Merge branch 'main' into py/CsvInjection

python/ql/src/experimental/Security/CWE-022/ZipSlip.qhelp

@@ -0,0 +1,56 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>Extracting files from a malicious zip archive without validating that the destination file path
+is within the destination directory can cause files outside the destination directory to be
+overwritten, due to the possible presence of directory traversal elements (<code>..</code>) in
+archive paths.</p>
+
+<p>Zip archives contain archive entries representing each file in the archive. These entries
+include a file path for the entry, but these file paths are not restricted and may contain
+unexpected special elements such as the directory traversal element (<code>..</code>). If these
+file paths are used to determine an output file to write the contents of the archive item to, then
+the file may be written to an unexpected location. This can result in sensitive information being
+revealed or deleted, or an attacker being able to influence behavior by modifying unexpected
+files.</p>
+
+<p>For example, if a Zip archive contains a file entry <code>..\sneaky-file</code>, and the Zip archive
+is extracted to the directory <code>c:\output</code>, then naively combining the paths would result
+in an output file path of <code>c:\output\..\sneaky-file</code>, which would cause the file to be
+written to <code>c:\sneaky-file</code>.</p>
+
+</overview>
+<recommendation>
+
+<p>Ensure that output paths constructed from Zip archive entries are validated
+to prevent writing files to unexpected locations.</p>
+
+<p>The recommended way of writing an output file from a Zip archive entry is to call <code>extract()</code> or <code>extractall()</code>.
+</p>
+
+</recommendation>
+
+<example>
+<p>
+In this example an archive is extracted without validating file paths.
+</p>
+
+<sample src="zipslip_bad.py" />
+
+<p>To fix this vulnerability, we need to call the function <code>extractall()</code>.
+</p>
+
+<sample src="zipslip_good.py" />
+
+</example>
+<references>
+<li>
+Snyk:
+<a href="https://snyk.io/research/zip-slip-vulnerability">Zip Slip Vulnerability</a>.
+</li>
+
+</references>
+</qhelp>

python/ql/src/experimental/Security/CWE-022/ZipSlip.ql

@@ -0,0 +1,22 @@
+/**
+ * @name Arbitrary file write during archive extraction ("Zip Slip")
+ * @description Extracting files from a malicious archive without validating that the
+ *              destination file path is within the destination directory can cause files outside
+ *              the destination directory to be overwritten.
+ * @kind path-problem
+ * @id py/zipslip
+ * @problem.severity error
+ * @security-severity 7.5
+ * @precision high
+ * @tags security
+ *       external/cwe/cwe-022
+ */
+
+import python
+import experimental.semmle.python.security.ZipSlip
+import DataFlow::PathGraph
+
+from ZipSlipConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
+where config.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "Extraction of zipfile from $@", source.getNode(),
+  "a potentially untrusted source"

python/ql/src/experimental/Security/CWE-022/zipslip_bad.py

@@ -0,0 +1,16 @@
+import zipfile
+import shutil
+
+def unzip(filename):
+    with tarfile.open(filename) as zipf:
+    #BAD : This could write any file on the filesystem.
+        for entry in zipf:
+            shutil.copyfile(entry, "/tmp/unpack/")
+          
+def unzip4(filename):
+    zf = zipfile.ZipFile(filename)
+    filelist = zf.namelist()
+    for x in filelist:
+        with zf.open(x) as srcf:
+            shutil.copyfileobj(srcf, dstfile)
+

python/ql/src/experimental/Security/CWE-022/zipslip_good.py

@@ -0,0 +1,10 @@
+import zipfile 
+
+def unzip(filename, dir):
+    zf = zipfile.ZipFile(filename)
+    zf.extractall(dir)
+    
+
+def unzip1(filename, dir):
+    zf = zipfile.ZipFile(filename)
+    zf.extract(dir)

python/ql/src/experimental/Security/CWE-287/ImproperLdapAuth.ql

@@ -13,7 +13,7 @@ import python
 import experimental.semmle.python.Concepts
 import semmle.python.dataflow.new.DataFlow
 
-predicate authenticatesImproperly(LDAPBind ldapBind) {
+predicate authenticatesImproperly(LdapBind ldapBind) {
   (
     DataFlow::localFlow(DataFlow::exprNode(any(None noneName)), ldapBind.getPassword()) or
     not exists(ldapBind.getPassword())
@@ -25,6 +25,6 @@ predicate authenticatesImproperly(LDAPBind ldapBind) {
   )
 }
 
-from LDAPBind ldapBind
+from LdapBind ldapBind
 where authenticatesImproperly(ldapBind)
 select ldapBind, "The following LDAP bind operation is executed without authentication"

python/ql/src/experimental/Security/CWE-347/JWTEmptyKeyOrAlgorithm.ql

@@ -12,7 +12,7 @@ import python
 import experimental.semmle.python.Concepts
 import experimental.semmle.python.frameworks.JWT
 
-from JWTEncoding jwtEncoding, string affectedComponent
+from JwtEncoding jwtEncoding, string affectedComponent
 where
   affectedComponent = "algorithm" and
   isEmptyOrNone(jwtEncoding.getAlgorithm())

python/ql/src/experimental/Security/CWE-347/JWTMissingSecretOrPublicKeyVerification.ql

@@ -12,6 +12,6 @@
 import python
 import experimental.semmle.python.Concepts
 
-from JWTDecoding jwtDecoding
+from JwtDecoding jwtDecoding
 where not jwtDecoding.verifiesSignature()
 select jwtDecoding.getPayload(), "is not verified with a cryptographic secret or public key."

python/ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.ql

@@ -18,7 +18,7 @@ import ClientSuppliedIpUsedInSecurityCheckLib
 import DataFlow::PathGraph
 
 /**
- * Taint-tracking configuration tracing flow from obtaining a client ip from an HTTP header to a sensitive use.
+ * A taint-tracking configuration tracing flow from obtaining a client ip from an HTTP header to a sensitive use.
  */
 class ClientSuppliedIpUsedInSecurityCheckConfig extends TaintTracking::Configuration {
   ClientSuppliedIpUsedInSecurityCheckConfig() { this = "ClientSuppliedIpUsedInSecurityCheckConfig" }

python/ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheckLib.qll

@@ -1,8 +1,8 @@
 private import python
 private import semmle.python.Concepts
 private import semmle.python.ApiGraphs
-private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.dataflow.new.DataFlow
 
 /**
  * A data flow source of the client ip obtained according to the remote endpoint identifier specified

python/ql/src/experimental/Security/CWE-522/LDAPInsecureAuth.ql

@@ -14,7 +14,7 @@ import python
 import DataFlow::PathGraph
 import experimental.semmle.python.security.LDAPInsecureAuth
 
-from LDAPInsecureAuthConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
+from LdapInsecureAuthConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "$@ is authenticated insecurely.", sink.getNode(),
   "This LDAP host"

python/ql/src/experimental/Security/CWE-611/SimpleXmlRpcServer.ql

@@ -0,0 +1,19 @@
+/**
+ * @name SimpleXMLRPCServer DoS vulnerability
+ * @description SimpleXMLRPCServer is vulnerable to DoS attacks from untrusted user input
+ * @kind problem
+ * @problem.severity warning
+ * @precision high
+ * @id py/simple-xml-rpc-server-dos
+ * @tags security
+ *       external/cwe/cwe-776
+ */
+
+private import python
+private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
+
+from DataFlow::CallCfgNode call
+where
+  call = API::moduleImport("xmlrpc").getMember("server").getMember("SimpleXMLRPCServer").getACall()
+select call, "SimpleXMLRPCServer is vulnerable to XML bombs"

python/ql/src/experimental/Security/CWE-614/CookieInjection.py

@@ -0,0 +1,16 @@
+from flask import request, make_response
+
+
+@app.route("/1")
+def true():
+    resp = make_response()
+    resp.set_cookie(request.args["name"],
+                    value=request.args["name"])
+    return resp
+
+
+@app.route("/2")
+def flask_make_response():
+    resp = make_response("hello")
+    resp.headers['Set-Cookie'] = f"{request.args['name']}={request.args['name']};"
+    return resp

python/ql/src/experimental/Security/CWE-614/CookieInjection.qhelp

@@ -0,0 +1,28 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>Constructing cookies from user input may allow an attacker to perform a Cookie Poisoning attack. 
+It is possible, however, to perform other parameter-like attacks through cookie poisoning techniques, 
+such as SQL Injection, Directory Traversal, or Stealth Commanding, etc. Additionally, 
+cookie injection may relate to attempts to perform Access of Administrative Interface.
+</p>
+</overview>
+
+<recommendation>
+<p>Do not use raw user input to construct cookies.</p>
+</recommendation>
+
+<example>
+<p>This example shows two ways of adding a cookie to a Flask response. The first way uses <code>set_cookie</code>'s
+and the second sets a cookie's raw value through a header, both using user-supplied input.</p>
+<sample src="CookieInjection.py" />
+</example>
+
+<references>
+<li>Imperva: <a href="https://docs.imperva.com/bundle/on-premises-knowledgebase-reference-guide/page/cookie_injection.htm">Cookie injection</a>.</li>
+</references>
+
+</qhelp>

python/ql/src/experimental/Security/CWE-614/CookieInjection.ql

@@ -0,0 +1,28 @@
+/**
+ * @name Construction of a cookie using user-supplied input.
+ * @description Constructing cookies from user input may allow an attacker to perform a Cookie Poisoning attack.
+ * @kind path-problem
+ * @problem.severity error
+ * @id py/cookie-injection
+ * @tags security
+ *       external/cwe/cwe-614
+ */
+
+// determine precision above
+import python
+import semmle.python.dataflow.new.DataFlow
+import experimental.semmle.python.Concepts
+import experimental.semmle.python.CookieHeader
+import experimental.semmle.python.security.injection.CookieInjection
+import DataFlow::PathGraph
+
+from
+  CookieInjectionFlowConfig config, DataFlow::PathNode source, DataFlow::PathNode sink,
+  string insecure
+where
+  config.hasFlowPath(source, sink) and
+  if exists(sink.getNode().(CookieSink))
+  then insecure = ",and its " + sink.getNode().(CookieSink).getFlag() + " flag is not properly set."
+  else insecure = "."
+select sink.getNode(), source, sink, "Cookie is constructed from a $@" + insecure, source.getNode(),
+  "user-supplied input"

python/ql/src/experimental/Security/CWE-614/InsecureCookie.py

@@ -0,0 +1,15 @@
+from flask import Flask, request, make_response, Response
+
+
+@app.route("/1")
+def true():
+    resp = make_response()
+    resp.set_cookie("name", value="value", secure=True)
+    return resp
+
+
+@app.route("/2")
+def flask_make_response():
+    resp = make_response("hello")
+    resp.headers['Set-Cookie'] = "name=value; Secure;"
+    return resp

