Merge pull request #6264 from RasmusWL/customization-files-for-path-problems

Python: Provide proper source/sink customization for most path queries

python/ql/src/Security/CWE-078/CommandInjection.ql

@@ -19,7 +19,7 @@ import python
 import semmle.python.security.dataflow.CommandInjection
 import DataFlow::PathGraph
 
-from CommandInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
+from CommandInjection::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "This command depends on $@.", source.getNode(),
   "a user-provided value"

python/ql/src/Security/CWE-079/ReflectedXss.ql

@@ -17,7 +17,7 @@ import python
 import semmle.python.security.dataflow.ReflectedXSS
 import DataFlow::PathGraph
 
-from ReflectedXssConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
+from ReflectedXSS::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "Cross-site scripting vulnerability due to $@.",
   source.getNode(), "a user-provided value"

python/ql/src/Security/CWE-089/SqlInjection.ql

@@ -16,7 +16,7 @@ import python
 import semmle.python.security.dataflow.SqlInjection
 import DataFlow::PathGraph
 
-from SQLInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
+from SqlInjection::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "This SQL query depends on $@.", source.getNode(),
   "a user-provided value"

python/ql/src/Security/CWE-094/CodeInjection.ql

@@ -19,7 +19,7 @@ import python
 import semmle.python.security.dataflow.CodeInjection
 import DataFlow::PathGraph
 
-from CodeInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
+from CodeInjection::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "$@ flows to here and is interpreted as code.",
   source.getNode(), "A user-provided value"

python/ql/src/Security/CWE-209/StackTraceExposure.ql

@@ -17,7 +17,7 @@ import python
 import semmle.python.security.dataflow.StackTraceExposure
 import DataFlow::PathGraph
 
-from StackTraceExposureConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
+from StackTraceExposure::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "$@ may be exposed to an external user", source.getNode(),
   "Error information"

python/ql/src/Security/CWE-502/UnsafeDeserialization.ql

@@ -16,6 +16,6 @@ import python
 import semmle.python.security.dataflow.UnsafeDeserialization
 import DataFlow::PathGraph
 
-from UnsafeDeserializationConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
+from UnsafeDeserialization::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "Deserializing of $@.", source.getNode(), "untrusted input"

python/ql/src/Security/CWE-601/UrlRedirect.ql

@@ -16,7 +16,7 @@ import python
 import semmle.python.security.dataflow.UrlRedirect
 import DataFlow::PathGraph
 
-from UrlRedirectConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
+from UrlRedirect::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "Untrusted URL redirection due to $@.", source.getNode(),
   "A user-provided value"

python/ql/src/Security/CWE-730/PolynomialReDoS.ql

@@ -17,8 +17,8 @@ import semmle.python.security.dataflow.PolynomialReDoS
 import DataFlow::PathGraph
 
 from
-  PolynomialReDoSConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink,
-  PolynomialReDoSSink sinkNode, PolynomialBackTrackingTerm regexp
+  PolynomialReDoS::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink,
+  PolynomialReDoS::Sink sinkNode, PolynomialBackTrackingTerm regexp
 where
   config.hasFlowPath(source, sink) and
   sinkNode = sink.getNode() and

python/ql/src/semmle/python/security/dataflow/CodeInjection.qll

@@ -1,26 +1,42 @@
 /**
- * Provides a taint-tracking configuration for detecting code injection
- * vulnerabilities.
+ * Provides a taint-tracking configuration for detecting "code injection" vulnerabilities.
+ *
+ * Note, for performance reasons: only import this file if
+ * `CodeInjection::Configuration` is needed, otherwise
+ * `CodeInjectionCustomizations` should be imported instead.
  */
 
-import python
+private import python
 import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
-import semmle.python.Concepts
-import semmle.python.dataflow.new.RemoteFlowSources
-import semmle.python.dataflow.new.BarrierGuards
 
 /**
- * A taint-tracking configuration for detecting code injection vulnerabilities.
+ * Provides a taint-tracking configuration for detecting "code injection" vulnerabilities.
  */
-class CodeInjectionConfiguration extends TaintTracking::Configuration {
-  CodeInjectionConfiguration() { this = "CodeInjectionConfiguration" }
+module CodeInjection {
+  import CodeInjectionCustomizations::CodeInjection
 
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+  /**
+   * A taint-tracking configuration for detecting "code injection" vulnerabilities.
+   */
+  class Configuration extends TaintTracking::Configuration {
+    Configuration() { this = "CodeInjection" }
 
-  override predicate isSink(DataFlow::Node sink) { sink = any(CodeExecution e).getCode() }
+    override predicate isSource(DataFlow::Node source) { source instanceof Source }
 
-  override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof StringConstCompare
+    override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+    override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
+
+    override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+      guard instanceof SanitizerGuard
+    }
   }
 }
+
+/**
+ * DEPRECATED: Don't extend this class for customization, since this will lead to bad
+ * performance, instead use the new `CodeInjectionCustomizations.qll` file, and extend
+ * its' classes.
+ */
+deprecated class CodeInjectionConfiguration = CodeInjection::Configuration;

python/ql/src/semmle/python/security/dataflow/CodeInjectionCustomizations.qll

@@ -0,0 +1,55 @@
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "code injection"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.Concepts
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.dataflow.new.BarrierGuards
+
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "code injection"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+module CodeInjection {
+  /**
+   * A data flow source for "code injection" vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for "code injection" vulnerabilities.
+   */
+  abstract class Sink extends DataFlow::Node { }
+
+  /**
+   * A sanitizer for "code injection" vulnerabilities.
+   */
+  abstract class Sanitizer extends DataFlow::Node { }
+
+  /**
+   * A sanitizer guard for "code injection" vulnerabilities.
+   */
+  abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
+
+  /**
+   * A source of remote user input, considered as a flow source.
+   */
+  class RemoteFlowSourceAsSource extends Source, RemoteFlowSource { }
+
+  /**
+   * A code execution, considered as a flow sink.
+   */
+  class CodeExecutionAsSink extends Sink {
+    CodeExecutionAsSink() { this = any(CodeExecution e).getCode() }
+  }
+
+  /**
+   * A comparison with a constant string, considered as a sanitizer-guard.
+   */
+  class StringConstCompareAsSanitizerGuard extends SanitizerGuard, StringConstCompare { }
+}

python/ql/src/semmle/python/security/dataflow/CommandInjection.qll

@@ -1,56 +1,42 @@
 /**
- * Provides a taint-tracking configuration for detecting command injection
- * vulnerabilities.
+ * Provides a taint-tracking configuration for detecting "command injection" vulnerabilities.
+ *
+ * Note, for performance reasons: only import this file if
+ * `CommandInjection::Configuration` is needed, otherwise
+ * `CommandInjectionCustomizations` should be imported instead.
  */
 
