Add sanitizer for ObjectId

ObjectId is a sanitizer used to sanitize strings into valid MongoDB ids. During research we've found that this method is used.

ObjectId returns a string representing an id. If at any time ObjectId can't parse it's input (like when a tainted dict in passed in), then ObjectId will throw an error preventing the query from running.

python/ql/src/experimental/semmle/python/frameworks/Stdlib.qll

@@ -89,4 +89,15 @@ private module NoSQL {
 
     override DataFlow::Node getSanitizerNode() { result = this.getArg(0) }
   }
+
+  private class BsonObjectIdCall extends DataFlow::CallCfgNode, NoSQLSanitizer::Range {
+    BsonObjectIdCall() {
+      this =
+        API::moduleImport(["bson", "bson.objectid", "bson.json_util"])
+            .getMember("ObjectId")
+            .getACall()
+    }
+
+    override DataFlow::Node getSanitizerNode() { result = this.getArg(0) }
+  }
 }