python/ql/src/experimental/Security/CWE-614/InsecureCookie.qhelp

@@ -0,0 +1,31 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>Setting the 'secure' flag on a cookie to <code>False</code> can cause it to be sent in cleartext.
+Setting the 'httponly' flag on a cookie to <code>False</code> may allow attackers access it via JavaScript.
+Setting the 'samesite' flag on a cookie to <code>'None'</code> will make the cookie to be sent in third-party 
+contexts which may be attacker-controlled.</p>
+</overview>
+
+<recommendation>
+<p>Always set <code>secure</code> to <code>True</code> or add "; Secure;" to the cookie's raw value.</p>
+<p>Always set <code>httponly</code> to <code>True</code> or add "; HttpOnly;" to the cookie's raw value.</p>
+<p>Always set <code>samesite</code> to <code>Lax</code> or <code>Strict</code>, or add "; SameSite=Lax;", or
+"; Samesite=Strict;" to the cookie's raw header value.</p>
+</recommendation>
+
+<example>
+<p>This example shows two ways of adding a cookie to a Flask response. The first way uses <code>set_cookie</code>'s
+secure flag and the second adds the secure flag in the cookie's raw value.</p>
+<sample src="InsecureCookie.py" />
+</example>
+
+<references>
+<li>Detectify: <a href="https://support.detectify.com/support/solutions/articles/48001048982-cookie-lack-secure-flag">Cookie lack Secure flag</a>.</li>
+<li>PortSwigger: <a href="https://portswigger.net/kb/issues/00500200_tls-cookie-without-secure-flag-set">TLS cookie without secure flag set</a>.</li>
+</references>
+
+</qhelp>

python/ql/src/experimental/Security/CWE-614/InsecureCookie.ql

@@ -0,0 +1,30 @@
+/**
+ * @name Failure to use secure cookies
+ * @description Insecure cookies may be sent in cleartext, which makes them vulnerable to
+ *              interception.
+ * @kind problem
+ * @problem.severity error
+ * @security-severity 5.0
+ * @precision ???
+ * @id py/insecure-cookie
+ * @tags security
+ *       external/cwe/cwe-614
+ */
+
+// TODO: determine precision above
+import python
+import semmle.python.dataflow.new.DataFlow
+import experimental.semmle.python.Concepts
+import experimental.semmle.python.CookieHeader
+
+from Cookie cookie, string alert
+where
+  not cookie.isSecure() and
+  alert = "secure"
+  or
+  not cookie.isHttpOnly() and
+  alert = "httponly"
+  or
+  not cookie.isSameSite() and
+  alert = "samesite"
+select cookie, "Cookie is added without the '" + alert + "' flag properly set."

python/ql/src/experimental/Security/CWE-643/XpathInjection.qhelp

@@ -1,30 +0,0 @@
-<!DOCTYPE qhelp SYSTEM "qhelp.dtd">
-<qhelp>
-    <overview>
-        <p>
-        Using user-supplied information to construct an XPath query for XML data can
-        result in an XPath injection flaw. By sending intentionally malformed information,
-        an attacker can access data that he may not normally have access to.
-        He/She may even be able to elevate his privileges on the web site if the XML data
-        is being used for authentication (such as an XML based user file).
-        </p>
-    </overview>
-    <recommendation>
-        <p>
-        XPath injection can be prevented using parameterized XPath interface or escaping the user input to make it safe to include in a dynamically constructed query.
-        If you are using quotes to terminate untrusted input in a dynamically constructed XPath query, then you need to escape that quote in the untrusted input to ensure the untrusted data can’t try to break out of that quoted context.
-        </p>
-        <p>
-        Another better mitigation option is to use a precompiled XPath query. Precompiled XPath queries are already preset before the program executes, rather than created on the fly after the user’s input has been added to the string. This is a better route because you don’t have to worry about missing a character that should have been escaped.
-        </p>
-    </recommendation>
-    <example>
-        <p>In the example below, the xpath query is controlled by the user and hence leads to a vulnerability.</p>
-        <sample src="xpathBad.py" />
-        <p> This can be fixed by using a parameterized query as shown below.</p>
-        <sample src="xpathGood.py" />
-    </example>
-    <references>
-        <li>OWASP XPath injection : <a href="https://owasp.org/www-community/attacks/XPATH_Injection"></a>/>> </li>
-    </references>
-</qhelp>

python/ql/src/experimental/Security/CWE-643/XpathInjection.ql

@@ -1,33 +0,0 @@
-/**
- * @name XPath query built from user-controlled sources
- * @description Building a XPath query from user-controlled sources is vulnerable to insertion of
- *              malicious Xpath code by the user.
- * @kind path-problem
- * @problem.severity error
- * @precision high
- * @id py/xpath-injection
- * @tags security
- *       external/cwe/cwe-643
- */
-
-private import python
-private import semmle.python.Concepts
-private import semmle.python.dataflow.new.TaintTracking
-private import semmle.python.Concepts
-private import semmle.python.ApiGraphs
-private import semmle.python.dataflow.new.RemoteFlowSources
-private import semmle.python.dataflow.new.BarrierGuards
-import XpathInjection::XpathInjection
-import DataFlow::PathGraph
-
-class XpathInjectionConfiguration extends TaintTracking::Configuration {
-  XpathInjectionConfiguration() { this = "PathNotNormalizedConfiguration" }
-
-  override predicate isSource(DataFlow::Node source) { source instanceof Source }
-
-  override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
-}
-
-from XpathInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
-where config.hasFlowPath(source, sink)
-select sink, source, sink, "This Xpath query depends on $@.", source, "a user-provided value"

python/ql/src/experimental/Security/CWE-643/XpathInjection.qll

@@ -1,35 +0,0 @@
-/**
- * Provides a taint-tracking configuration for detecting "Xpath Injection" vulnerabilities.
- *
- * Note, for performance reasons: only import this file if
- * `XpathInjection::Configuration` is needed, otherwise
- * `XpathInjectionCustomizations` should be imported instead.
- */
-
-private import python
-import semmle.python.dataflow.new.DataFlow
-import semmle.python.dataflow.new.TaintTracking
-
-/**
- * Provides a taint-tracking configuration for detecting "Xpath Injection" vulnerabilities.
- */
-module XpathInjection {
-  import XpathInjectionCustomizations::XpathInjection
-
-  /**
-   * A taint-tracking configuration for detecting "Xpath Injection" vulnerabilities.
-   */
-  class Configuration extends TaintTracking::Configuration {
-    Configuration() { this = "Xpath Injection" }
-
-    override predicate isSource(DataFlow::Node source) { source instanceof Source }
-
-    override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
-
-    override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
-
-    override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-      guard instanceof SanitizerGuard
-    }
-  }
-}

python/ql/src/experimental/Security/CWE-643/XpathInjectionCustomizations.qll

@@ -1,105 +0,0 @@
-/**
- * Provides class and predicates to track external data that
- * may represent malicious xpath query objects.
- *
- * This module is intended to be imported into a taint-tracking query.
- */
-
-private import python
-private import semmle.python.Concepts
-private import semmle.python.dataflow.new.TaintTracking
-private import semmle.python.Concepts
-private import semmle.python.ApiGraphs
-private import semmle.python.dataflow.new.RemoteFlowSources
-private import semmle.python.dataflow.new.BarrierGuards
-
-/** Models Xpath Injection related classes and functions */
-module XpathInjection {
-  /**
-   * A data flow source for "XPath injection" vulnerabilities.
-   */
-  abstract class Source extends DataFlow::Node { }
-
-  /**
-   * A data flow sink for "XPath injection" vulnerabilities.
-   */
-  abstract class Sink extends DataFlow::Node { }
-
-  /**
-   * A sanitizer for "XPath injection" vulnerabilities.
-   */
-  abstract class Sanitizer extends DataFlow::Node { }
-
-  /**
-   * A sanitizer guard for "XPath injection" vulnerabilities.
-   */
-  abstract class SanitizerGuard extends DataFlow::BarrierGuard { }
-
-  /**
-   * A source of remote user input, considered as a flow source.
-   */
-  class RemoteFlowSourceAsSource extends Source, RemoteFlowSource { }
-
-  /** Returns an API node referring to `lxml.etree` */
-  API::Node etree() { result = API::moduleImport("lxml").getMember("etree") }
-
-  /** Returns an API node referring to `lxml.etree` */
-  API::Node etreeFromString() { result = etree().getMember("fromstring") }
-
-  /** Returns an API node referring to `lxml.etree.parse` */
-  API::Node etreeParse() { result = etree().getMember("parse") }
-
-  /** Returns an API node referring to `lxml.etree.parse` */
-  API::Node libxml2parseFile() { result = API::moduleImport("libxml2").getMember("parseFile") }
-
-  /**
-   * A Sink representing an argument to `etree.XPath` or `etree.ETXPath` call.
-   *
-   *    from lxml import etree
-   *    root = etree.XML("<xmlContent>")
-   *    find_text = etree.XPath("`sink`")
-   *    find_text = etree.ETXPath("`sink`")
-   */
-  private class EtreeXpathArgument extends Sink {
-    EtreeXpathArgument() { this = etree().getMember(["XPath", "ETXPath"]).getACall().getArg(0) }
-  }
-
-  /**
-   * A Sink representing an argument to the `etree.XPath` call.
-   *
-   *    from lxml import etree
-   *    root =  etree.fromstring(file(XML_DB).read(), XMLParser())
-   *    find_text = root.xpath("`sink`")
-   */
-  private class EtreeFromstringXpathArgument extends Sink {
-    EtreeFromstringXpathArgument() {
-      this = etreeFromString().getReturn().getMember("xpath").getACall().getArg(0)
-    }
-  }
-
-  /**
-   * A Sink representing an argument to the `xpath` call to a parsed xml document.
-   *
-   *    from lxml import etree
-   *    from io import StringIO
-   *    f = StringIO('<foo><bar></bar></foo>')
-   *    tree = etree.parse(f)
-   *    r = tree.xpath('`sink`')
-   */
-  private class ParseXpathArgument extends Sink {
-    ParseXpathArgument() { this = etreeParse().getReturn().getMember("xpath").getACall().getArg(0) }
-  }
-
-  /**
-   * A Sink representing an argument to the `xpathEval` call to a parsed libxml2 document.
-   *
-   *    import libxml2
-   *    tree = libxml2.parseFile("file.xml")
-   *    r = tree.xpathEval('`sink`')
-   */
-  private class ParseFileXpathEvalArgument extends Sink {
-    ParseFileXpathEvalArgument() {
-      this = libxml2parseFile().getReturn().getMember("xpathEval").getACall().getArg(0)
-    }
-  }
-}

python/ql/src/experimental/Security/CWE-643/xpathBad.py

@@ -1,18 +0,0 @@
-from lxml import etree
-from io import StringIO
-
-from django.urls import path
-from django.http import HttpResponse
-from django.template import Template, Context, Engine, engines
-
-
-def a(request):
-    value = request.GET['xpath']
-    f = StringIO('<foo><bar></bar></foo>')
-    tree = etree.parse(f)
-    r = tree.xpath("/tag[@id='%s']" % value)
-
-
-urlpatterns = [
-    path('a', a)
-]

python/ql/src/experimental/Security/CWE-643/xpathGood.py

@@ -1,18 +0,0 @@
-from lxml import etree
-from io import StringIO
-
-from django.urls import path
-from django.http import HttpResponse
-from django.template import Template, Context, Engine, engines
-
-
-def a(request):
-    value = request.GET['xpath']
-    f = StringIO('<foo><bar></bar></foo>')
-    tree = etree.parse(f)
-    r = tree.xpath("/tag[@id=$tagid]", tagid=value)
-
-
-urlpatterns = [
-    path('a', a)
-]

python/ql/src/experimental/Security/CWE-943/NoSQLInjection.ql

@@ -13,7 +13,7 @@ import python
 import experimental.semmle.python.security.injection.NoSQLInjection
 import DataFlow::PathGraph
 