-import python
+private import python
 import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
-import semmle.python.Concepts
-import semmle.python.dataflow.new.RemoteFlowSources
-import semmle.python.dataflow.new.BarrierGuards
 
 /**
- * A taint-tracking configuration for detecting command injection vulnerabilities.
+ * Provides a taint-tracking configuration for detecting "command injection" vulnerabilities.
  */
-class CommandInjectionConfiguration extends TaintTracking::Configuration {
-  CommandInjectionConfiguration() { this = "CommandInjectionConfiguration" }
+module CommandInjection {
+  import CommandInjectionCustomizations::CommandInjection
 
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+  /**
+   * A taint-tracking configuration for detecting "command injection" vulnerabilities.
+   */
+  class Configuration extends TaintTracking::Configuration {
+    Configuration() { this = "CommandInjection" }
 
-  override predicate isSink(DataFlow::Node sink) {
-    sink = any(SystemCommandExecution e).getCommand() and
-    // Since the implementation of standard library functions such `os.popen` looks like
-    // ```py
-    // def popen(cmd, mode="r", buffering=-1):
-    //     ...
-    //     proc = subprocess.Popen(cmd, ...)
-    // ```
-    // any time we would report flow to the `os.popen` sink, we can ALSO report the flow
-    // from the `cmd` parameter to the `subprocess.Popen` sink -- obviously we don't
-    // want that.
-    //
-    // However, simply removing taint edges out of a sink is not a good enough solution,
-    // since we would only flag one of the `os.system` calls in the following example
-    // due to use-use flow
-    // ```py
-    // os.system(cmd)
-    // os.system(cmd)
-    // ```
-    //
-    // Best solution I could come up with is to exclude all sinks inside the modules of
-    // known sinks. This does have a downside: If we have overlooked a function in any
-    // of these, that internally runs a command, we no longer give an alert :| -- and we
-    // need to keep them updated (which is hard to remember)
-    //
-    // This does not only affect `os.popen`, but also the helper functions in
-    // `subprocess`. See:
-    // https://github.com/python/cpython/blob/fa7ce080175f65d678a7d5756c94f82887fc9803/Lib/os.py#L974
-    // https://github.com/python/cpython/blob/fa7ce080175f65d678a7d5756c94f82887fc9803/Lib/subprocess.py#L341
-    not sink.getScope().getEnclosingModule().getName() in ["os", "subprocess", "platform", "popen2"]
-  }
+    override predicate isSource(DataFlow::Node source) { source instanceof Source }
 
-  override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof StringConstCompare
+    override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+    override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
+
+    override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+      guard instanceof SanitizerGuard
+    }
   }
 }
+
+/**
+ * DEPRECATED: Don't extend this class for customization, since this will lead to bad
+ * performance, instead use the new `CommandInjectionCustomizations.qll` file, and extend
+ * its' classes.
+ */
+deprecated class CommandInjectionConfiguration = CommandInjection::Configuration;

python/ql/src/semmle/python/security/dataflow/CommandInjectionCustomizations.qll

@@ -0,0 +1,87 @@
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "command injection"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.Concepts
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.dataflow.new.BarrierGuards
+
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "command injection"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+module CommandInjection {
+  /**
+   * A data flow source for "command injection" vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for "command injection" vulnerabilities.
+   */
+  abstract class Sink extends DataFlow::Node { }
+
+  /**
+   * A sanitizer for "command injection" vulnerabilities.
+   */
+  abstract class Sanitizer extends DataFlow::Node { }
+
+  /**
+   * A sanitizer guard for "command injection" vulnerabilities.
+   */
+  abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
+
+  /**
+   * A source of remote user input, considered as a flow source.
+   */
+  class RemoteFlowSourceAsSource extends Source, RemoteFlowSource { }
+
+  /**
+   * A command execution, considered as a flow sink.
+   */
+  class CommandExecutionAsSink extends Sink {
+    CommandExecutionAsSink() {
+      this = any(SystemCommandExecution e).getCommand() and
+      // Since the implementation of standard library functions such `os.popen` looks like
+      // ```py
+      // def popen(cmd, mode="r", buffering=-1):
+      //     ...
+      //     proc = subprocess.Popen(cmd, ...)
+      // ```
+      // any time we would report flow to the `os.popen` sink, we can ALSO report the flow
+      // from the `cmd` parameter to the `subprocess.Popen` sink -- obviously we don't
+      // want that.
+      //
+      // However, simply removing taint edges out of a sink is not a good enough solution,
+      // since we would only flag one of the `os.system` calls in the following example
+      // due to use-use flow
+      // ```py
+      // os.system(cmd)
+      // os.system(cmd)
+      // ```
+      //
+      // Best solution I could come up with is to exclude all sinks inside the modules of
+      // known sinks. This does have a downside: If we have overlooked a function in any
+      // of these, that internally runs a command, we no longer give an alert :| -- and we
+      // need to keep them updated (which is hard to remember)
+      //
+      // This does not only affect `os.popen`, but also the helper functions in
+      // `subprocess`. See:
+      // https://github.com/python/cpython/blob/fa7ce080175f65d678a7d5756c94f82887fc9803/Lib/os.py#L974
+      // https://github.com/python/cpython/blob/fa7ce080175f65d678a7d5756c94f82887fc9803/Lib/subprocess.py#L341
+      not this.getScope().getEnclosingModule().getName() in [
+          "os", "subprocess", "platform", "popen2"
+        ]
+    }
+  }
+
+  /**
+   * A comparison with a constant string, considered as a sanitizer-guard.
+   */
+  class StringConstCompareAsSanitizerGuard extends SanitizerGuard, StringConstCompare { }
+}

python/ql/src/semmle/python/security/dataflow/PathInjection.qll

@@ -1,37 +1,19 @@
 /**
- * Provides a taint-tracking configuration for detecting path injection
- * vulnerabilities.
+ * Provides taint-tracking configurations for detecting "path injection" vulnerabilities.
  *
- * We detect cases where a user-controlled path is used in an unsafe manner,
- * meaning it is not both normalized and _afterwards_ checked.
- *
- * It does so by dividing the problematic situation into two cases:
- *  1. The file path is never normalized.
- *     This is easily detected by using normalization as a sanitizer.
- *
- *  2. The file path is normalized at least once, but never checked afterwards.
- *     This is detected by finding the earliest normalization and then ensuring that
- *     no checks happen later. Since we start from the earliest normalization,
- *     we know that the absence of checks means that no normalization has a
- *     check after it. (No checks after a second normalization would be ok if
- *     there was a check between the first and the second.)
- *
- * Note that one could make the dual split on whether the file path is ever checked. This does
- * not work as nicely, however, since checking is modelled as a `BarrierGuard` rather than
- * as a `Sanitizer`. That means that only some dataflow paths out of a check will be removed,
- * and so identifying the last check is not possible simply by finding a dataflow path from it
- * to a sink.
+ * Note, for performance reasons: only import this file if
+ * the Configurations or the `pathInjection` predicate are needed, otherwise
+ * `PathInjectionCustomizations` should be imported instead.
  */
 
