Merge pull request #9756 from erik-krogh/greyMatter

JS: add model for the gray-matter library to js/code-injection

javascript/ql/lib/change-notes/2022-06-22-sensitive-common-words copy.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `gray-matter` library is now modeled as a sink for the `js/code-injection` query.

javascript/ql/lib/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll

@@ -51,6 +51,18 @@ module CodeInjection {
     }
   }
 
+  /** An expression parsed by the `gray-matter` library. */
+  class GrayMatterSink extends Sink {
+    GrayMatterSink() {
+      exists(API::CallNode call |
+        call = DataFlow::moduleImport("gray-matter").getACall() and
+        this = call.getArgument(0) and
+        // if the js/javascript engine is set, then we assume they are set to something safe.
+        not exists(call.getParameter(1).getMember("engines").getMember(["js", "javascript"]))
+      )
+    }
+  }
+
   /**
    * A template tag occurring in JS code, viewed as a code injection sink.
    */