-from NoSQLInjection::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
+from NoSqlInjection::Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)
 select sink, source, sink, "$@ NoSQL query contains an unsanitized $@", sink, "This", source,
   "user-provided value"

python/ql/src/experimental/semmle/python/Concepts.qll

@@ -13,9 +13,77 @@ private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.dataflow.new.TaintTracking
 private import experimental.semmle.python.Frameworks
+private import semmle.python.Concepts
+
+/** Provides classes for modeling copying file related APIs. */
+module CopyFile {
+  /**
+   * A data flow node for copying file.
+   *
+   * Extend this class to model new APIs. If you want to refine existing API models,
+   * extend `CopyFile` instead.
+   */
+  abstract class Range extends DataFlow::Node {
+    /**
+     * Gets the argument containing the path.
+     */
+    abstract DataFlow::Node getAPathArgument();
+
+    /**
+     * Gets fsrc argument.
+     */
+    abstract DataFlow::Node getfsrcArgument();
+  }
+}
+
+/**
+ * A data flow node for copying file.
+ *
+ * Extend this class to refine existing API models. If you want to model new APIs,
+ * extend `CopyFile::Range` instead.
+ */
+class CopyFile extends DataFlow::Node {
+  CopyFile::Range range;
+
+  CopyFile() { this = range }
+
+  DataFlow::Node getAPathArgument() { result = range.getAPathArgument() }
+
+  DataFlow::Node getfsrcArgument() { result = range.getfsrcArgument() }
+}
+
+/** Provides classes for modeling log related APIs. */
+module LogOutput {
+  /**
+   * A data flow node for log output.
+   *
+   * Extend this class to model new APIs. If you want to refine existing API models,
+   * extend `LogOutput` instead.
+   */
+  abstract class Range extends DataFlow::Node {
+    /**
+     * Get the parameter value of the log output function.
+     */
+    abstract DataFlow::Node getAnInput();
+  }
+}
+
+/**
+ * A data flow node for log output.
+ *
+ * Extend this class to refine existing API models. If you want to model new APIs,
+ * extend `LogOutput::Range` instead.
+ */
+class LogOutput extends DataFlow::Node {
+  LogOutput::Range range;
+
+  LogOutput() { this = range }
+
+  DataFlow::Node getAnInput() { result = range.getAnInput() }
+}
 
 /** Provides classes for modeling LDAP query execution-related APIs. */
-module LDAPQuery {
+module LdapQuery {
   /**
    * A data-flow node that collects methods executing a LDAP query.
    *
@@ -30,16 +98,19 @@ module LDAPQuery {
   }
 }
 
+/** DEPRECATED: Alias for LdapQuery */
+deprecated module LDAPQuery = LdapQuery;
+
 /**
  * A data-flow node that collect methods executing a LDAP query.
  *
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `LDAPQuery::Range` instead.
  */
-class LDAPQuery extends DataFlow::Node {
-  LDAPQuery::Range range;
+class LdapQuery extends DataFlow::Node {
+  LdapQuery::Range range;
 
-  LDAPQuery() { this = range }
+  LdapQuery() { this = range }
 
   /**
    * Gets the argument containing the executed expression.
@@ -47,8 +118,11 @@ class LDAPQuery extends DataFlow::Node {
   DataFlow::Node getQuery() { result = range.getQuery() }
 }
 
+/** DEPRECATED: Alias for LdapQuery */
+deprecated class LDAPQuery = LdapQuery;
+
 /** Provides classes for modeling LDAP components escape-related APIs. */
-module LDAPEscape {
+module LdapEscape {
   /**
    * A data-flow node that collects functions escaping LDAP components.
    *
@@ -63,16 +137,19 @@ module LDAPEscape {
   }
 }
 
+/** DEPRECATED: Alias for LdapEscape */
+deprecated module LDAPEscape = LdapEscape;
+
 /**
  * A data-flow node that collects functions escaping LDAP components.
  *
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `LDAPEscape::Range` instead.
  */
-class LDAPEscape extends DataFlow::Node {
-  LDAPEscape::Range range;
+class LdapEscape extends DataFlow::Node {
+  LdapEscape::Range range;
 
-  LDAPEscape() { this = range }
+  LdapEscape() { this = range }
 
   /**
    * Gets the argument containing the escaped expression.
@@ -80,8 +157,11 @@ class LDAPEscape extends DataFlow::Node {
   DataFlow::Node getAnInput() { result = range.getAnInput() }
 }
 
+/** DEPRECATED: Alias for LdapEscape */
+deprecated class LDAPEscape = LdapEscape;
+
 /** Provides classes for modeling LDAP bind-related APIs. */
-module LDAPBind {
+module LdapBind {
   /**
    * A data-flow node that collects methods binding a LDAP connection.
    *
@@ -106,16 +186,19 @@ module LDAPBind {
   }
 }
 
+/** DEPRECATED: Alias for LdapBind */
+deprecated module LDAPBind = LdapBind;
+
 /**
  * A data-flow node that collects methods binding a LDAP connection.
  *
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `LDAPBind::Range` instead.
  */
-class LDAPBind extends DataFlow::Node {
-  LDAPBind::Range range;
+class LdapBind extends DataFlow::Node {
+  LdapBind::Range range;
 
-  LDAPBind() { this = range }
+  LdapBind() { this = range }
 
   /**
    * Gets the argument containing the binding host.
@@ -133,8 +216,11 @@ class LDAPBind extends DataFlow::Node {
   predicate useSSL() { range.useSSL() }
 }
 
+/** DEPRECATED: Alias for LdapBind */
+deprecated class LDAPBind = LdapBind;
+
 /** Provides classes for modeling SQL sanitization libraries. */
-module SQLEscape {
+module SqlEscape {
   /**
    * A data-flow node that collects functions that escape SQL statements.
    *
@@ -149,16 +235,19 @@ module SQLEscape {
   }
 }
 
+/** DEPRECATED: Alias for SqlEscape */
+deprecated module SQLEscape = SqlEscape;
+
 /**
  * A data-flow node that collects functions escaping SQL statements.
  *
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `SQLEscape::Range` instead.
  */
-class SQLEscape extends DataFlow::Node {
-  SQLEscape::Range range;
+class SqlEscape extends DataFlow::Node {
+  SqlEscape::Range range;
 
-  SQLEscape() { this = range }
+  SqlEscape() { this = range }
 
   /**
    * Gets the argument containing the raw SQL statement.
@@ -166,8 +255,11 @@ class SQLEscape extends DataFlow::Node {
   DataFlow::Node getAnInput() { result = range.getAnInput() }
 }
 
-/** Provides a class for modeling NoSQL execution APIs. */
-module NoSQLQuery {
+/** DEPRECATED: Alias for SqlEscape */
+deprecated class SQLEscape = SqlEscape;
+
+/** Provides a class for modeling NoSql execution APIs. */
+module NoSqlQuery {
   /**
    * A data-flow node that executes NoSQL queries.
    *
@@ -175,28 +267,34 @@ module NoSQLQuery {
    * extend `NoSQLQuery` instead.
    */
   abstract class Range extends DataFlow::Node {
-    /** Gets the argument that specifies the NoSQL query to be executed. */
+    /** Gets the argument that specifies the NoSql query to be executed. */
     abstract DataFlow::Node getQuery();
   }
 }
 
+/** DEPRECATED: Alias for NoSqlQuery */
+deprecated module NoSQLQuery = NoSqlQuery;
+
 /**
  * A data-flow node that executes NoSQL queries.
  *
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `NoSQLQuery::Range` instead.
  */
-class NoSQLQuery extends DataFlow::Node {
-  NoSQLQuery::Range range;
+class NoSqlQuery extends DataFlow::Node {
+  NoSqlQuery::Range range;
 
-  NoSQLQuery() { this = range }
+  NoSqlQuery() { this = range }
 
-  /** Gets the argument that specifies the NoSQL query to be executed. */
+  /** Gets the argument that specifies the NoSql query to be executed. */
   DataFlow::Node getQuery() { result = range.getQuery() }
 }
 
-/** Provides classes for modeling NoSQL sanitization-related APIs. */
-module NoSQLSanitizer {
+/** DEPRECATED: Alias for NoSqlQuery */
+deprecated class NoSQLQuery = NoSqlQuery;
+
+/** Provides classes for modeling NoSql sanitization-related APIs. */
+module NoSqlSanitizer {
   /**
    * A data-flow node that collects functions sanitizing NoSQL queries.
    *
@@ -204,26 +302,32 @@ module NoSQLSanitizer {
    * extend `NoSQLSanitizer` instead.
    */
   abstract class Range extends DataFlow::Node {
-    /** Gets the argument that specifies the NoSQL query to be sanitized. */
+    /** Gets the argument that specifies the NoSql query to be sanitized. */
     abstract DataFlow::Node getAnInput();
   }
 }
 
+/** DEPRECATED: Alias for NoSqlSanitizer */
+deprecated module NoSQLSanitizer = NoSqlSanitizer;
+
 /**
  * A data-flow node that collects functions sanitizing NoSQL queries.
  *
  * Extend this class to model new APIs. If you want to refine existing API models,
  * extend `NoSQLSanitizer::Range` instead.
  */
-class NoSQLSanitizer extends DataFlow::Node {
-  NoSQLSanitizer::Range range;
+class NoSqlSanitizer extends DataFlow::Node {
+  NoSqlSanitizer::Range range;
 
-  NoSQLSanitizer() { this = range }
+  NoSqlSanitizer() { this = range }
 
-  /** Gets the argument that specifies the NoSQL query to be sanitized. */
+  /** Gets the argument that specifies the NoSql query to be sanitized. */
   DataFlow::Node getAnInput() { result = range.getAnInput() }
 }
 
+/** DEPRECATED: Alias for NoSqlSanitizer */
+deprecated class NoSQLSanitizer = NoSqlSanitizer;
+
 /** Provides classes for modeling HTTP Header APIs. */
 module HeaderDeclaration {
   /**
@@ -300,8 +404,57 @@ class CsvWriter extends DataFlow::Node {
   DataFlow::Node getAnInput() { result = range.getAnInput() }
 }
 