-import python
-import semmle.python.dataflow.new.DataFlow
-import semmle.python.dataflow.new.DataFlow2
-import semmle.python.dataflow.new.TaintTracking
-import semmle.python.dataflow.new.TaintTracking2
-import semmle.python.Concepts
-import semmle.python.dataflow.new.RemoteFlowSources
+private import python
+private import semmle.python.Concepts
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.DataFlow2
+private import semmle.python.dataflow.new.TaintTracking
+private import semmle.python.dataflow.new.TaintTracking2
 import ChainedConfigs12
-import semmle.python.dataflow.new.BarrierGuards
+import PathInjectionCustomizations::PathInjection
 
 // ---------------------------------------------------------------------------
 // Case 1. The path is never normalized.
@@ -40,16 +22,14 @@ import semmle.python.dataflow.new.BarrierGuards
 class PathNotNormalizedConfiguration extends TaintTracking::Configuration {
   PathNotNormalizedConfiguration() { this = "PathNotNormalizedConfiguration" }
 
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+  override predicate isSource(DataFlow::Node source) { source instanceof Source }
 
-  override predicate isSink(DataFlow::Node sink) {
-    sink = any(FileSystemAccess e).getAPathArgument()
-  }
+  override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
 
   override predicate isSanitizer(DataFlow::Node node) { node instanceof Path::PathNormalization }
 
   override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof StringConstCompare
+    guard instanceof SanitizerGuard
   }
 }
 
@@ -68,14 +48,14 @@ predicate pathNotNormalized(CustomPathNode source, CustomPathNode sink) {
 class FirstNormalizationConfiguration extends TaintTracking::Configuration {
   FirstNormalizationConfiguration() { this = "FirstNormalizationConfiguration" }
 
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+  override predicate isSource(DataFlow::Node source) { source instanceof Source }
 
   override predicate isSink(DataFlow::Node sink) { sink instanceof Path::PathNormalization }
 
   override predicate isSanitizerOut(DataFlow::Node node) { node instanceof Path::PathNormalization }
 
   override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof StringConstCompare
+    guard instanceof SanitizerGuard
   }
 }
 
@@ -85,14 +65,12 @@ class NormalizedPathNotCheckedConfiguration extends TaintTracking2::Configuratio
 
   override predicate isSource(DataFlow::Node source) { source instanceof Path::PathNormalization }
 
-  override predicate isSink(DataFlow::Node sink) {
-    sink = any(FileSystemAccess e).getAPathArgument()
-  }
+  override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
 
   override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
     guard instanceof Path::SafeAccessCheck
     or
-    guard instanceof StringConstCompare
+    guard instanceof SanitizerGuard
   }
 }
 

python/ql/src/semmle/python/security/dataflow/PathInjectionCustomizations.qll

@@ -0,0 +1,56 @@
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "path injection"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.Concepts
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.dataflow.new.BarrierGuards
+
+/**
+ * Provides default sources, and sinks for detecting
+ * "path injection"
+ * vulnerabilities, as well as extension points for adding your own.
+ *
+ * Since the path-injection configuration setup is rather complicated, we do not
+ * expose a `Sanitizer` class, and instead you should extend
+ * `Path::PathNormalization::Range` and `Path::SafeAccessCheck::Range` from
+ * `semmle.python.Concepts` instead.
+ */
+module PathInjection {
+  /**
+   * A data flow source for "path injection" vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for "path injection" vulnerabilities.
+   * Such as a file system access.
+   */
+  abstract class Sink extends DataFlow::Node { }
+
+  /**
+   * A sanitizer guard for "path injection" vulnerabilities.
+   */
+  abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
+
+  /**
+   * A source of remote user input, considered as a flow source.
+   */
+  class RemoteFlowSourceAsSource extends Source, RemoteFlowSource { }
+
+  /**
+   * A file system access, considered as a flow sink.
+   */
+  class FileSystemAccessAsSink extends Sink {
+    FileSystemAccessAsSink() { this = any(FileSystemAccess e).getAPathArgument() }
+  }
+
+  /**
+   * A comparison with a constant string, considered as a sanitizer-guard.
+   */
+  class StringConstCompareAsSanitizerGuard extends SanitizerGuard, StringConstCompare { }
+}

python/ql/src/semmle/python/security/dataflow/PolynomialReDoS.qll

@@ -1,177 +1,35 @@
 /**
- * Provides a taint-tracking configuration for detecting polynomial regular expression denial of service (ReDoS)
- * vulnerabilities.
+ * Provides a taint-tracking configuration for detecting "polynomial regular expression denial of service (ReDoS)" vulnerabilities.
+ *
+ * Note, for performance reasons: only import this file if
+ * `PolynomialReDoS::Configuration` is needed, otherwise
+ * `PolynomialReDoSCustomizations` should be imported instead.
  */
 
-import python
+private import python
 import semmle.python.dataflow.new.DataFlow
-import semmle.python.dataflow.new.DataFlow2
 import semmle.python.dataflow.new.TaintTracking
-import semmle.python.Concepts
-import semmle.python.dataflow.new.RemoteFlowSources
-import semmle.python.dataflow.new.BarrierGuards
-import semmle.python.RegexTreeView
-import semmle.python.ApiGraphs
-
-/** A configuration for finding uses of compiled regexes. */
-class RegexDefinitionConfiguration extends DataFlow2::Configuration {
-  RegexDefinitionConfiguration() { this = "RegexDefinitionConfiguration" }
-
-  override predicate isSource(DataFlow::Node source) { source instanceof RegexDefinitonSource }
-
-  override predicate isSink(DataFlow::Node sink) { sink instanceof RegexDefinitionSink }
-}
-
-/** A regex compilation. */
-class RegexDefinitonSource extends DataFlow::CallCfgNode {
-  DataFlow::Node regexNode;
-
-  RegexDefinitonSource() {
-    this = API::moduleImport("re").getMember("compile").getACall() and
-    regexNode in [this.getArg(0), this.getArgByName("pattern")]
-  }
-
-  /** Gets the regex that is being compiled by this node. */
-  RegExpTerm getRegExp() { result.getRegex() = regexNode.asExpr() and result.isRootTerm() }
-
-  /** Gets the data flow node for the regex being compiled by this node. */
-  DataFlow::Node getRegexNode() { result = regexNode }
-}
-
-/** A use of a compiled regex. */
-class RegexDefinitionSink extends DataFlow::Node {
-  RegexExecutionMethod method;
-  DataFlow::CallCfgNode executingCall;
-
-  RegexDefinitionSink() {
-    exists(DataFlow::AttrRead reMethod |
-      executingCall.getFunction() = reMethod and
-      reMethod.getAttributeName() = method and
-      this = reMethod.getObject()
-    )
-  }
-
-  /** Gets the method used to execute the regex. */
-  RegexExecutionMethod getMethod() { result = method }
-
-  /** Gets the data flow node for the executing call. */
-  DataFlow::CallCfgNode getExecutingCall() { result = executingCall }
-}
 
