @@ class FirstElementKind extends TaintKind {
   ExternalStringKind getItem() { this = "sequence[" + result + "][0]" }
 }
 
-class FirstElementFlow extends DataFlowExtension::DataFlowNode {
+deprecated class FirstElementFlow extends DataFlowExtension::DataFlowNode {
   FirstElementFlow() { this = any(SequenceNode s).getElement(0) }
 
   override ControlFlowNode getASuccessorNode(TaintKind fromkind, TaintKind tokind) {
@@ -43,7 +43,7 @@ class FirstElementFlow extends DataFlowExtension::DataFlowNode {
  * A taint sink that is potentially vulnerable to malicious shell commands.
  * The `vuln` in `subprocess.call(shell=vuln)` and similar calls.
  */
-class ShellCommand extends CommandSink {
+deprecated class ShellCommand extends CommandSink {
   override string toString() { result = "shell command" }
 
   ShellCommand() {
@@ -81,7 +81,7 @@ class ShellCommand extends CommandSink {
  * A taint sink that is potentially vulnerable to malicious shell commands.
  * The `vuln` in `subprocess.call(vuln, ...)` and similar calls.
  */
-class OsCommandFirstArgument extends CommandSink {
+deprecated class OsCommandFirstArgument extends CommandSink {
   override string toString() { result = "OS command first argument" }
 
   OsCommandFirstArgument() {
@@ -111,7 +111,7 @@ class OsCommandFirstArgument extends CommandSink {
  * A taint sink that is potentially vulnerable to malicious shell commands.
  * The `vuln` in `invoke.run(vuln, ...)` and similar calls.
  */
-class InvokeRun extends CommandSink {
+deprecated class InvokeRun extends CommandSink {
   InvokeRun() {
     this = Value::named("invoke.run").(FunctionValue).getArgumentForCall(_, 0)
     or
@@ -127,12 +127,12 @@ class InvokeRun extends CommandSink {
  * Internal TaintKind to track the invoke.Context instance passed to functions
  * marked with @invoke.task
  */
-private class InvokeContextArg extends TaintKind {
+deprecated private class InvokeContextArg extends TaintKind {
   InvokeContextArg() { this = "InvokeContextArg" }
 }
 
 /** Internal TaintSource to track the context passed to functions marked with @invoke.task */
-private class InvokeContextArgSource extends TaintSource {
+deprecated private class InvokeContextArgSource extends TaintSource {
   InvokeContextArgSource() {
     exists(Function f, Expr decorator |
       count(f.getADecorator()) = 1 and
@@ -158,7 +158,7 @@ private class InvokeContextArgSource extends TaintSource {
  * A taint sink that is potentially vulnerable to malicious shell commands.
  * The `vuln` in `invoke.Context().run(vuln, ...)` and similar calls.
  */
-class InvokeContextRun extends CommandSink {
+deprecated class InvokeContextRun extends CommandSink {
   InvokeContextRun() {
     exists(CallNode call |
       any(InvokeContextArg k).taints(call.getFunction().(AttrNode).getObject("run"))
@@ -187,7 +187,7 @@ class InvokeContextRun extends CommandSink {
  * A taint sink that is potentially vulnerable to malicious shell commands.
  * The `vuln` in `fabric.Group().run(vuln, ...)` and similar calls.
  */
-class FabricGroupRun extends CommandSink {
+deprecated class FabricGroupRun extends CommandSink {
   FabricGroupRun() {
     exists(ClassValue cls |
       cls.getASuperType() = Value::named("fabric.Group") and
@@ -203,7 +203,7 @@ class FabricGroupRun extends CommandSink {
 // -------------------------------------------------------------------------- //
 // Modeling of the 'invoke' package and 'fabric' package (v 1.x)
 // -------------------------------------------------------------------------- //
-class FabricV1Commands extends CommandSink {
+deprecated class FabricV1Commands extends CommandSink {
   FabricV1Commands() {
     // since `run` and `sudo` are decorated, we can't use FunctionValue's :(
     exists(CallNode call |
@@ -228,7 +228,7 @@ class FabricV1Commands extends CommandSink {
  * An extension that propagates taint from the arguments of `fabric.api.execute(func, arg0, arg1, ...)`
  * to the parameters of `func`, since this will call `func(arg0, arg1, ...)`.
  */
-class FabricExecuteExtension extends DataFlowExtension::DataFlowNode {
+deprecated class FabricExecuteExtension extends DataFlowExtension::DataFlowNode {
   CallNode call;
 