+/**
+ * A data-flow node that sets a cookie in an HTTP response.
+ *
+ * Extend this class to refine existing API models. If you want to model new APIs,
+ * extend `Cookie::Range` instead.
+ */
+class Cookie extends HTTP::Server::CookieWrite instanceof Cookie::Range {
+  /**
+   * Holds if this cookie is secure.
+   */
+  predicate isSecure() { super.isSecure() }
+
+  /**
+   * Holds if this cookie is HttpOnly.
+   */
+  predicate isHttpOnly() { super.isHttpOnly() }
+
+  /**
+   * Holds if the cookie is SameSite
+   */
+  predicate isSameSite() { super.isSameSite() }
+}
+
+/** Provides a class for modeling new cookie writes on HTTP responses. */
+module Cookie {
+  /**
+   * A data-flow node that sets a cookie in an HTTP response.
+   *
+   * Extend this class to model new APIs. If you want to refine existing API models,
+   * extend `Cookie` instead.
+   */
+  abstract class Range extends HTTP::Server::CookieWrite::Range {
+    /**
+     * Holds if this cookie is secure.
+     */
+    abstract predicate isSecure();
+
+    /**
+     * Holds if this cookie is HttpOnly.
+     */
+    abstract predicate isHttpOnly();
+
+    /**
+     * Holds if the cookie is SameSite.
+     */
+    abstract predicate isSameSite();
+  }
+}
+
 /** Provides classes for modeling JWT encoding-related APIs. */
-module JWTEncoding {
+module JwtEncoding {
   /**
    * A data-flow node that collects methods encoding a JWT token.
    *
@@ -331,13 +484,16 @@ module JWTEncoding {
   }
 }
 
+/** DEPRECATED: Alias for JwtEncoding */
+deprecated module JWTEncoding = JwtEncoding;
+
 /**
  * A data-flow node that collects methods encoding a JWT token.
  *
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `JWTEncoding::Range` instead.
  */
-class JWTEncoding extends DataFlow::Node instanceof JWTEncoding::Range {
+class JwtEncoding extends DataFlow::Node instanceof JwtEncoding::Range {
   /**
    * Gets the argument containing the payload.
    */
@@ -359,8 +515,11 @@ class JWTEncoding extends DataFlow::Node instanceof JWTEncoding::Range {
   string getAlgorithmString() { result = super.getAlgorithmString() }
 }
 
+/** DEPRECATED: Alias for JwtEncoding */
+deprecated class JWTEncoding = JwtEncoding;
+
 /** Provides classes for modeling JWT decoding-related APIs. */
-module JWTDecoding {
+module JwtDecoding {
   /**
    * A data-flow node that collects methods decoding a JWT token.
    *
@@ -400,13 +559,16 @@ module JWTDecoding {
   }
 }
 
+/** DEPRECATED: Alias for JwtDecoding */
+deprecated module JWTDecoding = JwtDecoding;
+
 /**
  * A data-flow node that collects methods encoding a JWT token.
  *
  * Extend this class to refine existing API models. If you want to model new APIs,
  * extend `JWTDecoding::Range` instead.
  */
-class JWTDecoding extends DataFlow::Node instanceof JWTDecoding::Range {
+class JwtDecoding extends DataFlow::Node instanceof JwtDecoding::Range {
   /**
    * Gets the argument containing the payload.
    */
@@ -437,3 +599,6 @@ class JWTDecoding extends DataFlow::Node instanceof JWTDecoding::Range {
    */
   predicate verifiesSignature() { super.verifiesSignature() }
 }
+
+/** DEPRECATED: Alias for JwtDecoding */
+deprecated class JWTDecoding = JwtDecoding;

python/ql/src/experimental/semmle/python/CookieHeader.qll

@@ -0,0 +1,72 @@
+/**
+ * Temporary: provides a class to extend current cookies to header declarations
+ */
+
+import python
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.dataflow.new.TaintTracking
+import experimental.semmle.python.Concepts
+
+/**
+ * Gets a header setting a cookie.
+ *
+ * Given the following example:
+ *
+ * ```py
+ * @app.route("/")
+ * def flask_make_response():
+ *    resp = make_response("")
+ *    resp.headers['Set-Cookie'] = "name=value; Secure;"
+ *    return resp
+ * ```
+ *
+ * * `this` would be `resp.headers['Set-Cookie'] = "name=value; Secure;"`.
+ * * `isSecure()` predicate would succeed.
+ * * `isHttpOnly()` predicate would fail.
+ * * `isSameSite()` predicate would fail.
+ * * `getName()` and `getValue()` results would be `"name=value; Secure;"`.
+ */
+class CookieHeader extends Cookie::Range instanceof HeaderDeclaration {
+  CookieHeader() {
+    this instanceof HeaderDeclaration and
+    exists(StrConst str |
+      str.getText() = "Set-Cookie" and
+      DataFlow::exprNode(str)
+          .(DataFlow::LocalSourceNode)
+          .flowsTo(this.(HeaderDeclaration).getNameArg())
+    )
+  }
+
+  override predicate isSecure() {
+    exists(StrConst str |
+      str.getText().regexpMatch(".*; *Secure;.*") and
+      DataFlow::exprNode(str)
+          .(DataFlow::LocalSourceNode)
+          .flowsTo(this.(HeaderDeclaration).getValueArg())
+    )
+  }
+
+  override predicate isHttpOnly() {
+    exists(StrConst str |
+      str.getText().regexpMatch(".*; *HttpOnly;.*") and
+      DataFlow::exprNode(str)
+          .(DataFlow::LocalSourceNode)
+          .flowsTo(this.(HeaderDeclaration).getValueArg())
+    )
+  }
+
+  override predicate isSameSite() {
+    exists(StrConst str |
+      str.getText().regexpMatch(".*; *SameSite=(Strict|Lax);.*") and
+      DataFlow::exprNode(str)
+          .(DataFlow::LocalSourceNode)
+          .flowsTo(this.(HeaderDeclaration).getValueArg())
+    )
+  }
+
+  override DataFlow::Node getNameArg() { result = this.(HeaderDeclaration).getValueArg() }
+
+  override DataFlow::Node getValueArg() { result = this.(HeaderDeclaration).getValueArg() }
+
+  override DataFlow::Node getHeaderArg() { none() }
+}

python/ql/src/experimental/semmle/python/Frameworks.qll

@@ -14,3 +14,4 @@ private import experimental.semmle.python.libraries.PyJWT
 private import experimental.semmle.python.libraries.Python_JWT
 private import experimental.semmle.python.libraries.Authlib
 private import experimental.semmle.python.libraries.PythonJose
+private import experimental.semmle.python.frameworks.CopyFile

python/ql/src/experimental/semmle/python/frameworks/CopyFile.qll

@@ -0,0 +1,42 @@
+private import python
+private import experimental.semmle.python.Concepts
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.ApiGraphs
+
+private module CopyFileImpl {
+  /**
+   * The `shutil` module provides methods to copy or move files.
+   * See:
+   * - https://docs.python.org/3/library/shutil.html#shutil.copyfile
+   * - https://docs.python.org/3/library/shutil.html#shutil.copy
+   * - https://docs.python.org/3/library/shutil.html#shutil.copy2
+   * - https://docs.python.org/3/library/shutil.html#shutil.copytree
+   * - https://docs.python.org/3/library/shutil.html#shutil.move
+   */
+  private class CopyFiles extends DataFlow::CallCfgNode, CopyFile::Range {
+    CopyFiles() {
+      this =
+        API::moduleImport("shutil")
+            .getMember(["copyfile", "copy", "copy2", "copytree", "move"])
+            .getACall()
+    }
+
+    override DataFlow::Node getAPathArgument() {
+      result in [this.getArg(0), this.getArgByName("src")]
+    }
+
+    override DataFlow::Node getfsrcArgument() { none() }
+  }
+
+  // TODO: once we have flow summaries, model `shutil.copyfileobj` which copies the content between its' file-like arguments.
+  // See https://docs.python.org/3/library/shutil.html#shutil.copyfileobj
+  private class CopyFileobj extends DataFlow::CallCfgNode, CopyFile::Range {
+    CopyFileobj() { this = API::moduleImport("shutil").getMember("copyfileobj").getACall() }
+
+    override DataFlow::Node getfsrcArgument() {
+      result in [this.getArg(0), this.getArgByName("fsrc")]
+    }
+
+    override DataFlow::Node getAPathArgument() { none() }
+  }
+}

python/ql/src/experimental/semmle/python/frameworks/Django.qll

@@ -9,17 +9,18 @@ private import semmle.python.dataflow.new.DataFlow
 private import experimental.semmle.python.Concepts
 private import semmle.python.ApiGraphs
 import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.Concepts
 
 private module ExperimentalPrivateDjango {
-  private module django {
+  private module DjangoMod {
     API::Node http() { result = API::moduleImport("django").getMember("http") }
 
-    module http {
+    module Http {
       API::Node response() { result = http().getMember("response") }
 
       API::Node request() { result = http().getMember("request") }
 
-      module request {
+      module Request {
         module HttpRequest {
           class DjangoGETParameter extends DataFlow::Node, RemoteFlowSource::Range {
             DjangoGETParameter() { this = request().getMember("GET").getMember("get").getACall() }
@@ -29,25 +30,67 @@ private module ExperimentalPrivateDjango {
         }
       }
 
-      module response {
+      module Response {
         module HttpResponse {
           API::Node baseClassRef() {
-            result = response().getMember("HttpResponse").getReturn()
+            result = response().getMember("HttpResponse")
             or
             // Handle `django.http.HttpResponse` alias
-            result = http().getMember("HttpResponse").getReturn()
+            result = http().getMember("HttpResponse")
           }
 
+          /** Gets a reference to the `django.http.response.HttpResponse` class. */
+          API::Node classRef() { result = baseClassRef().getASubclass*() }
+
+          /**
+           * A source of instances of `django.http.response.HttpResponse`, extend this class to model new instances.
+           *
+           * This can include instantiations of the class, return values from function
+           * calls, or a special parameter that will be set when functions are called by an external
+           * library.
+           *
+           * Use the predicate `HttpResponse::instance()` to get references to instances of `django.http.response.HttpResponse`.
+           */
+          abstract class InstanceSource extends HTTP::Server::HttpResponse::Range, DataFlow::Node {
+          }
+
+          /** A direct instantiation of `django.http.response.HttpResponse`. */
+          private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
+            ClassInstantiation() { this = classRef().getACall() }
+
+            override DataFlow::Node getBody() {
+              result in [this.getArg(0), this.getArgByName("content")]
+            }
+
+            // How to support the `headers` argument here?
+            override DataFlow::Node getMimetypeOrContentTypeArg() {
+              result in [this.getArg(1), this.getArgByName("content_type")]
+            }
+
+            override string getMimetypeDefault() { result = "text/html" }
+          }
+
+          /** Gets a reference to an instance of `django.http.response.HttpResponse`. */
+          private DataFlow::TypeTrackingNode instance(DataFlow::TypeTracker t) {
+            t.start() and
+            result instanceof InstanceSource
+            or
+            exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
+          }
+
+          /** Gets a reference to an instance of `django.http.response.HttpResponse`. */
+          DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
+
           /** Gets a reference to a header instance. */
           private DataFlow::LocalSourceNode headerInstance(DataFlow::TypeTracker t) {
             t.start() and
             (
               exists(SubscriptNode subscript |
-                subscript.getObject() = baseClassRef().getAUse().asCfgNode() and
+                subscript.getObject() = baseClassRef().getReturn().getAUse().asCfgNode() and
                 result.asCfgNode() = subscript
               )
               or
-              result.(DataFlow::AttrRead).getObject() = baseClassRef().getAUse()
+              result.(DataFlow::AttrRead).getObject() = baseClassRef().getReturn().getAUse()
             )
             or
             exists(DataFlow::TypeTracker t2 | result = headerInstance(t2).track(t2, t))
@@ -86,6 +129,63 @@ private module ExperimentalPrivateDjango {
 