 /**
- * A taint-tracking configuration for detecting regular expression denial-of-service vulnerabilities.
+ * Provides a taint-tracking configuration for detecting "polynomial regular expression denial of service (ReDoS)" vulnerabilities.
  */
-class PolynomialReDoSConfiguration extends TaintTracking::Configuration {
-  PolynomialReDoSConfiguration() { this = "PolynomialReDoSConfiguration" }
-
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
-
-  override predicate isSink(DataFlow::Node sink) { sink instanceof PolynomialReDoSSink }
-}
-
-/** A data flow node executing a regex. */
-abstract class RegexExecution extends DataFlow::Node {
-  /** Gets the data flow node for the regex being compiled by this node. */
-  abstract DataFlow::Node getRegexNode();
-
-  /** Gets a dataflow node for the string to be searched or matched against. */
-  abstract DataFlow::Node getString();
-}
-
-private class RegexExecutionMethod extends string {
-  RegexExecutionMethod() {
-    this in ["match", "fullmatch", "search", "split", "findall", "finditer", "sub", "subn"]
-  }
-}
-
-/** Gets the index of the argument representing the string to be searched by a regex. */
-int stringArg(RegexExecutionMethod method) {
-  method in ["match", "fullmatch", "search", "split", "findall", "finditer"] and
-  result = 1
-  or
-  method in ["sub", "subn"] and
-  result = 2
-}
-
-/**
- * A class to find `re` methods immediately executing an expression.
- *
- * See `RegexExecutionMethods`
- */
-class DirectRegex extends DataFlow::CallCfgNode, RegexExecution {
-  RegexExecutionMethod method;
-
-  DirectRegex() { this = API::moduleImport("re").getMember(method).getACall() }
-
-  override DataFlow::Node getRegexNode() {
-    result in [this.getArg(0), this.getArgByName("pattern")]
-  }
-
-  override DataFlow::Node getString() {
-    result in [this.getArg(stringArg(method)), this.getArgByName("string")]
-  }
-}
-
-/**
- * A class to find `re` methods immediately executing a compiled expression by `re.compile`.
- *
- * Given the following example:
- *
- * ```py
- * pattern = re.compile(input)
- * pattern.match(s)
- * ```
- *
- * This class will identify that `re.compile` compiles `input` and afterwards
- * executes `re`'s `match`. As a result, `this` will refer to `pattern.match(s)`
- * and `this.getRegexNode()` will return the node for `input` (`re.compile`'s first argument)
- *
- *
- * See `RegexExecutionMethods`
- *
- * See https://docs.python.org/3/library/re.html#regular-expression-objects
- */
-private class CompiledRegex extends DataFlow::CallCfgNode, RegexExecution {
-  DataFlow::Node regexNode;
-  RegexExecutionMethod method;
-
-  CompiledRegex() {
-    exists(
-      RegexDefinitionConfiguration conf, RegexDefinitonSource source, RegexDefinitionSink sink
-    |
-      conf.hasFlow(source, sink) and
-      regexNode = source.getRegexNode() and
-      method = sink.getMethod() and
-      this = sink.getExecutingCall()
-    )
-  }
-
-  override DataFlow::Node getRegexNode() { result = regexNode }
-
-  override DataFlow::Node getString() {
-    result in [this.getArg(stringArg(method) - 1), this.getArgByName("string")]
-  }
-}
-
-/**
- * A data flow sink node for polynomial regular expression denial-of-service vulnerabilities.
- */
-class PolynomialReDoSSink extends DataFlow::Node {
-  RegExpTerm t;
-
-  PolynomialReDoSSink() {
-    exists(RegexExecution re |
-      re.getRegexNode().asExpr() = t.getRegex() and
-      this = re.getString()
-    ) and
-    t.isRootTerm()
-  }
-
-  /** Gets the regex that is being executed by this node. */
-  RegExpTerm getRegExp() { result = t }
+module PolynomialReDoS {
+  import PolynomialReDoSCustomizations::PolynomialReDoS
 
   /**
-   * Gets the node to highlight in the alert message.
+   * A taint-tracking configuration for detecting "polynomial regular expression denial of service (ReDoS)" vulnerabilities.
    */
-  DataFlow::Node getHighlight() { result = this }
+  class Configuration extends TaintTracking::Configuration {
+    Configuration() { this = "PolynomialReDoS" }
+
+    override predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+    override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+    override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
+
+    override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+      guard instanceof SanitizerGuard
+    }
+  }
 }