   FabricExecuteExtension() {

python/ql/lib/semmle/python/security/injection/Deserialization.qll

@@ -2,7 +2,7 @@ import python
 import semmle.python.dataflow.TaintTracking
 
 /** `pickle.loads(untrusted)` vulnerability. */
-abstract class DeserializationSink extends TaintSink {
+abstract deprecated class DeserializationSink extends TaintSink {
   bindingset[this]
   DeserializationSink() { this = this }
 }

python/ql/lib/semmle/python/security/injection/Exec.qll

@@ -14,7 +14,7 @@ import semmle.python.security.strings.Untrusted
  * A taint sink that represents an argument to exec or eval that is vulnerable to malicious input.
  * The `vuln` in `exec(vuln)` or similar.
  */
-class StringEvaluationNode extends TaintSink {
+deprecated class StringEvaluationNode extends TaintSink {
   override string toString() { result = "exec or eval" }
 
   StringEvaluationNode() {

python/ql/lib/semmle/python/security/injection/Marshal.qll

@@ -11,13 +11,15 @@ import semmle.python.dataflow.TaintTracking
 import semmle.python.security.strings.Untrusted
 import semmle.python.security.injection.Deserialization
 
-private FunctionObject marshalLoads() { result = ModuleObject::named("marshal").attr("loads") }
+deprecated private FunctionObject marshalLoads() {
+  result = ModuleObject::named("marshal").attr("loads")
+}
 
 /**
  * A taint sink that is potentially vulnerable to malicious marshaled objects.
  * The `vuln` in `marshal.loads(vuln)`.
  */
-class UnmarshalingNode extends DeserializationSink {
+deprecated class UnmarshalingNode extends DeserializationSink {
   override string toString() { result = "unmarshaling vulnerability" }
 
   UnmarshalingNode() {

python/ql/lib/semmle/python/security/injection/Path.qll

@@ -6,7 +6,7 @@ import semmle.python.security.strings.Untrusted
  * Prevents taint flowing through ntpath.normpath()
  * NormalizedPath below handles that case.
  */
-class PathSanitizer extends Sanitizer {
+deprecated class PathSanitizer extends Sanitizer {
   PathSanitizer() { this = "path.sanitizer" }
 
   override predicate sanitizingNode(TaintKind taint, ControlFlowNode node) {
@@ -15,7 +15,7 @@ class PathSanitizer extends Sanitizer {
   }
 }
 
-private FunctionObject abspath() {
+deprecated private FunctionObject abspath() {
   exists(ModuleObject os_path | ModuleObject::named("os").attr("path") = os_path |
     os_path.attr("abspath") = result
     or
@@ -24,18 +24,18 @@ private FunctionObject abspath() {
 }
 
 /** A path that has been normalized, but not verified to be safe */
-class NormalizedPath extends TaintKind {
+deprecated class NormalizedPath extends TaintKind {
   NormalizedPath() { this = "normalized.path.injection" }
 
   override string repr() { result = "normalized path" }
 }
 
-private predicate abspath_call(CallNode call, ControlFlowNode arg) {
+deprecated private predicate abspath_call(CallNode call, ControlFlowNode arg) {
   call.getFunction().refersTo(abspath()) and
   arg = call.getArg(0)
 }
 
-class AbsPath extends DataFlowExtension::DataFlowNode {
+deprecated class AbsPath extends DataFlowExtension::DataFlowNode {
   AbsPath() { abspath_call(_, this) }
 
   override ControlFlowNode getASuccessorNode(TaintKind fromkind, TaintKind tokind) {
@@ -45,7 +45,7 @@ class AbsPath extends DataFlowExtension::DataFlowNode {
   }
 }
 
-class NormalizedPathSanitizer extends Sanitizer {
+deprecated class NormalizedPathSanitizer extends Sanitizer {
   NormalizedPathSanitizer() { this = "normalized.path.sanitizer" }
 
   override predicate sanitizingEdge(TaintKind taint, PyEdgeRefinement test) {
@@ -59,7 +59,7 @@ class NormalizedPathSanitizer extends Sanitizer {
  * A taint sink that is vulnerable to malicious paths.
  * The `vuln` in `open(vuln)` and similar.
  */
-class OpenNode extends TaintSink {
+deprecated class OpenNode extends TaintSink {
   override string toString() { result = "argument to open()" }
 
   OpenNode() {

python/ql/lib/semmle/python/security/injection/Pickle.qll

@@ -11,7 +11,7 @@ import semmle.python.dataflow.TaintTracking
 import semmle.python.security.strings.Untrusted
 import semmle.python.security.injection.Deserialization
 