             override DataFlow::Node getValueArg() { result = headerInput }
           }
+
+          /**
+           * Gets a call to `set_cookie()`.
+           *
+           * Given the following example:
+           *
+           * ```py
+           * def django_response(request):
+           *    resp = django.http.HttpResponse()
+           *    resp.set_cookie("name", "value", secure=True, httponly=True, samesite='Lax')
+           *    return resp
+           * ```
+           *
+           * * `this` would be `resp.set_cookie("name", "value", secure=False, httponly=False, samesite='None')`.
+           * * `getName()`'s result would be `"name"`.
+           * * `getValue()`'s result would be `"value"`.
+           * * `isSecure()` predicate would succeed.
+           * * `isHttpOnly()` predicate would succeed.
+           * * `isSameSite()` predicate would succeed.
+           */
+          class DjangoResponseSetCookieCall extends DataFlow::MethodCallNode, Cookie::Range {
+            DjangoResponseSetCookieCall() {
+              this.calls(PrivateDjango::DjangoImpl::Http::Response::HttpResponse::instance(),
+                "set_cookie")
+            }
+
+            override DataFlow::Node getNameArg() {
+              result in [this.getArg(0), this.getArgByName("key")]
+            }
+
+            override DataFlow::Node getValueArg() {
+              result in [this.getArg(1), this.getArgByName("value")]
+            }
+
+            override predicate isSecure() {
+              DataFlow::exprNode(any(True t))
+                  .(DataFlow::LocalSourceNode)
+                  .flowsTo(this.(DataFlow::CallCfgNode).getArgByName("secure"))
+            }
+
+            override predicate isHttpOnly() {
+              DataFlow::exprNode(any(True t))
+                  .(DataFlow::LocalSourceNode)
+                  .flowsTo(this.(DataFlow::CallCfgNode).getArgByName("httponly"))
+            }
+
+            override predicate isSameSite() {
+              exists(StrConst str |
+                str.getText() in ["Strict", "Lax"] and
+                DataFlow::exprNode(str)
+                    .(DataFlow::LocalSourceNode)
+                    .flowsTo(this.(DataFlow::CallCfgNode).getArgByName("samesite"))
+              )
+            }
+
+            override DataFlow::Node getHeaderArg() { none() }
+          }
         }
       }
     }

python/ql/src/experimental/semmle/python/frameworks/Flask.qll

@@ -8,6 +8,7 @@ private import semmle.python.frameworks.Flask
 private import semmle.python.dataflow.new.DataFlow
 private import experimental.semmle.python.Concepts
 private import semmle.python.ApiGraphs
+private import semmle.python.frameworks.Flask
 
 module ExperimentalFlask {
   /**
@@ -27,17 +28,8 @@ module ExperimentalFlask {
   }
 
   /** Gets a reference to a header instance. */
-  private DataFlow::LocalSourceNode headerInstance(DataFlow::TypeTracker t) {
-    t.start() and
-    result.(DataFlow::AttrRead).getObject().getALocalSource() =
-      [Flask::Response::classRef(), flaskMakeResponse()].getReturn().getAUse()
-    or
-    exists(DataFlow::TypeTracker t2 | result = headerInstance(t2).track(t2, t))
-  }
-
-  /** Gets a reference to a header instance use. */
-  private DataFlow::Node headerInstance() {
-    headerInstance(DataFlow::TypeTracker::end()).flowsTo(result)
+  private DataFlow::LocalSourceNode headerInstance() {
+    result = [Flask::Response::classRef(), flaskMakeResponse()].getReturn().getAMember().getAUse()
   }
 
   /** Gets a reference to a header instance call/subscript */
@@ -75,10 +67,62 @@ module ExperimentalFlask {
   private class FlaskResponse extends DataFlow::CallCfgNode, HeaderDeclaration::Range {
     KeyValuePair item;
 
-    FlaskResponse() { this = Flask::Response::classRef().getACall() }
+    FlaskResponse() {
+      this = Flask::Response::classRef().getACall() and
+      item = this.getArg(_).asExpr().(Dict).getAnItem()
+    }
 
     override DataFlow::Node getNameArg() { result.asExpr() = item.getKey() }
 
     override DataFlow::Node getValueArg() { result.asExpr() = item.getValue() }
   }
+
+  /**
+   * Gets a call to `set_cookie()`.
+   *
+   * Given the following example:
+   *
+   * ```py
+   * @app.route("/")
+   * def false():
+   *    resp = make_response()
+   *    resp.set_cookie("name", value="value", secure=True, httponly=True, samesite='Lax')
+   *    return resp
+   * ```
+   *
+   * * `this` would be `resp.set_cookie("name", value="value", secure=False, httponly=False, samesite='None')`.
+   * * `getName()`'s result would be `"name"`.
+   * * `getValue()`'s result would be `"value"`.
+   * * `isSecure()` predicate would succeed.
+   * * `isHttpOnly()` predicate would succeed.
+   * * `isSameSite()` predicate would succeed.
+   */
+  class FlaskSetCookieCall extends Cookie::Range instanceof Flask::FlaskResponseSetCookieCall {
+    override DataFlow::Node getNameArg() { result = this.getNameArg() }
+
+    override DataFlow::Node getValueArg() { result = this.getValueArg() }
+
+    override predicate isSecure() {
+      DataFlow::exprNode(any(True t))
+          .(DataFlow::LocalSourceNode)
+          .flowsTo(this.(DataFlow::CallCfgNode).getArgByName("secure"))
+    }
+
+    override predicate isHttpOnly() {
+      DataFlow::exprNode(any(True t))
+          .(DataFlow::LocalSourceNode)
+          .flowsTo(this.(DataFlow::CallCfgNode).getArgByName("httponly"))
+    }
+
+    override predicate isSameSite() {
+      exists(StrConst str |
+        str.getText() in ["Strict", "Lax"] and
+        DataFlow::exprNode(str)
+            .(DataFlow::LocalSourceNode)
+            .flowsTo(this.(DataFlow::CallCfgNode).getArgByName("samesite"))
+      )
+    }
+
+    override DataFlow::Node getHeaderArg() { none() }
+  }
 }

python/ql/src/experimental/semmle/python/frameworks/LDAP.qll

@@ -60,7 +60,7 @@ private module LDAP {
      *
      * See `LDAP2QueryMethods`
      */
-    private class LDAP2Query extends DataFlow::CallCfgNode, LDAPQuery::Range {
+    private class LDAP2Query extends DataFlow::CallCfgNode, LdapQuery::Range {
       LDAP2Query() { this.getFunction() = ldapQuery() }
 
       override DataFlow::Node getQuery() {
@@ -98,7 +98,7 @@ private module LDAP {
      *
      * See `LDAP2BindMethods`
      */
-    private class LDAP2Bind extends DataFlow::CallCfgNode, LDAPBind::Range {
+    private class LDAP2Bind extends DataFlow::CallCfgNode, LdapBind::Range {
       LDAP2Bind() { this.getFunction() = ldapBind() }
 
       override DataFlow::Node getPassword() {
@@ -149,7 +149,7 @@ private module LDAP {
      *
      * See https://github.com/python-ldap/python-ldap/blob/7ce471e238cdd9a4dd8d17baccd1c9e05e6f894a/Lib/ldap/dn.py#L17
      */
-    private class LDAP2EscapeDNCall extends DataFlow::CallCfgNode, LDAPEscape::Range {
+    private class LDAP2EscapeDNCall extends DataFlow::CallCfgNode, LdapEscape::Range {
       LDAP2EscapeDNCall() { this = ldap().getMember("dn").getMember("escape_dn_chars").getACall() }
 
       override DataFlow::Node getAnInput() { result = this.getArg(0) }
@@ -160,7 +160,7 @@ private module LDAP {
      *
      * See https://www.python-ldap.org/en/python-ldap-3.3.0/reference/ldap-filter.html#ldap.filter.escape_filter_chars
      */
-    private class LDAP2EscapeFilterCall extends DataFlow::CallCfgNode, LDAPEscape::Range {
+    private class LDAP2EscapeFilterCall extends DataFlow::CallCfgNode, LdapEscape::Range {
       LDAP2EscapeFilterCall() {
         this = ldap().getMember("filter").getMember("escape_filter_chars").getACall()
       }
@@ -190,7 +190,7 @@ private module LDAP {
     /**
      * A class to find `ldap3` methods executing a query.
      */
-    private class LDAP3Query extends DataFlow::CallCfgNode, LDAPQuery::Range {
+    private class LDAP3Query extends DataFlow::CallCfgNode, LdapQuery::Range {
       LDAP3Query() {
         this.getFunction().(DataFlow::AttrRead).getObject().getALocalSource() =
           ldap3Connection().getACall() and
@@ -203,7 +203,7 @@ private module LDAP {
     /**
      * A class to find `ldap3` methods binding a connection.
      */
-    class LDAP3Bind extends DataFlow::CallCfgNode, LDAPBind::Range {
+    class LDAP3Bind extends DataFlow::CallCfgNode, LdapBind::Range {
       LDAP3Bind() { this = ldap3Connection().getACall() }
 
       override DataFlow::Node getPassword() {
@@ -241,7 +241,7 @@ private module LDAP {
      *
      * See https://github.com/cannatag/ldap3/blob/4d33166f0869b929f59c6e6825a1b9505eb99967/ldap3/utils/dn.py#L390
      */
-    private class LDAP3EscapeDNCall extends DataFlow::CallCfgNode, LDAPEscape::Range {
+    private class LDAP3EscapeDNCall extends DataFlow::CallCfgNode, LdapEscape::Range {
       LDAP3EscapeDNCall() { this = ldap3Utils().getMember("dn").getMember("escape_rdn").getACall() }
 
       override DataFlow::Node getAnInput() { result = this.getArg(0) }
@@ -252,7 +252,7 @@ private module LDAP {
      *
      * See https://github.com/cannatag/ldap3/blob/4d33166f0869b929f59c6e6825a1b9505eb99967/ldap3/utils/conv.py#L91
      */
-    private class LDAP3EscapeFilterCall extends DataFlow::CallCfgNode, LDAPEscape::Range {
+    private class LDAP3EscapeFilterCall extends DataFlow::CallCfgNode, LdapEscape::Range {
       LDAP3EscapeFilterCall() {
         this = ldap3Utils().getMember("conv").getMember("escape_filter_chars").getACall()
       }

python/ql/src/experimental/semmle/python/frameworks/NoSQL.qll

@@ -10,11 +10,15 @@ private import semmle.python.dataflow.new.RemoteFlowSources
 private import experimental.semmle.python.Concepts
 private import semmle.python.ApiGraphs
 
