Add more regex use functions in String

java/ql/lib/semmle/code/java/regex/RegexFlowConfigs.qll

@@ -86,7 +86,7 @@ private class JdkRegexMatchMethodAccess extends RegexMatchMethodAccess {
     or
     package = "java.lang" and
     type = "String" and
-    name = ["matches", "split"] and
+    name = ["matches", "split", "replaceAll", "replaceFirst"] and
     regexArg = 0 and
     stringArg = -1
     or

java/ql/lib/semmle/code/java/regex/RegexFlowModels.qll

@@ -14,6 +14,8 @@ private class RegexSinkCsv extends SinkModelCsv {
         "java.util;String;false;matches;(String);;Argument[0];regex-compile",
         "java.util;String;false;split;(String);;Argument[0];regex-compile",
         "java.util;String;false;split;(String,int);;Argument[0];regex-compile",
+        "java.util;String;false;replaceAll;(String,String);;Argument[0];regex-compile",
+        "java.util;String;false;replaceFirst;(String,String);;Argument[0];regex-compile",
         "com.google.common.base;Splitter;false;onPattern;(String);;Argument[0];regex-compile"
       ]
   }

java/ql/test/query-tests/security/CWE-730/PolyRedosTest.java

@@ -12,6 +12,8 @@ class PolyRedosTest {
         tainted.matches(reg); // $ hasPolyRedos
         tainted.split(reg); // $ hasPolyRedos
         tainted.split(reg, 7); // $ hasPolyRedos
+        tainted.replaceAll(reg, "a"); // $ hasPolyRedos
+        tainted.replaceFirst(reg, "a"); // $ hasPolyRedos
         Pattern.matches(reg, tainted); // $ hasPolyRedos
         Pattern.compile(reg).matcher(tainted).matches(); // $ hasPolyRedos
         Pattern.compile(reg).split(tainted); // $ hasPolyRedos