-private ModuleObject pickleModule() {
+deprecated private ModuleObject pickleModule() {
   result.getName() = "pickle"
   or
   result.getName() = "cPickle"
@@ -19,10 +19,10 @@ private ModuleObject pickleModule() {
   result.getName() = "dill"
 }
 
-private FunctionObject pickleLoads() { result = pickleModule().attr("loads") }
+deprecated private FunctionObject pickleLoads() { result = pickleModule().attr("loads") }
 
 /** `pickle.loads(untrusted)` vulnerability. */
-class UnpicklingNode extends DeserializationSink {
+deprecated class UnpicklingNode extends DeserializationSink {
   override string toString() { result = "unpickling untrusted data" }
 
   UnpicklingNode() {

python/ql/lib/semmle/python/security/injection/Sql.qll

@@ -11,7 +11,7 @@ import semmle.python.dataflow.TaintTracking
 import semmle.python.security.strings.Untrusted
 import semmle.python.security.SQL
 
-private StringObject first_part(ControlFlowNode command) {
+deprecated private StringObject first_part(ControlFlowNode command) {
   command.(BinaryExprNode).getOp() instanceof Add and
   command.(BinaryExprNode).getLeft().refersTo(result)
   or
@@ -26,7 +26,7 @@ private StringObject first_part(ControlFlowNode command) {
 }
 
 /** Holds if `command` appears to be a SQL command string of which `inject` is a part. */
-predicate probable_sql_command(ControlFlowNode command, ControlFlowNode inject) {
+deprecated predicate probable_sql_command(ControlFlowNode command, ControlFlowNode inject) {
   exists(string prefix |
     inject = command.getAChild*() and
     first_part(command).getText().regexpMatch(" *" + prefix + ".*")
@@ -39,7 +39,7 @@ predicate probable_sql_command(ControlFlowNode command, ControlFlowNode inject)
  * A taint kind representing a DB cursor.
  * This will be overridden to provide specific kinds of DB cursor.
  */
-abstract class DbCursor extends TaintKind {
+abstract deprecated class DbCursor extends TaintKind {
   bindingset[this]
   DbCursor() { any() }
 
@@ -50,7 +50,7 @@ abstract class DbCursor extends TaintKind {
  * A part of a string that appears to be a SQL command and is thus
  * vulnerable to malicious input.
  */
-class SimpleSqlStringInjection extends SqlInjectionSink {
+deprecated class SimpleSqlStringInjection extends SqlInjectionSink {
   override string toString() { result = "simple SQL string injection" }
 
   SimpleSqlStringInjection() { probable_sql_command(_, this) }
@@ -62,13 +62,13 @@ class SimpleSqlStringInjection extends SqlInjectionSink {
  * A taint source representing sources of DB connections.
  * This will be overridden to provide specific kinds of DB connection sources.
  */
-abstract class DbConnectionSource extends TaintSource { }
+abstract deprecated class DbConnectionSource extends TaintSource { }
 
 /**
  * A taint sink that is vulnerable to malicious SQL queries.
  * The `vuln` in `db.connection.execute(vuln)` and similar.
  */
-class DbConnectionExecuteArgument extends SqlInjectionSink {
+deprecated class DbConnectionExecuteArgument extends SqlInjectionSink {
   override string toString() { result = "db.connection.execute" }
 
   DbConnectionExecuteArgument() {

python/ql/lib/semmle/python/security/injection/Xml.qll

@@ -11,23 +11,25 @@ import semmle.python.dataflow.TaintTracking
 import semmle.python.security.strings.Untrusted
 import semmle.python.security.injection.Deserialization
 
-private ModuleObject xmlElementTreeModule() { result.getName() = "xml.etree.ElementTree" }
+deprecated private ModuleObject xmlElementTreeModule() {
+  result.getName() = "xml.etree.ElementTree"
+}
 
-private ModuleObject xmlMiniDomModule() { result.getName() = "xml.dom.minidom" }
+deprecated private ModuleObject xmlMiniDomModule() { result.getName() = "xml.dom.minidom" }
 
-private ModuleObject xmlPullDomModule() { result.getName() = "xml.dom.pulldom" }
+deprecated private ModuleObject xmlPullDomModule() { result.getName() = "xml.dom.pulldom" }
 
-private ModuleObject xmlSaxModule() { result.getName() = "xml.sax" }
+deprecated private ModuleObject xmlSaxModule() { result.getName() = "xml.sax" }
 