python/ql/src/semmle/python/security/dataflow/PolynomialReDoSCustomizations.qll

@@ -0,0 +1,212 @@
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "polynomial regular expression denial of service (ReDoS)"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.DataFlow2
+private import semmle.python.dataflow.new.TaintTracking
+private import semmle.python.Concepts
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.dataflow.new.BarrierGuards
+private import semmle.python.RegexTreeView
+private import semmle.python.ApiGraphs
+
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "polynomial regular expression denial of service (ReDoS)"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+module PolynomialReDoS {
+  /**
+   * A data flow source for "polynomial regular expression denial of service (ReDoS)" vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for "polynomial regular expression denial of service (ReDoS)" vulnerabilities.
+   */
+  abstract class Sink extends DataFlow::Node {
+    /** Gets the regex that is being executed by this node. */
+    abstract RegExpTerm getRegExp();
+
+    /**
+     * Gets the node to highlight in the alert message.
+     */
+    DataFlow::Node getHighlight() { result = this }
+  }
+
+  /**
+   * A sanitizer for "polynomial regular expression denial of service (ReDoS)" vulnerabilities.
+   */
+  abstract class Sanitizer extends DataFlow::Node { }
+
+  /**
+   * A sanitizer guard for "polynomial regular expression denial of service (ReDoS)" vulnerabilities.
+   */
+  abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
+
+  /**
+   * A source of remote user input, considered as a flow source.
+   */
+  class RemoteFlowSourceAsSource extends Source, RemoteFlowSource { }
+
+  /**
+   * A regex execution, considered as a flow sink.
+   */
+  class RegexExecutionAsSink extends DataFlow::Node {
+    RegExpTerm t;
+
+    RegexExecutionAsSink() {
+      exists(CompiledRegexes::RegexExecution re |
+        re.getRegexNode().asExpr() = t.getRegex() and
+        this = re.getString()
+      ) and
+      t.isRootTerm()
+    }
+
+    /** Gets the regex that is being executed by this node. */
+    RegExpTerm getRegExp() { result = t }
+  }
+
+  /**
+   * A comparison with a constant string, considered as a sanitizer-guard.
+   */
+  class StringConstCompareAsSanitizerGuard extends SanitizerGuard, StringConstCompare { }
+}
+
+/** Helper module for tracking compiled regexes. */
+private module CompiledRegexes {
+  // TODO: This module should be refactored and merged with the experimental work done on detecting
+  // regex injections, such that this can be expressed from just using a concept.
+  /** A configuration for finding uses of compiled regexes. */
+  class RegexDefinitionConfiguration extends DataFlow2::Configuration {
+    RegexDefinitionConfiguration() { this = "RegexDefinitionConfiguration" }
+
+    override predicate isSource(DataFlow::Node source) { source instanceof RegexDefinitonSource }
+
+    override predicate isSink(DataFlow::Node sink) { sink instanceof RegexDefinitionSink }
+  }
+
+  /** A regex compilation. */
+  class RegexDefinitonSource extends DataFlow::CallCfgNode {
+    DataFlow::Node regexNode;
+
+    RegexDefinitonSource() {
+      this = API::moduleImport("re").getMember("compile").getACall() and
+      regexNode in [this.getArg(0), this.getArgByName("pattern")]
+    }
+
+    /** Gets the regex that is being compiled by this node. */
+    RegExpTerm getRegExp() { result.getRegex() = regexNode.asExpr() and result.isRootTerm() }
+
+    /** Gets the data flow node for the regex being compiled by this node. */
+    DataFlow::Node getRegexNode() { result = regexNode }
+  }
+
+  /** A use of a compiled regex. */
+  class RegexDefinitionSink extends DataFlow::Node {
+    RegexExecutionMethod method;
+    DataFlow::CallCfgNode executingCall;
+
+    RegexDefinitionSink() {
+      exists(DataFlow::AttrRead reMethod |
+        executingCall.getFunction() = reMethod and
+        reMethod.getAttributeName() = method and
+        this = reMethod.getObject()
+      )
+    }
+
+    /** Gets the method used to execute the regex. */
+    RegexExecutionMethod getMethod() { result = method }
+
+    /** Gets the data flow node for the executing call. */
+    DataFlow::CallCfgNode getExecutingCall() { result = executingCall }
+  }
+
+  /** A data flow node executing a regex. */
+  abstract class RegexExecution extends DataFlow::Node {
+    /** Gets the data flow node for the regex being compiled by this node. */
+    abstract DataFlow::Node getRegexNode();
+
+    /** Gets a dataflow node for the string to be searched or matched against. */
+    abstract DataFlow::Node getString();
+  }
+
+  private class RegexExecutionMethod extends string {
+    RegexExecutionMethod() {
+      this in ["match", "fullmatch", "search", "split", "findall", "finditer", "sub", "subn"]
+    }
+  }
+
+  /** Gets the index of the argument representing the string to be searched by a regex. */
+  int stringArg(RegexExecutionMethod method) {
+    method in ["match", "fullmatch", "search", "split", "findall", "finditer"] and
+    result = 1
+    or
+    method in ["sub", "subn"] and
+    result = 2
+  }
+
+  /**
+   * A class to find `re` methods immediately executing an expression.
+   *
+   * See `RegexExecutionMethods`
+   */
+  class DirectRegex extends DataFlow::CallCfgNode, RegexExecution {
+    RegexExecutionMethod method;
+
+    DirectRegex() { this = API::moduleImport("re").getMember(method).getACall() }
+
+    override DataFlow::Node getRegexNode() {
+      result in [this.getArg(0), this.getArgByName("pattern")]
+    }
+
+    override DataFlow::Node getString() {
+      result in [this.getArg(stringArg(method)), this.getArgByName("string")]
+    }
+  }
+
+  /**
+   * A class to find `re` methods immediately executing a compiled expression by `re.compile`.
+   *
+   * Given the following example:
+   *
+   * ```py
+   * pattern = re.compile(input)
+   * pattern.match(s)
+   * ```
+   *
+   * This class will identify that `re.compile` compiles `input` and afterwards
+   * executes `re`'s `match`. As a result, `this` will refer to `pattern.match(s)`
+   * and `this.getRegexNode()` will return the node for `input` (`re.compile`'s first argument)
+   *
+   *
+   * See `RegexExecutionMethods`
+   *
+   * See https://docs.python.org/3/library/re.html#regular-expression-objects
+   */
+  private class CompiledRegex extends DataFlow::CallCfgNode, RegexExecution {
+    DataFlow::Node regexNode;
+    RegexExecutionMethod method;
+
+    CompiledRegex() {
+      exists(
+        RegexDefinitionConfiguration conf, RegexDefinitonSource source, RegexDefinitionSink sink
+      |
+        conf.hasFlow(source, sink) and
+        regexNode = source.getRegexNode() and
+        method = sink.getMethod() and
+        this = sink.getExecutingCall()
+      )
+    }
+
+    override DataFlow::Node getRegexNode() { result = regexNode }
+
+    override DataFlow::Node getString() {
+      result in [this.getArg(stringArg(method) - 1), this.getArgByName("string")]
+    }
+  }
+}

python/ql/src/semmle/python/security/dataflow/ReflectedXSS.qll

@@ -1,41 +1,42 @@
 /**
- * Provides a taint-tracking configuration for detecting reflected server-side
- * cross-site scripting vulnerabilities.
+ * Provides a taint-tracking configuration for detecting "reflected server-side cross-site scripting" vulnerabilities.
+ *
+ * Note, for performance reasons: only import this file if
+ * `ReflectedXSS::Configuration` is needed, otherwise
+ * `ReflectedXSSCustomizations` should be imported instead.
  */
 
-import python
+private import python
 import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
-import semmle.python.Concepts
-import semmle.python.dataflow.new.RemoteFlowSources
-import semmle.python.dataflow.new.BarrierGuards
 
