add model for the gray-matter libary to js/code-injection

javascript/ql/lib/change-notes/2022-06-22-sensitive-common-words copy.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `gray-matter` library is now modeled as a sink for the `js/code-injection` query.

javascript/ql/lib/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll

@@ -51,6 +51,11 @@ module CodeInjection {
     }
   }
 
+  /** An expression parsed by the `gray-matter` library. */
+  class GrayMatterSink extends Sink {
+    GrayMatterSink() { this = DataFlow::moduleImport("gray-matter").getACall().getArgument(0) }
+  }
+
   /**
    * A template tag occurring in JS code, viewed as a code injection sink.
    */