-private class ExpatParser extends TaintKind {
+deprecated private class ExpatParser extends TaintKind {
   ExpatParser() { this = "expat.parser" }
 }
 
-private FunctionObject expatCreateParseFunction() {
+deprecated private FunctionObject expatCreateParseFunction() {
   result = ModuleObject::named("xml.parsers.expat").attr("ParserCreate")
 }
 
-private class ExpatCreateParser extends TaintSource {
+deprecated private class ExpatCreateParser extends TaintSource {
   ExpatCreateParser() { expatCreateParseFunction().getACall() = this }
 
   override predicate isSourceOf(TaintKind kind) { kind instanceof ExpatParser }
@@ -35,7 +37,7 @@ private class ExpatCreateParser extends TaintSource {
   override string toString() { result = "expat.create.parser" }
 }
 
-private FunctionObject xmlFromString() {
+deprecated private FunctionObject xmlFromString() {
   result = xmlElementTreeModule().attr("fromstring")
   or
   result = xmlMiniDomModule().attr("parseString")
@@ -46,7 +48,7 @@ private FunctionObject xmlFromString() {
 }
 
 /** A (potentially) malicious XML string. */
-class ExternalXmlString extends ExternalStringKind {
+deprecated class ExternalXmlString extends ExternalStringKind {
   ExternalXmlString() { this = "external xml encoded object" }
 }
 
@@ -54,7 +56,7 @@ class ExternalXmlString extends ExternalStringKind {
  * A call to an XML library function that is potentially vulnerable to a
  * specially crafted XML string.
  */
-class XmlLoadNode extends DeserializationSink {
+deprecated class XmlLoadNode extends DeserializationSink {
   override string toString() { result = "xml.load vulnerability" }
 
   XmlLoadNode() {

python/ql/lib/semmle/python/security/injection/Yaml.qll

@@ -11,10 +11,10 @@ import semmle.python.dataflow.TaintTracking
 import semmle.python.security.strings.Untrusted
 import semmle.python.security.injection.Deserialization
 
-private FunctionObject yamlLoad() { result = ModuleObject::named("yaml").attr("load") }
+deprecated private FunctionObject yamlLoad() { result = ModuleObject::named("yaml").attr("load") }
 
 /** `yaml.load(untrusted)` vulnerability. */
-class YamlLoadNode extends DeserializationSink {
+deprecated class YamlLoadNode extends DeserializationSink {
   override string toString() { result = "yaml.load vulnerability" }
 
   YamlLoadNode() {

python/ql/lib/semmle/python/security/strings/Basic.qll

@@ -3,7 +3,7 @@ private import Common
 import semmle.python.dataflow.TaintTracking
 
 /** An extensible kind of taint representing any kind of string. */
-abstract class StringKind extends TaintKind {
+abstract deprecated class StringKind extends TaintKind {
   bindingset[this]
   StringKind() { this = this }
 
@@ -42,7 +42,7 @@ abstract class StringKind extends TaintKind {
   }
 }
 
-private class StringEqualitySanitizer extends Sanitizer {
+deprecated private class StringEqualitySanitizer extends Sanitizer {
   StringEqualitySanitizer() { this = "string equality sanitizer" }
 
   /** The test `if untrusted == "KNOWN_VALUE":` sanitizes `untrusted` on its `true` edge. */
@@ -64,13 +64,13 @@ private class StringEqualitySanitizer extends Sanitizer {
 }
 
 /** tonode = ....format(fromnode) */
-private predicate str_format(ControlFlowNode fromnode, CallNode tonode) {
+deprecated private predicate str_format(ControlFlowNode fromnode, CallNode tonode) {
   tonode.getFunction().(AttrNode).getName() = "format" and
   tonode.getAnArg() = fromnode
 }
 
 /** tonode = codec.[en|de]code(fromnode) */
-private predicate encode_decode(ControlFlowNode fromnode, CallNode tonode) {
+deprecated private predicate encode_decode(ControlFlowNode fromnode, CallNode tonode) {
   exists(FunctionObject func, string name |
     not func.getFunction().isMethod() and
     func.getACall() = tonode and
@@ -84,7 +84,7 @@ private predicate encode_decode(ControlFlowNode fromnode, CallNode tonode) {
 }
 