 /**
- * A taint-tracking configuration for detecting reflected server-side cross-site
- * scripting vulnerabilities.
+ * Provides a taint-tracking configuration for detecting "reflected server-side cross-site scripting" vulnerabilities.
  */
-class ReflectedXssConfiguration extends TaintTracking::Configuration {
-  ReflectedXssConfiguration() { this = "ReflectedXssConfiguration" }
+module ReflectedXSS {
+  import ReflectedXSSCustomizations::ReflectedXSS
 
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+  /**
+   * A taint-tracking configuration for detecting "reflected server-side cross-site scripting" vulnerabilities.
+   */
+  class Configuration extends TaintTracking::Configuration {
+    Configuration() { this = "ReflectedXSS" }
 
-  override predicate isSink(DataFlow::Node sink) {
-    exists(HTTP::Server::HttpResponse response |
-      response.getMimetype().toLowerCase() = "text/html" and
-      sink = response.getBody()
-    )
+    override predicate isSource(DataFlow::Node source) { source instanceof Source }
+
+    override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+    override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
+
+    override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+      guard instanceof SanitizerGuard
+    }
   }
-
-  override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof StringConstCompare
-  }
-
-  // TODO: For now, since there is not an `isSanitizingStep` member-predicate part of a
-  // `TaintTracking::Configuration`, we use treat the output is a taint-sanitizer. This
-  // is slightly imprecise, which you can see in the `m_unsafe + SAFE` test-case in
-  // python/ql/test/library-tests/frameworks/markupsafe/taint_test.py
-  //
-  // However, it is better than `getAnInput()`. Due to use-use flow, that would remove
-  // the taint-flow to `SINK()` in `some_escape(tainted); SINK(tainted)`.
-  override predicate isSanitizer(DataFlow::Node node) { node = any(HtmlEscaping esc).getOutput() }
 }
+
+/**
+ * DEPRECATED: Don't extend this class for customization, since this will lead to bad
+ * performance, instead use the new `ReflectedXSSCustomizations.qll` file, and extend
+ * its' classes.
+ */
+deprecated class ReflectedXssConfiguration = ReflectedXSS::Configuration;

python/ql/src/semmle/python/security/dataflow/ReflectedXSSCustomizations.qll

@@ -0,0 +1,76 @@
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "reflected server-side cross-site scripting"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.Concepts
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.dataflow.new.BarrierGuards
+
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "reflected server-side cross-site scripting"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+module ReflectedXSS {
+  /**
+   * A data flow source for "reflected server-side cross-site scripting" vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for "reflected server-side cross-site scripting" vulnerabilities.
+   */
+  abstract class Sink extends DataFlow::Node { }
+
+  /**
+   * A sanitizer for "reflected server-side cross-site scripting" vulnerabilities.
+   */
+  abstract class Sanitizer extends DataFlow::Node { }
+
+  /**
+   * A sanitizer guard for "reflected server-side cross-site scripting" vulnerabilities.
+   */
+  abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
+
+  /**
+   * A source of remote user input, considered as a flow source.
+   */
+  class RemoteFlowSourceAsSource extends Source, RemoteFlowSource { }
+
+  /**
+   * The body of a HTTP response that will be returned from a server, considered as a flow sink.
+   */
+  class ServerHttpResponseBodyAsSink extends Sink {
+    ServerHttpResponseBodyAsSink() {
+      exists(HTTP::Server::HttpResponse response |
+        response.getMimetype().toLowerCase() = "text/html" and
+        this = response.getBody()
+      )
+    }
+  }
+
+  /**
+   * An HTML escaping, considered as a sanitizer.
+   */
+  class HtmlEscapingAsSanitizer extends Sanitizer {
+    HtmlEscapingAsSanitizer() {
+      // TODO: For now, since there is not an `isSanitizingStep` member-predicate part of a
+      // `TaintTracking::Configuration`, we use treat the output is a taint-sanitizer. This
+      // is slightly imprecise, which you can see in the `m_unsafe + SAFE` test-case in
+      // python/ql/test/library-tests/frameworks/markupsafe/taint_test.py
+      //
+      // However, it is better than `getAnInput()`. Due to use-use flow, that would remove
+      // the taint-flow to `SINK()` in `some_escape(tainted); SINK(tainted)`.
+      this = any(HtmlEscaping esc).getOutput()
+    }
+  }
+
+  /**
+   * A comparison with a constant string, considered as a sanitizer-guard.
+   */
+  class StringConstCompareAsSanitizerGuard extends SanitizerGuard, StringConstCompare { }
+}

python/ql/src/semmle/python/security/dataflow/SqlInjection.qll

@@ -1,26 +1,42 @@
 /**
- * Provides a taint-tracking configuration for detecting SQL injection
- * vulnerabilities.
+ * Provides a taint-tracking configuration for detecting "SQL injection" vulnerabilities.
+ *
+ * Note, for performance reasons: only import this file if
+ * `SqlInjection::Configuration` is needed, otherwise
+ * `SqlInjectionCustomizations` should be imported instead.
  */
 
-import python
+private import python
 import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
-import semmle.python.Concepts
-import semmle.python.dataflow.new.RemoteFlowSources
-import semmle.python.dataflow.new.BarrierGuards
 
 /**
- * A taint-tracking configuration for detecting SQL injection vulnerabilities.
+ * Provides a taint-tracking configuration for detecting "SQL injection" vulnerabilities.
  */
-class SQLInjectionConfiguration extends TaintTracking::Configuration {
-  SQLInjectionConfiguration() { this = "SQLInjectionConfiguration" }
+module SqlInjection {
+  import SqlInjectionCustomizations::SqlInjection
 
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+  /**
+   * A taint-tracking configuration for detecting "SQL injection" vulnerabilities.
+   */
+  class Configuration extends TaintTracking::Configuration {
+    Configuration() { this = "SqlInjection" }
 
-  override predicate isSink(DataFlow::Node sink) { sink = any(SqlExecution e).getSql() }
+    override predicate isSource(DataFlow::Node source) { source instanceof Source }
 