-private module NoSQL {
+private module NoSql {
   // API Nodes returning `Mongo` instances.
   /** Gets a reference to `pymongo.MongoClient` */
   private API::Node pyMongo() {
     result = API::moduleImport("pymongo").getMember("MongoClient").getReturn()
+    or
+    // see https://pymongo.readthedocs.io/en/stable/api/pymongo/mongo_client.html#pymongo.mongo_client.MongoClient
+    result =
+      API::moduleImport("pymongo").getMember("mongo_client").getMember("MongoClient").getReturn()
   }
 
   /** Gets a reference to `flask_pymongo.PyMongo` */
@@ -34,40 +38,36 @@ private module NoSQL {
    * Gets a reference to an initialized `Mongo` instance.
    * See `pyMongo()`, `flask_PyMongo()`
    */
-  private API::Node mongoInstance() {
+  private API::Node mongoClientInstance() {
     result = pyMongo() or
     result = flask_PyMongo()
   }
 
   /**
-   * Gets a reference to an initialized `Mongo` DB instance.
-   * See `mongoEngine()`, `flask_MongoEngine()`
+   * Gets a reference to a `Mongo` DB instance.
    */
-  private API::Node mongoDBInstance() {
-    result = mongoEngine().getMember(["get_db", "connect"]).getReturn() or
-    result = mongoEngine().getMember("connection").getMember(["get_db", "connect"]).getReturn() or
-    result = flask_MongoEngine().getMember("get_db").getReturn()
-  }
-
-  /**
-   * Gets a reference to a `Mongo` DB use.
-   *
-   * See `mongoInstance()`, `mongoDBInstance()`.
-   */
-  private DataFlow::LocalSourceNode mongoDB(DataFlow::TypeTracker t) {
+  private DataFlow::LocalSourceNode mongoDBInstance(DataFlow::TypeTracker t) {
     t.start() and
     (
       exists(SubscriptNode subscript |
-        subscript.getObject() = mongoInstance().getAUse().asCfgNode() and
+        subscript.getObject() = mongoClientInstance().getAUse().asCfgNode() and
         result.asCfgNode() = subscript
       )
       or
-      result.(DataFlow::AttrRead).getObject() = mongoInstance().getAUse()
+      result.(DataFlow::AttrRead).getObject() = mongoClientInstance().getAUse()
       or
-      result = mongoDBInstance().getAUse()
+      result = mongoEngine().getMember(["get_db", "connect"]).getACall()
+      or
+      result = mongoEngine().getMember("connection").getMember(["get_db", "connect"]).getACall()
+      or
+      result = flask_MongoEngine().getMember("get_db").getACall()
+      or
+      // see https://pymongo.readthedocs.io/en/stable/api/pymongo/mongo_client.html#pymongo.mongo_client.MongoClient.get_default_database
+      // see https://pymongo.readthedocs.io/en/stable/api/pymongo/mongo_client.html#pymongo.mongo_client.MongoClient.get_database
+      result = mongoClientInstance().getMember(["get_default_database", "get_database"]).getACall()
     )
     or
-    exists(DataFlow::TypeTracker t2 | result = mongoDB(t2).track(t2, t))
+    exists(DataFlow::TypeTracker t2 | result = mongoDBInstance(t2).track(t2, t))
   }
 
   /**
@@ -81,21 +81,27 @@ private module NoSQL {
    *
    * `mongo.db` would be a use of a `Mongo` instance, and so the result.
    */
-  private DataFlow::Node mongoDB() { mongoDB(DataFlow::TypeTracker::end()).flowsTo(result) }
+  private DataFlow::Node mongoDBInstance() {
+    mongoDBInstance(DataFlow::TypeTracker::end()).flowsTo(result)
+  }
 
   /**
    * Gets a reference to a `Mongo` collection use.
-   *
-   * See `mongoDB()`.
    */
   private DataFlow::LocalSourceNode mongoCollection(DataFlow::TypeTracker t) {
     t.start() and
     (
       exists(SubscriptNode subscript | result.asCfgNode() = subscript |
-        subscript.getObject() = mongoDB().asCfgNode()
+        subscript.getObject() = mongoDBInstance().asCfgNode()
       )
       or
-      result.(DataFlow::AttrRead).getObject() = mongoDB()
+      result.(DataFlow::AttrRead).getObject() = mongoDBInstance()
+      or
+      // see https://pymongo.readthedocs.io/en/stable/api/pymongo/database.html#pymongo.database.Database.get_collection
+      // see https://pymongo.readthedocs.io/en/stable/api/pymongo/database.html#pymongo.database.Database.create_collection
+      result
+          .(DataFlow::MethodCallNode)
+          .calls(mongoDBInstance(), ["get_collection", "create_collection"])
     )
     or
     exists(DataFlow::TypeTracker t2 | result = mongoCollection(t2).track(t2, t))
@@ -153,7 +159,7 @@ private module NoSQL {
    *
    * `mongo.db.user.find({'name': safe_search})` would be a collection method call, and so the result.
    */
-  private class MongoCollectionCall extends DataFlow::CallCfgNode, NoSQLQuery::Range {
+  private class MongoCollectionCall extends DataFlow::CallCfgNode, NoSqlQuery::Range {
     MongoCollectionCall() { this.getFunction() = mongoCollectionMethod() }
 
     override DataFlow::Node getQuery() { result = this.getArg(0) }
@@ -174,7 +180,7 @@ private module NoSQL {
    *
    * `Movie.objects(__raw__=json_search)` would be the result.
    */
-  private class MongoEngineObjectsCall extends DataFlow::CallCfgNode, NoSQLQuery::Range {
+  private class MongoEngineObjectsCall extends DataFlow::CallCfgNode, NoSqlQuery::Range {
     MongoEngineObjectsCall() {
       this =
         [mongoEngine(), flask_MongoEngine()]
@@ -188,7 +194,7 @@ private module NoSQL {
   }
 
   /** Gets a reference to `mongosanitizer.sanitizer.sanitize` */
-  private class MongoSanitizerCall extends DataFlow::CallCfgNode, NoSQLSanitizer::Range {
+  private class MongoSanitizerCall extends DataFlow::CallCfgNode, NoSqlSanitizer::Range {
     MongoSanitizerCall() {
       this =
         API::moduleImport("mongosanitizer").getMember("sanitizer").getMember("sanitize").getACall()
@@ -202,12 +208,15 @@ private module NoSQL {
    * If at any time ObjectId can't parse it's input (like when a tainted dict in passed in),
    * then ObjectId will throw an error preventing the query from running.
    */
-  private class BsonObjectIdCall extends DataFlow::CallCfgNode, NoSQLSanitizer::Range {
+  private class BsonObjectIdCall extends DataFlow::CallCfgNode, NoSqlSanitizer::Range {
     BsonObjectIdCall() {
-      this =
-        API::moduleImport(["bson", "bson.objectid", "bson.json_util"])
-            .getMember("ObjectId")
-            .getACall()
+      exists(API::Node mod |
+        mod = API::moduleImport("bson")
+        or
+        mod = API::moduleImport("bson").getMember(["objectid", "json_util"])
+      |
+        this = mod.getMember("ObjectId").getACall()
+      )
     }
 
     override DataFlow::Node getAnInput() { result = this.getArg(0) }

python/ql/src/experimental/semmle/python/frameworks/Werkzeug.qll

@@ -12,7 +12,7 @@ private import experimental.semmle.python.Concepts
 private import semmle.python.ApiGraphs
 
 private module Werkzeug {
-  module datastructures {
+  module Datastructures {
     module Headers {
       class WerkzeugHeaderAddCall extends DataFlow::CallCfgNode, HeaderDeclaration::Range {
         WerkzeugHeaderAddCall() {

python/ql/src/experimental/semmle/python/libraries/Authlib.qll

@@ -5,7 +5,7 @@ private import experimental.semmle.python.frameworks.JWT
 
 private module Authlib {
   /** Gets a reference to `authlib.jose.(jwt|JsonWebToken)` */
-  private API::Node authlibJWT() {
+  private API::Node authlibJwt() {
     result in [
         API::moduleImport("authlib").getMember("jose").getMember("jwt"),
         API::moduleImport("authlib").getMember("jose").getMember("JsonWebToken").getReturn()
@@ -13,10 +13,10 @@ private module Authlib {
   }
 
   /** Gets a reference to `jwt.encode` */
-  private API::Node authlibJWTEncode() { result = authlibJWT().getMember("encode") }
+  private API::Node authlibJwtEncode() { result = authlibJwt().getMember("encode") }
 
   /** Gets a reference to `jwt.decode` */
-  private API::Node authlibJWTDecode() { result = authlibJWT().getMember("decode") }
+  private API::Node authlibJwtDecode() { result = authlibJwt().getMember("decode") }
 
   /**
    * Gets a call to `authlib.jose.(jwt|JsonWebToken).encode`.
@@ -33,8 +33,8 @@ private module Authlib {
    * * `getAlgorithm()`'s result would be `"HS256"`.
    * * `getAlgorithmstring()`'s result would be `HS256`.
    */
-  private class AuthlibJWTEncodeCall extends DataFlow::CallCfgNode, JWTEncoding::Range {
-    AuthlibJWTEncodeCall() { this = authlibJWTEncode().getACall() }
+  private class AuthlibJwtEncodeCall extends DataFlow::CallCfgNode, JwtEncoding::Range {
+    AuthlibJwtEncodeCall() { this = authlibJwtEncode().getACall() }
 
     override DataFlow::Node getPayload() { result = this.getArg(1) }
 
@@ -43,7 +43,7 @@ private module Authlib {
     override DataFlow::Node getAlgorithm() {
       exists(KeyValuePair headerDict |
         headerDict = this.getArg(0).asExpr().(Dict).getItem(_) and
-        headerDict.getKey().(Str_).getS().matches("alg") and
+        headerDict.getKey().(Str_).getS() = "alg" and
         result.asExpr() = headerDict.getValue()
       )
     }
@@ -69,8 +69,8 @@ private module Authlib {
    * * `getPayload()`'s result would be `token`.
    * * `getKey()`'s result would be `key`.
    */
-  private class AuthlibJWTDecodeCall extends DataFlow::CallCfgNode, JWTDecoding::Range {
-    AuthlibJWTDecodeCall() { this = authlibJWTDecode().getACall() }
+  private class AuthlibJwtDecodeCall extends DataFlow::CallCfgNode, JwtDecoding::Range {
+    AuthlibJwtDecodeCall() { this = authlibJwtDecode().getACall() }
 
     override DataFlow::Node getPayload() { result = this.getArg(0) }
 

python/ql/src/experimental/semmle/python/libraries/PyJWT.qll

@@ -3,7 +3,7 @@ private import experimental.semmle.python.Concepts
 private import semmle.python.ApiGraphs
 private import experimental.semmle.python.frameworks.JWT
 
-private module PyJWT {
+private module PyJwt {
   /** Gets a reference to `jwt.encode` */
   private API::Node pyjwtEncode() { result = API::moduleImport("jwt").getMember("encode") }
 