 /** tonode = str(fromnode) */
-private predicate to_str(ControlFlowNode fromnode, CallNode tonode) {
+deprecated private predicate to_str(ControlFlowNode fromnode, CallNode tonode) {
   tonode.getAnArg() = fromnode and
   (
     tonode = ClassValue::bytes().getACall()
@@ -94,7 +94,7 @@ private predicate to_str(ControlFlowNode fromnode, CallNode tonode) {
 }
 
 /** tonode = fromnode[:] */
-private predicate slice(ControlFlowNode fromnode, SubscriptNode tonode) {
+deprecated private predicate slice(ControlFlowNode fromnode, SubscriptNode tonode) {
   exists(Slice all |
     all = tonode.getIndex().getNode() and
     not exists(all.getStart()) and
@@ -104,13 +104,13 @@ private predicate slice(ControlFlowNode fromnode, SubscriptNode tonode) {
 }
 
 /** tonode = os.path.join(..., fromnode, ...) */
-private predicate os_path_join(ControlFlowNode fromnode, CallNode tonode) {
+deprecated private predicate os_path_join(ControlFlowNode fromnode, CallNode tonode) {
   tonode = Value::named("os.path.join").getACall() and
   tonode.getAnArg() = fromnode
 }
 
 /** tonode = f"... {fromnode} ..." */
-private predicate f_string(ControlFlowNode fromnode, ControlFlowNode tonode) {
+deprecated private predicate f_string(ControlFlowNode fromnode, ControlFlowNode tonode) {
   tonode.getNode().(Fstring).getAValue() = fromnode.getNode()
 }
 

python/ql/lib/semmle/python/security/strings/Common.qll

@@ -1,7 +1,7 @@
 import python
 
 /* A call that returns a copy (or similar) of the argument */
-predicate copy_call(ControlFlowNode fromnode, CallNode tonode) {
+deprecated predicate copy_call(ControlFlowNode fromnode, CallNode tonode) {
   tonode.getFunction().(AttrNode).getObject("copy") = fromnode
   or
   exists(ModuleValue copy, string name | name = "copy" or name = "deepcopy" |

python/ql/lib/semmle/python/security/strings/External.qll

@@ -5,7 +5,7 @@ private import Common
 /**
  * An extensible kind of taint representing an externally controlled string.
  */
-abstract class ExternalStringKind extends StringKind {
+abstract deprecated class ExternalStringKind extends StringKind {
   bindingset[this]
   ExternalStringKind() { this = this }
 
@@ -30,7 +30,7 @@ abstract class ExternalStringKind extends StringKind {
 }
 
 /** A kind of "taint", representing a sequence, with a "taint" member */
-class ExternalStringSequenceKind extends SequenceKind {
+deprecated class ExternalStringSequenceKind extends SequenceKind {
   ExternalStringSequenceKind() { this.getItem() instanceof ExternalStringKind }
 }
 
@@ -38,7 +38,7 @@ class ExternalStringSequenceKind extends SequenceKind {
  * An hierachical dictionary or list where the entire structure is externally controlled
  * This is typically a parsed JSON object.
  */
-class ExternalJsonKind extends TaintKind {
+deprecated class ExternalJsonKind extends TaintKind {
   ExternalJsonKind() { this = "json[" + any(ExternalStringKind key) + "]" }
 
   /** Gets the taint kind for item in this sequence */
@@ -61,7 +61,7 @@ class ExternalJsonKind extends TaintKind {
 }
 
 /** A kind of "taint", representing a dictionary mapping keys to tainted strings. */
-class ExternalStringDictKind extends DictKind {
+deprecated class ExternalStringDictKind extends DictKind {
   ExternalStringDictKind() { this.getValue() instanceof ExternalStringKind }
 }
 
@@ -69,12 +69,12 @@ class ExternalStringDictKind extends DictKind {
  * A kind of "taint", representing a dictionary mapping keys to sequences of
  *  tainted strings.
  */
-class ExternalStringSequenceDictKind extends DictKind {
+deprecated class ExternalStringSequenceDictKind extends DictKind {
   ExternalStringSequenceDictKind() { this.getValue() instanceof ExternalStringSequenceKind }
 }
 
 /** TaintKind for the result of `urlsplit(tainted_string)` */
-class ExternalUrlSplitResult extends ExternalStringSequenceKind {
+deprecated class ExternalUrlSplitResult extends ExternalStringSequenceKind {
   // https://docs.python.org/3/library/urllib.parse.html#urllib.parse.urlsplit
   override TaintKind getTaintOfAttribute(string name) {
     result = super.getTaintOfAttribute(name)
@@ -103,7 +103,7 @@ class ExternalUrlSplitResult extends ExternalStringSequenceKind {
 }
 