-  override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof StringConstCompare
+    override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+    override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
+
+    override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+      guard instanceof SanitizerGuard
+    }
   }
 }
+
+/**
+ * DEPRECATED: Don't extend this class for customization, since this will lead to bad
+ * performance, instead use the new `SqlInjectionCustomizations.qll` file, and extend
+ * its' classes.
+ */
+deprecated class SQLInjectionConfiguration = SqlInjection::Configuration;

python/ql/src/semmle/python/security/dataflow/SqlInjectionCustomizations.qll

@@ -0,0 +1,55 @@
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "SQL injection"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.Concepts
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.dataflow.new.BarrierGuards
+
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "SQL injection"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+module SqlInjection {
+  /**
+   * A data flow source for "SQL injection" vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for "SQL injection" vulnerabilities.
+   */
+  abstract class Sink extends DataFlow::Node { }
+
+  /**
+   * A sanitizer for "SQL injection" vulnerabilities.
+   */
+  abstract class Sanitizer extends DataFlow::Node { }
+
+  /**
+   * A sanitizer guard for "SQL injection" vulnerabilities.
+   */
+  abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
+
+  /**
+   * A source of remote user input, considered as a flow source.
+   */
+  class RemoteFlowSourceAsSource extends Source, RemoteFlowSource { }
+
+  /**
+   * A SQL statement of a SQL execution, considered as a flow sink.
+   */
+  class SqlExecutionAsSink extends Sink {
+    SqlExecutionAsSink() { this = any(SqlExecution e).getSql() }
+  }
+
+  /**
+   * A comparison with a constant string, considered as a sanitizer-guard.
+   */
+  class StringConstCompareAsSanitizerGuard extends SanitizerGuard, StringConstCompare { }
+}

python/ql/src/semmle/python/security/dataflow/StackTraceExposure.qll

@@ -1,33 +1,51 @@
 /**
- * Provides a taint-tracking configuration for detecting stack trace exposure
- * vulnerabilities.
+ * Provides a taint-tracking configuration for detecting "stack trace exposure" vulnerabilities.
+ *
+ * Note, for performance reasons: only import this file if
+ * `StackTraceExposure::Configuration` is needed, otherwise
+ * `StackTraceExposureCustomizations` should be imported instead.
  */
 
-import python
+private import python
 import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
-import semmle.python.Concepts
-import semmle.python.dataflow.new.internal.Attributes
-private import ExceptionInfo
 
 /**
- * A taint-tracking configuration for detecting stack trace exposure.
+ * Provides a taint-tracking configuration for detecting "stack trace exposure" vulnerabilities.
  */
-class StackTraceExposureConfiguration extends TaintTracking::Configuration {
-  StackTraceExposureConfiguration() { this = "StackTraceExposureConfiguration" }
+module StackTraceExposure {
+  import StackTraceExposureCustomizations::StackTraceExposure
 
-  override predicate isSource(DataFlow::Node source) { source instanceof ExceptionInfo }
+  /**
+   * A taint-tracking configuration for detecting "stack trace exposure" vulnerabilities.
+   */
+  class Configuration extends TaintTracking::Configuration {
+    Configuration() { this = "StackTraceExposure" }
 
-  override predicate isSink(DataFlow::Node sink) {
-    sink = any(HTTP::Server::HttpResponse response).getBody()
-  }
+    override predicate isSource(DataFlow::Node source) { source instanceof Source }
 
-  // A stack trace is accessible as the `__traceback__` attribute of a caught exception.
-  //  seehttps://docs.python.org/3/reference/datamodel.html#traceback-objects
-  override predicate isAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
-    exists(AttrRead attr | attr.getAttributeName() = "__traceback__" |
-      nodeFrom = attr.getObject() and
-      nodeTo = attr
-    )
+    override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+    override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
+
+    override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+      guard instanceof SanitizerGuard
+    }
+
+    // A stack trace is accessible as the `__traceback__` attribute of a caught exception.
+    //  seehttps://docs.python.org/3/reference/datamodel.html#traceback-objects
+    override predicate isAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
+      exists(DataFlow::AttrRead attr | attr.getAttributeName() = "__traceback__" |
+        nodeFrom = attr.getObject() and
+        nodeTo = attr
+      )
+    }
   }
 }
+
+/**
+ * DEPRECATED: Don't extend this class for customization, since this will lead to bad
+ * performance, instead use the new `StackTraceExposureCustomizations.qll` file, and extend
+ * its' classes.
+ */
+deprecated class StackTraceExposureConfiguration = StackTraceExposure::Configuration;

python/ql/src/semmle/python/security/dataflow/StackTraceExposureCustomizations.qll

@@ -0,0 +1,52 @@
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "stack trace exposure"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.Concepts
+private import semmle.python.dataflow.new.BarrierGuards
+private import ExceptionInfo
+
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "stack trace exposure"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+module StackTraceExposure {
+  /**
+   * A data flow source for "stack trace exposure" vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for "stack trace exposure" vulnerabilities.
+   */
+  abstract class Sink extends DataFlow::Node { }
+
+  /**
+   * A sanitizer for "stack trace exposure" vulnerabilities.
+   */
+  abstract class Sanitizer extends DataFlow::Node { }
+
+  /**
+   * A sanitizer guard for "stack trace exposure" vulnerabilities.
+   */
+  abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
+
+  /**
+   * A source of exception info, considered as a flow source.
+   */
+  class ExceptionInfoAsSource extends Source {
+    ExceptionInfoAsSource() { this instanceof ExceptionInfo }
+  }
+
+  /**
+   * The body of a HTTP response that will be returned from a server, considered as a flow sink.
+   */
+  class ServerHttpResponseBodyAsSink extends Sink {
+    ServerHttpResponseBodyAsSink() { this = any(HTTP::Server::HttpResponse response).getBody() }
+  }
+}

python/ql/src/semmle/python/security/dataflow/UnsafeDeserialization.qll

@@ -1,32 +1,42 @@
 /**
- * Provides a taint-tracking configuration for detecting arbitrary code execution
- * vulnerabilities due to deserializing user-controlled data.
+ * Provides a taint-tracking configuration for detecting "code execution from deserialization" vulnerabilities.
+ *
+ * Note, for performance reasons: only import this file if
+ * `UnsafeDeserialization::Configuration` is needed, otherwise
+ * `UnsafeDeserializationCustomizations` should be imported instead.
  */
 
-import python
+private import python
 import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
-import semmle.python.Concepts
-import semmle.python.dataflow.new.RemoteFlowSources
-import semmle.python.dataflow.new.BarrierGuards
 
 /**
- * A taint-tracking configuration for detecting arbitrary code execution
- * vulnerabilities due to deserializing user-controlled data.
+ * Provides a taint-tracking configuration for detecting "code execution from deserialization" vulnerabilities.
  */
-class UnsafeDeserializationConfiguration extends TaintTracking::Configuration {
-  UnsafeDeserializationConfiguration() { this = "UnsafeDeserializationConfiguration" }
+module UnsafeDeserialization {
+  import UnsafeDeserializationCustomizations::UnsafeDeserialization
 
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+  /**
+   * A taint-tracking configuration for detecting "code execution from deserialization" vulnerabilities.
+   */
+  class Configuration extends TaintTracking::Configuration {
+    Configuration() { this = "UnsafeDeserialization" }
 