@@ -25,8 +25,8 @@ private module PyJWT {
    * * `getAlgorithm()`'s result would be `"HS256"`.
    * * `getAlgorithmstring()`'s result would be `HS256`.
    */
-  private class PyJWTEncodeCall extends DataFlow::CallCfgNode, JWTEncoding::Range {
-    PyJWTEncodeCall() { this = pyjwtEncode().getACall() }
+  private class PyJwtEncodeCall extends DataFlow::CallCfgNode, JwtEncoding::Range {
+    PyJwtEncodeCall() { this = pyjwtEncode().getACall() }
 
     override DataFlow::Node getPayload() {
       result in [this.getArg(0), this.getArgByName("payload")]
@@ -63,8 +63,8 @@ private module PyJWT {
    * * `getOptions()`'s result would be `{"verify_signature": True}`.
    * * `verifiesSignature()` predicate would succeed.
    */
-  private class PyJWTDecodeCall extends DataFlow::CallCfgNode, JWTDecoding::Range {
-    PyJWTDecodeCall() { this = pyjwtDecode().getACall() }
+  private class PyJwtDecodeCall extends DataFlow::CallCfgNode, JwtDecoding::Range {
+    PyJwtDecodeCall() { this = pyjwtDecode().getACall() }
 
     override DataFlow::Node getPayload() { result in [this.getArg(0), this.getArgByName("jwt")] }
 

python/ql/src/experimental/semmle/python/libraries/PythonJose.qll

@@ -5,13 +5,13 @@ private import experimental.semmle.python.frameworks.JWT
 
 private module PythonJose {
   /** Gets a reference to `jwt` */
-  private API::Node joseJWT() { result = API::moduleImport("jose").getMember("jwt") }
+  private API::Node joseJwt() { result = API::moduleImport("jose").getMember("jwt") }
 
   /** Gets a reference to `jwt.encode` */
-  private API::Node joseJWTEncode() { result = joseJWT().getMember("encode") }
+  private API::Node joseJwtEncode() { result = joseJwt().getMember("encode") }
 
   /** Gets a reference to `jwt.decode` */
-  private API::Node joseJWTDecode() { result = joseJWT().getMember("decode") }
+  private API::Node joseJwtDecode() { result = joseJwt().getMember("decode") }
 
   /**
    * Gets a call to `jwt.encode`.
@@ -28,8 +28,8 @@ private module PythonJose {
    * * `getAlgorithm()`'s result would be `"HS256"`.
    * * `getAlgorithmstring()`'s result would be `HS256`.
    */
-  private class JoseJWTEncodeCall extends DataFlow::CallCfgNode, JWTEncoding::Range {
-    JoseJWTEncodeCall() { this = joseJWTEncode().getACall() }
+  private class JoseJwtEncodeCall extends DataFlow::CallCfgNode, JwtEncoding::Range {
+    JoseJwtEncodeCall() { this = joseJwtEncode().getACall() }
 
     override DataFlow::Node getPayload() { result = this.getArg(0) }
 
@@ -64,8 +64,8 @@ private module PythonJose {
    * * `getOptions()`'s result would be none.
    * * `verifiesSignature()` predicate would succeed.
    */
-  private class JoseJWTDecodeCall extends DataFlow::CallCfgNode, JWTDecoding::Range {
-    JoseJWTDecodeCall() { this = joseJWTDecode().getACall() }
+  private class JoseJwtDecodeCall extends DataFlow::CallCfgNode, JwtDecoding::Range {
+    JoseJwtDecodeCall() { this = joseJwtDecode().getACall() }
 
     override DataFlow::Node getPayload() { result = this.getArg(0) }
 

python/ql/src/experimental/semmle/python/libraries/Python_JWT.qll

@@ -2,7 +2,7 @@ private import python
 private import experimental.semmle.python.Concepts
 private import semmle.python.ApiGraphs
 
-private module Python_JWT {
+private module Python_Jwt {
   /**
    * Gets a call to `python_jwt.process_jwt`.
    *
@@ -21,7 +21,7 @@ private module Python_JWT {
    * * `getOptions()`'s result would be `none()`.
    * * `verifiesSignature()` predicate would succeed.
    */
-  private class PythonJwtProcessCall extends DataFlow::CallCfgNode, JWTDecoding::Range {
+  private class PythonJwtProcessCall extends DataFlow::CallCfgNode, JwtDecoding::Range {
     PythonJwtProcessCall() {
       this = API::moduleImport("python_jwt").getMember("process_jwt").getACall()
     }

python/ql/src/experimental/semmle/python/security/LDAPInsecureAuth.qll

@@ -18,8 +18,8 @@ string getPrivateHostRegex() {
 }
 
 // "ldap://somethingon.theinternet.com"
-class LDAPFullHost extends StrConst {
-  LDAPFullHost() {
+class LdapFullHost extends StrConst {
+  LdapFullHost() {
     exists(string s |
       s = this.getText() and
       s.regexpMatch(getFullHostRegex()) and
@@ -29,27 +29,39 @@ class LDAPFullHost extends StrConst {
   }
 }
 
-class LDAPSchema extends StrConst {
-  LDAPSchema() { this.getText().regexpMatch(getSchemaRegex()) }
+/** DEPRECATED: Alias for LdapFullHost */
+deprecated class LDAPFullHost = LdapFullHost;
+
+class LdapSchema extends StrConst {
+  LdapSchema() { this.getText().regexpMatch(getSchemaRegex()) }
 }
 
-class LDAPPrivateHost extends StrConst {
-  LDAPPrivateHost() { this.getText().regexpMatch(getPrivateHostRegex()) }
+/** DEPRECATED: Alias for LdapSchema */
+deprecated class LDAPSchema = LdapSchema;
+
+class LdapPrivateHost extends StrConst {
+  LdapPrivateHost() { this.getText().regexpMatch(getPrivateHostRegex()) }
 }
 
-predicate concatAndCompareAgainstFullHostRegex(LDAPSchema schema, StrConst host) {
-  not host instanceof LDAPPrivateHost and
+/** DEPRECATED: Alias for LdapPrivateHost */
+deprecated class LDAPPrivateHost = LdapPrivateHost;
+
+predicate concatAndCompareAgainstFullHostRegex(LdapSchema schema, StrConst host) {
+  not host instanceof LdapPrivateHost and
   (schema.getText() + host.getText()).regexpMatch(getFullHostRegex())
 }
 
 // "ldap://" + "somethingon.theinternet.com"
-class LDAPBothStrings extends BinaryExpr {
-  LDAPBothStrings() { concatAndCompareAgainstFullHostRegex(this.getLeft(), this.getRight()) }
+class LdapBothStrings extends BinaryExpr {
+  LdapBothStrings() { concatAndCompareAgainstFullHostRegex(this.getLeft(), this.getRight()) }
 }
 
+/** DEPRECATED: Alias for LdapBothStrings */
+deprecated class LDAPBothStrings = LdapBothStrings;
+
 // schema + host
-class LDAPBothVar extends BinaryExpr {
-  LDAPBothVar() {
+class LdapBothVar extends BinaryExpr {
+  LdapBothVar() {
     exists(SsaVariable schemaVar, SsaVariable hostVar |
       this.getLeft() = schemaVar.getVariable().getALoad() and // getAUse is incompatible with Expr
       this.getRight() = hostVar.getVariable().getALoad() and
@@ -61,9 +73,12 @@ class LDAPBothVar extends BinaryExpr {
   }
 }
 
+/** DEPRECATED: Alias for LdapBothVar */
+deprecated class LDAPBothVar = LdapBothVar;
+
 // schema + "somethingon.theinternet.com"
-class LDAPVarString extends BinaryExpr {
-  LDAPVarString() {
+class LdapVarString extends BinaryExpr {
+  LdapVarString() {
     exists(SsaVariable schemaVar |
       this.getLeft() = schemaVar.getVariable().getALoad() and
       concatAndCompareAgainstFullHostRegex(schemaVar
@@ -74,9 +89,12 @@ class LDAPVarString extends BinaryExpr {
   }
 }
 
+/** DEPRECATED: Alias for LdapVarString */
+deprecated class LDAPVarString = LdapVarString;
+
 // "ldap://" + host
-class LDAPStringVar extends BinaryExpr {
-  LDAPStringVar() {
+class LdapStringVar extends BinaryExpr {
+  LdapStringVar() {
     exists(SsaVariable hostVar |
       this.getRight() = hostVar.getVariable().getALoad() and
       concatAndCompareAgainstFullHostRegex(this.getLeft(),
@@ -85,22 +103,28 @@ class LDAPStringVar extends BinaryExpr {
   }
 }
 
+/** DEPRECATED: Alias for LdapStringVar */
+deprecated class LDAPStringVar = LdapStringVar;
+
 /**
  * A taint-tracking configuration for detecting LDAP insecure authentications.
  */
-class LDAPInsecureAuthConfig extends TaintTracking::Configuration {
-  LDAPInsecureAuthConfig() { this = "LDAPInsecureAuthConfig" }
+class LdapInsecureAuthConfig extends TaintTracking::Configuration {
+  LdapInsecureAuthConfig() { this = "LDAPInsecureAuthConfig" }
 
   override predicate isSource(DataFlow::Node source) {
     source instanceof RemoteFlowSource or
-    source.asExpr() instanceof LDAPFullHost or
-    source.asExpr() instanceof LDAPBothStrings or
-    source.asExpr() instanceof LDAPBothVar or
-    source.asExpr() instanceof LDAPVarString or
-    source.asExpr() instanceof LDAPStringVar
+    source.asExpr() instanceof LdapFullHost or
+    source.asExpr() instanceof LdapBothStrings or
+    source.asExpr() instanceof LdapBothVar or
+    source.asExpr() instanceof LdapVarString or
+    source.asExpr() instanceof LdapStringVar
   }
 
   override predicate isSink(DataFlow::Node sink) {
-    exists(LDAPBind ldapBind | not ldapBind.useSSL() and sink = ldapBind.getHost())
+    exists(LdapBind ldapBind | not ldapBind.useSSL() and sink = ldapBind.getHost())
   }
 }
+
+/** DEPRECATED: Alias for LdapInsecureAuthConfig */
+deprecated class LDAPInsecureAuthConfig = LdapInsecureAuthConfig;

