rb/stored-xss structure and initial implementation (FileSystemReadAccess sources)

ql/test/query-tests/security/cwe-079/StoredXSS.qlref

@@ -0,0 +1 @@
+queries/security/cwe-079/StoredXSS.ql

ql/test/query-tests/security/cwe-079/app/controllers/foo/bars_controller.rb

@@ -22,4 +22,10 @@ class BarsController < ApplicationController
     @html_escaped = ERB::Util.html_escape(params[:text])
     render "foo/bars/show", locals: { display_text: dt, safe_text: "hello" }
   end
+
+  def show_stored
+    dt = File.read("foo.txt")
+    @instance_text = dt
+    render "foo/bars/show", locals: { display_text: dt, safe_text: "hello" }
+  end
 end