 /** TaintKind for the result of `urlparse(tainted_string)` */
-class ExternalUrlParseResult extends ExternalStringSequenceKind {
+deprecated class ExternalUrlParseResult extends ExternalStringSequenceKind {
   // https://docs.python.org/3/library/urllib.parse.html#urllib.parse.urlparse
   override TaintKind getTaintOfAttribute(string name) {
     result = super.getTaintOfAttribute(name)
@@ -134,7 +134,7 @@ class ExternalUrlParseResult extends ExternalStringSequenceKind {
 
 /* Helper for getTaintForStep() */
 pragma[noinline]
-private predicate json_subscript_taint(
+deprecated private predicate json_subscript_taint(
   SubscriptNode sub, ControlFlowNode obj, ExternalJsonKind seq, TaintKind key
 ) {
   sub.isLoad() and
@@ -142,12 +142,12 @@ private predicate json_subscript_taint(
   key = seq.getValue()
 }
 
-private predicate json_load(ControlFlowNode fromnode, CallNode tonode) {
+deprecated private predicate json_load(ControlFlowNode fromnode, CallNode tonode) {
   tonode = Value::named("json.loads").getACall() and
   tonode.getArg(0) = fromnode
 }
 
-private predicate urlsplit(ControlFlowNode fromnode, CallNode tonode) {
+deprecated private predicate urlsplit(ControlFlowNode fromnode, CallNode tonode) {
   // This could be implemented as `exists(FunctionValue` without the explicit six part,
   // but then our tests will need to import +100 modules, so for now this slightly
   // altered version gets to live on.
@@ -166,7 +166,7 @@ private predicate urlsplit(ControlFlowNode fromnode, CallNode tonode) {
   )
 }
 
-private predicate urlparse(ControlFlowNode fromnode, CallNode tonode) {
+deprecated private predicate urlparse(ControlFlowNode fromnode, CallNode tonode) {
   // This could be implemented as `exists(FunctionValue` without the explicit six part,
   // but then our tests will need to import +100 modules, so for now this slightly
   // altered version gets to live on.
@@ -185,7 +185,7 @@ private predicate urlparse(ControlFlowNode fromnode, CallNode tonode) {
   )
 }
 
-private predicate parse_qs(ControlFlowNode fromnode, CallNode tonode) {
+deprecated private predicate parse_qs(ControlFlowNode fromnode, CallNode tonode) {
   // This could be implemented as `exists(FunctionValue` without the explicit six part,
   // but then our tests will need to import +100 modules, so for now this slightly
   // altered version gets to live on.
@@ -211,7 +211,7 @@ private predicate parse_qs(ControlFlowNode fromnode, CallNode tonode) {
   )
 }
 
-private predicate parse_qsl(ControlFlowNode fromnode, CallNode tonode) {
+deprecated private predicate parse_qsl(ControlFlowNode fromnode, CallNode tonode) {
   // This could be implemented as `exists(FunctionValue` without the explicit six part,
   // but then our tests will need to import +100 modules, so for now this slightly
   // altered version gets to live on.
@@ -238,7 +238,7 @@ private predicate parse_qsl(ControlFlowNode fromnode, CallNode tonode) {
 }
 
 /** A kind of "taint", representing an open file-like object from an external source. */
-class ExternalFileObject extends TaintKind {
+deprecated class ExternalFileObject extends TaintKind {
   ExternalStringKind valueKind;
 
   ExternalFileObject() { this = "file[" + valueKind + "]" }
@@ -266,7 +266,7 @@ class ExternalFileObject extends TaintKind {
  * - `if splitres.netloc == "KNOWN_VALUE"`
  * - `if splitres[0] == "KNOWN_VALUE"`
  */
-class UrlsplitUrlparseTempSanitizer extends Sanitizer {
+deprecated class UrlsplitUrlparseTempSanitizer extends Sanitizer {
   // TODO: remove this once we have better support for named tuples
   UrlsplitUrlparseTempSanitizer() { this = "UrlsplitUrlparseTempSanitizer" }
 

python/ql/lib/semmle/python/security/strings/Untrusted.qll

@@ -5,6 +5,6 @@ import External
  * A kind of taint representing an externally controlled string.
  * This class is a simple sub-class of `ExternalStringKind`.
  */
-class UntrustedStringKind extends ExternalStringKind {
+deprecated class UntrustedStringKind extends ExternalStringKind {
   UntrustedStringKind() { this = "externally controlled string" }
 }