python/ql/src/experimental/semmle/python/security/ZipSlip.qll

@@ -0,0 +1,39 @@
+import python
+import experimental.semmle.python.Concepts
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.ApiGraphs
+import semmle.python.dataflow.new.TaintTracking
+
+class ZipSlipConfig extends TaintTracking::Configuration {
+  ZipSlipConfig() { this = "ZipSlipConfig" }
+
+  override predicate isSource(DataFlow::Node source) {
+    (
+      source =
+        API::moduleImport("zipfile").getMember("ZipFile").getReturn().getMember("open").getACall() or
+      source =
+        API::moduleImport("zipfile")
+            .getMember("ZipFile")
+            .getReturn()
+            .getMember("namelist")
+            .getACall() or
+      source = API::moduleImport("tarfile").getMember("open").getACall() or
+      source = API::moduleImport("tarfile").getMember("TarFile").getACall() or
+      source = API::moduleImport("bz2").getMember("open").getACall() or
+      source = API::moduleImport("bz2").getMember("BZ2File").getACall() or
+      source = API::moduleImport("gzip").getMember("GzipFile").getACall() or
+      source = API::moduleImport("gzip").getMember("open").getACall() or
+      source = API::moduleImport("lzma").getMember("open").getACall() or
+      source = API::moduleImport("lzma").getMember("LZMAFile").getACall()
+    ) and
+    not source.getScope().getLocation().getFile().inStdlib()
+  }
+
+  override predicate isSink(DataFlow::Node sink) {
+    (
+      sink = any(CopyFile copyfile).getAPathArgument() or
+      sink = any(CopyFile copyfile).getfsrcArgument()
+    ) and
+    not sink.getScope().getLocation().getFile().inStdlib()
+  }
+}

python/ql/src/experimental/semmle/python/security/injection/CookieInjection.qll

@@ -0,0 +1,40 @@
+import python
+import experimental.semmle.python.Concepts
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.dataflow.new.TaintTracking
+import semmle.python.dataflow.new.RemoteFlowSources
+
+class CookieSink extends DataFlow::Node {
+  string flag;
+
+  CookieSink() {
+    exists(Cookie cookie |
+      this in [cookie.getNameArg(), cookie.getValueArg()] and
+      (
+        not cookie.isSecure() and
+        flag = "secure"
+        or
+        not cookie.isHttpOnly() and
+        flag = "httponly"
+        or
+        not cookie.isSameSite() and
+        flag = "samesite"
+      )
+    )
+  }
+
+  string getFlag() { result = flag }
+}
+
+/**
+ * A taint-tracking configuration for detecting Cookie injections.
+ */
+class CookieInjectionFlowConfig extends TaintTracking::Configuration {
+  CookieInjectionFlowConfig() { this = "CookieInjectionFlowConfig" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(Cookie c | sink in [c.getNameArg(), c.getValueArg()])
+  }
+}

python/ql/src/experimental/semmle/python/security/injection/NoSQLInjection.qll

@@ -5,7 +5,7 @@ import semmle.python.dataflow.new.RemoteFlowSources
 import experimental.semmle.python.Concepts
 import semmle.python.Concepts
 
-module NoSQLInjection {
+module NoSqlInjection {
   class Configuration extends TaintTracking::Configuration {
     Configuration() { this = "NoSQLInjection" }
 
@@ -15,17 +15,17 @@ module NoSQLInjection {
     }
 
     override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
-      sink = any(NoSQLQuery noSQLQuery).getQuery() and
+      sink = any(NoSqlQuery noSqlQuery).getQuery() and
       state instanceof ConvertedToDict
     }
 
-    override predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) {
+    override predicate isSanitizer(DataFlow::Node node, DataFlow::FlowState state) {
       // Block `RemoteInput` paths here, since they change state to `ConvertedToDict`
       exists(Decoding decoding | decoding.getFormat() = "JSON" and node = decoding.getOutput()) and
       state instanceof RemoteInput
     }
 
-    override predicate isAdditionalFlowStep(
+    override predicate isAdditionalTaintStep(
       DataFlow::Node nodeFrom, DataFlow::FlowState stateFrom, DataFlow::Node nodeTo,
       DataFlow::FlowState stateTo
     ) {
@@ -38,7 +38,7 @@ module NoSQLInjection {
     }
 
     override predicate isSanitizer(DataFlow::Node sanitizer) {
-      sanitizer = any(NoSQLSanitizer noSQLSanitizer).getAnInput()
+      sanitizer = any(NoSqlSanitizer noSqlSanitizer).getAnInput()
     }
   }
 
@@ -52,3 +52,6 @@ module NoSQLInjection {
     ConvertedToDict() { this = "ConvertedToDict" }
   }
 }
+
+/** DEPRECATED: Alias for NoSqlInjection */
+deprecated module NoSQLInjection = NoSqlInjection;

python/ql/src/experimental/semmle/python/security/injection/XSLT.qll

@@ -25,7 +25,7 @@ module XSLTInjection {
     ExternalXmlStringKind() { this = "etree.XML string" }
 
     override TaintKind getTaintForFlowStep(ControlFlowNode fromnode, ControlFlowNode tonode) {
-      etreeXML(fromnode, tonode) and result instanceof ExternalXmlKind
+      etreeXml(fromnode, tonode) and result instanceof ExternalXmlKind
       or
       etreeFromStringList(fromnode, tonode) and result instanceof ExternalXmlKind
       or
@@ -40,7 +40,7 @@ module XSLTInjection {
     ExternalXmlKind() { this = "lxml etree xml" }
   }
 
-  private predicate etreeXML(ControlFlowNode fromnode, CallNode tonode) {
+  private predicate etreeXml(ControlFlowNode fromnode, CallNode tonode) {
     // etree.XML("<xmlContent>")
     exists(CallNode call | call.getFunction().(AttrNode).getObject("XML").pointsTo(etree()) |
       call.getArg(0) = fromnode and

python/ql/src/experimental/semmle/python/templates/Airspeed.qll

@@ -8,7 +8,7 @@ import experimental.semmle.python.templates.SSTISink
 deprecated ClassValue theAirspeedTemplateClass() { result = Value::named("airspeed.Template") }
 
 /**
- * Sink representing the `airspeed.Template` class instantiation argument.
+ * A sink representing the `airspeed.Template` class instantiation argument.
  *
  *  import airspeed
  *  temp = airspeed.Template(`"sink"`)

python/ql/src/experimental/semmle/python/templates/Bottle.qll

@@ -10,7 +10,7 @@ deprecated ClassValue theBottleSimpleTemplateClass() {
 }
 
 /**
- * Sink representing the `bottle.SimpleTemplate` class instantiation argument.
+ * A sink representing the `bottle.SimpleTemplate` class instantiation argument.
  *
  *  from bottle import SimpleTemplate
  *  template = SimpleTemplate(`sink`)
@@ -29,7 +29,7 @@ deprecated class BottleSimpleTemplateSink extends SSTISink {
 }
 
 /**
- * Sink representing the `bottle.template` function call argument.
+ * A sink representing the `bottle.template` function call argument.
  *
  *  from bottle import template
  *  tmp = template(`sink`)

python/ql/src/experimental/semmle/python/templates/Chameleon.qll

@@ -10,7 +10,7 @@ deprecated ClassValue theChameleonPageTemplateClass() {
 }
 
 /**
- * Sink representing the `chameleon.PageTemplate` class instantiation argument.
+ * A sink representing the `chameleon.PageTemplate` class instantiation argument.
  *
  *  from chameleon import PageTemplate
  *  template = PageTemplate(`sink`)

python/ql/src/experimental/semmle/python/templates/Cheetah.qll

@@ -10,7 +10,7 @@ deprecated ClassValue theCheetahTemplateClass() {
 }
 
 /**
- * Sink representing the instantiation argument of any class which derives from
+ * A sink representing the instantiation argument of any class which derives from
  * the `Cheetah.Template.Template` class .
  *
  *  from Cheetah.Template import Template

python/ql/src/experimental/semmle/python/templates/Chevron.qll

@@ -8,7 +8,7 @@ import experimental.semmle.python.templates.SSTISink
 deprecated Value theChevronRenderFunc() { result = Value::named("chevron.render") }
 
 /**
- * Sink representing the `chevron.render` function call argument.
+ * A sink representing the `chevron.render` function call argument.
  *
  *  import chevron
  *  tmp = chevron.render(`sink`,{ 'key' : 'value' })

python/ql/src/experimental/semmle/python/templates/DjangoTemplate.qll

@@ -7,7 +7,7 @@ import experimental.semmle.python.templates.SSTISink
 deprecated ClassValue theDjangoTemplateClass() { result = Value::named("django.template.Template") }
 
 /**
- * Sink representng `django.template.Template` class instantiation argument.
+ * A sink representng `django.template.Template` class instantiation argument.
  *
  *  from django.template import Template
  *  template = Template(`sink`)

python/ql/src/experimental/semmle/python/templates/FlaskTemplate.qll

@@ -9,7 +9,7 @@ deprecated Value theFlaskRenderTemplateClass() {
 }
 
 /**
- * Sink representng `flask.render_template_string` function call argument.
+ * A sink representng `flask.render_template_string` function call argument.
  *
  *  from flask import render_template_string
  *  render_template_string(`sink`)

python/ql/src/experimental/semmle/python/templates/Genshi.qll

@@ -15,7 +15,7 @@ deprecated ClassValue theGenshiMarkupTemplateClass() {
 }
 
 /**
- * Sink representing the `genshi.template.TextTemplate` class instantiation argument.
+ * A sink representing the `genshi.template.TextTemplate` class instantiation argument.
  *
  *  from genshi.template import TextTemplate
  *  tmpl = TextTemplate('sink')
@@ -34,7 +34,7 @@ deprecated class GenshiTextTemplateSink extends SSTISink {
 }
 
 /**
- * Sink representing the `genshi.template.MarkupTemplate` class instantiation argument.
+ * A sink representing the `genshi.template.MarkupTemplate` class instantiation argument.
  *
  *  from genshi.template import MarkupTemplate
  *  tmpl = MarkupTemplate('sink')

python/ql/src/experimental/semmle/python/templates/Jinja.qll

@@ -11,7 +11,7 @@ deprecated ClassValue theJinja2TemplateClass() { result = Value::named("jinja2.T
 deprecated Value theJinja2FromStringValue() { result = Value::named("jinja2.from_string") }
 
 /**
- * Sink representing the `jinja2.Template` class instantiation argument.
+ * A sink representing the `jinja2.Template` class instantiation argument.
  *
  *  from jinja2 import Template
  *  template = Template(`sink`)
@@ -30,7 +30,7 @@ deprecated class Jinja2TemplateSink extends SSTISink {
 }
 
 /**
- * Sink representing the `jinja2.from_string` function call argument.
+ * A sink representing the `jinja2.from_string` function call argument.
  *
  *  from jinja2 import from_string
  *  template = from_string(`sink`)

python/ql/src/experimental/semmle/python/templates/Mako.qll

@@ -8,7 +8,7 @@ import experimental.semmle.python.templates.SSTISink
 deprecated ClassValue theMakoTemplateClass() { result = Value::named("mako.template.Template") }
 
 /**
- * Sink representing the `mako.template.Template` class instantiation argument.
+ * A sink representing the `mako.template.Template` class instantiation argument.
  *
  *  from mako.template import Template
  *  mytemplate = Template("hello world!")

python/ql/src/experimental/semmle/python/templates/TRender.qll

@@ -8,7 +8,7 @@ import experimental.semmle.python.templates.SSTISink
 deprecated ClassValue theTRenderTemplateClass() { result = Value::named("trender.TRender") }
 
 /**
- * Sink representing the `trender.TRender` class instantiation argument.
+ * A sink representing the `trender.TRender` class instantiation argument.
  *
  *  from trender import TRender
  *  template = TRender(`sink`)