-  override predicate isSink(DataFlow::Node sink) {
-    exists(Decoding d |
-      d.mayExecuteInput() and
-      sink = d.getAnInput()
-    )
-  }
+    override predicate isSource(DataFlow::Node source) { source instanceof Source }
 
-  override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof StringConstCompare
+    override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
+
+    override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
+
+    override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+      guard instanceof SanitizerGuard
+    }
   }
 }
+
+/**
+ * DEPRECATED: Don't extend this class for customization, since this will lead to bad
+ * performance, instead use the new `UnsafeDeserializationCustomizations.qll` file, and extend
+ * its' classes.
+ */
+deprecated class UnsafeDeserializationConfiguration = UnsafeDeserialization::Configuration;

python/ql/src/semmle/python/security/dataflow/UnsafeDeserializationCustomizations.qll

@@ -0,0 +1,60 @@
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "code execution from deserialization"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.Concepts
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.dataflow.new.BarrierGuards
+
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "code execution from deserialization"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+module UnsafeDeserialization {
+  /**
+   * A data flow source for "code execution from deserialization" vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for "code execution from deserialization" vulnerabilities.
+   */
+  abstract class Sink extends DataFlow::Node { }
+
+  /**
+   * A sanitizer for "code execution from deserialization" vulnerabilities.
+   */
+  abstract class Sanitizer extends DataFlow::Node { }
+
+  /**
+   * A sanitizer guard for "code execution from deserialization" vulnerabilities.
+   */
+  abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
+
+  /**
+   * A source of remote user input, considered as a flow source.
+   */
+  class RemoteFlowSourceAsSource extends Source, RemoteFlowSource { }
+
+  /**
+   * An insecure decoding, considered as a flow sink.
+   */
+  class InsecureDecodingAsSink extends Sink {
+    InsecureDecodingAsSink() {
+      exists(Decoding d |
+        d.mayExecuteInput() and
+        this = d.getAnInput()
+      )
+    }
+  }
+
+  /**
+   * A comparison with a constant string, considered as a sanitizer-guard.
+   */
+  class StringConstCompareAsSanitizerGuard extends SanitizerGuard, StringConstCompare { }
+}

python/ql/src/semmle/python/security/dataflow/UrlRedirect.qll

@@ -1,37 +1,42 @@
 /**
- * Provides a taint-tracking configuration for detecting URL redirection
- * vulnerabilities.
+ * Provides a taint-tracking configuration for detecting "URL redirection" vulnerabilities.
+ *
+ * Note, for performance reasons: only import this file if
+ * `UrlRedirect::Configuration` is needed, otherwise
+ * `UrlRedirectCustomizations` should be imported instead.
  */
 
-import python
+private import python
 import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
-import semmle.python.Concepts
-import semmle.python.dataflow.new.RemoteFlowSources
-import semmle.python.dataflow.new.BarrierGuards
 
 /**
- * A taint-tracking configuration for detecting URL redirection vulnerabilities.
+ * Provides a taint-tracking configuration for detecting "URL redirection" vulnerabilities.
  */
-class UrlRedirectConfiguration extends TaintTracking::Configuration {
-  UrlRedirectConfiguration() { this = "UrlRedirectConfiguration" }
+module UrlRedirect {
+  import UrlRedirectCustomizations::UrlRedirect
 
-  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+  /**
+   * A taint-tracking configuration for detecting "URL redirection" vulnerabilities.
+   */
+  class Configuration extends TaintTracking::Configuration {
+    Configuration() { this = "UrlRedirect" }
 
-  override predicate isSink(DataFlow::Node sink) {
-    sink = any(HTTP::Server::HttpRedirectResponse e).getRedirectLocation()
-  }
+    override predicate isSource(DataFlow::Node source) { source instanceof Source }
 
-  override predicate isSanitizer(DataFlow::Node node) {
-    // Url redirection is a problem only if the user controls the prefix of the URL.
-    // TODO: This is a copy of the taint-sanitizer from the old points-to query, which doesn't
-    // cover formatting.
-    exists(BinaryExprNode string_concat | string_concat.getOp() instanceof Add |
-      string_concat.getRight() = node.asCfgNode()
-    )
-  }
+    override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
 
-  override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof StringConstCompare
+    override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
+
+    override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
+      guard instanceof SanitizerGuard
+    }
   }
 }
+
+/**
+ * DEPRECATED: Don't extend this class for customization, since this will lead to bad
+ * performance, instead use the new `UrlRedirectCustomizations.qll` file, and extend
+ * its' classes.
+ */
+deprecated class UrlRedirectConfiguration = UrlRedirect::Configuration;

python/ql/src/semmle/python/security/dataflow/UrlRedirectCustomizations.qll

@@ -0,0 +1,71 @@
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "URL redirection"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.Concepts
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.dataflow.new.BarrierGuards
+
+/**
+ * Provides default sources, sinks and sanitizers for detecting
+ * "URL redirection"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
+module UrlRedirect {
+  /**
+   * A data flow source for "URL redirection" vulnerabilities.
+   */
+  abstract class Source extends DataFlow::Node { }
+
+  /**
+   * A data flow sink for "URL redirection" vulnerabilities.
+   */
+  abstract class Sink extends DataFlow::Node { }
+
+  /**
+   * A sanitizer for "URL redirection" vulnerabilities.
+   */
+  abstract class Sanitizer extends DataFlow::Node { }
+
+  /**
+   * A sanitizer guard for "URL redirection" vulnerabilities.
+   */
+  abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
+
+  /**
+   * A source of remote user input, considered as a flow source.
+   */
+  class RemoteFlowSourceAsSource extends Source, RemoteFlowSource { }
+
+  /**
+   * A HTTP redirect response, considered as a flow sink.
+   */
+  class RedirectLocationAsSink extends Sink {
+    RedirectLocationAsSink() {
+      this = any(HTTP::Server::HttpRedirectResponse e).getRedirectLocation()
+    }
+  }
+
+  /**
+   * The right side of a string-concat, considered as a sanitizer.
+   */
+  class StringConcatAsSanitizer extends Sanitizer {
+    StringConcatAsSanitizer() {
+      // Url redirection is a problem only if the user controls the prefix of the URL.
+      // TODO: This is a copy of the taint-sanitizer from the old points-to query, which doesn't
+      // cover formatting.
+      exists(BinaryExprNode string_concat | string_concat.getOp() instanceof Add |
+        string_concat.getRight() = this.asCfgNode()
+      )
+    }
+  }
+
+  /**
+   * A comparison with a constant string, considered as a sanitizer-guard.
+   */
+  class StringConstCompareAsSanitizerGuard extends SanitizerGuard, StringConstCompare { }
+}