JS: Add steps and sinks for pipes

javascript/ql/src/semmle/javascript/JsonStringifiers.qll

@@ -25,6 +25,8 @@ class JsonStringifyCall extends DataFlow::CallNode {
       callee = DataFlow::moduleMember("util", "inspect") or
       callee = DataFlow::moduleImport(["pretty-format", "object-inspect"])
     )
+    or
+    this = Templating::getAPipeCall(["json", "dump"])
   }
 
   /**

javascript/ql/src/semmle/javascript/frameworks/Templating.qll

@@ -531,4 +531,15 @@ module Templating {
     not file.getExtension() = any(TemplateSyntax s).getAFileExtension() and
     result = getTemplateSyntaxInFolder(file.getParentContainer())
   }
+
+  /** A step through the `safe` pipe, which bypasses HTML escaping. */
+  private class SafePipeStep extends TaintTracking::SharedTaintStep {
+    override predicate step(DataFlow::Node pred, DataFlow::Node succ) {
+      exists(DataFlow::CallNode call |
+        call = getAPipeCall("safe") and
+        pred = call.getArgument(0) and
+        succ = call
+      )
+    }
+  }
 }

javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll

@@ -381,6 +381,16 @@ module DomBasedXss {
     }
   }
 
+  /**
+   * A value being piped into the `safe` pipe in a template file,
+   * disabling subsequent HTML escaping.
+   */
+  class SafePipe extends DomBasedXss::Sink {
+    SafePipe() {
+      this = Templating::getAPipeCall("safe").getArgument(0)
+    }
+  }
+
   /**
    * A property read from a safe property is considered a sanitizer.
    */