Python: Adjust Xxe/XmlBomb for Python

I changed a few QLdocs so they fit the style we have used in Python...
although I surely do regret having introduced a new style for how these
QLDocs look :D

python/ql/src/experimental/Security/NEW/CWE-611/Xxe.ql

@@ -6,14 +6,14 @@
  * @problem.severity error
  * @security-severity 9.1
  * @precision high
- * @id js/xxe
+ * @id py/xxe
  * @tags security
  *       external/cwe/cwe-611
  *       external/cwe/cwe-827
  */
 
-import javascript
+import python
-import semmle.javascript.security.dataflow.XxeQuery
+import experimental.semmle.python.security.dataflow.XxeQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

python/ql/src/experimental/Security/NEW/CWE-776/XmlBomb.ql

@@ -6,14 +6,14 @@
  * @problem.severity warning
  * @security-severity 7.5
  * @precision high
- * @id js/xml-bomb
+ * @id py/xml-bomb
  * @tags security
  *       external/cwe/cwe-776
  *       external/cwe/cwe-400
  */
 
-import javascript
+import python
-import semmle.javascript.security.dataflow.XmlBombQuery
+import experimental.semmle.python.security.dataflow.XmlBombQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

python/ql/src/experimental/semmle/python/security/dataflow/XmlBombCustomizations.qll

@@ -1,12 +1,18 @@
 /**
- * Provides default sources, sinks and sanitizers for reasoning about
+ * Provides default sources, sinks and sanitizers for detecting
- * XML-bomb vulnerabilities, as well as extension points for adding
+ * "XML bomb"
- * your own.
+ * vulnerabilities, as well as extension points for adding your own.
  */
 
-import javascript
+private import python
-import semmle.javascript.security.dataflow.DOM
+private import semmle.python.dataflow.new.DataFlow
+private import experimental.semmle.python.Concepts
+private import semmle.python.dataflow.new.RemoteFlowSources
 
+/**
+ * Provides default sources, sinks and sanitizers for detecting "XML bomb"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
 module XmlBomb {
   /**
    * A data flow source for XML-bomb vulnerabilities.
@@ -28,21 +34,16 @@ module XmlBomb {
     RemoteFlowSourceAsSource() { this instanceof RemoteFlowSource }
   }
 
-  /**
-   * An access to `document.location`, considered as a flow source for XML bomb vulnerabilities.
-   */
-  class LocationAsSource extends Source, DataFlow::ValueNode {
-    LocationAsSource() { isLocation(astNode) }
-  }
-
   /**
    * A call to an XML parser that performs internal entity expansion, viewed
    * as a data flow sink for XML-bomb vulnerabilities.
    */
-  class XmlParsingWithEntityResolution extends Sink, DataFlow::ValueNode {
+  class XmlParsingWithEntityResolution extends Sink {
     XmlParsingWithEntityResolution() {
-      exists(XML::ParserInvocation parse | astNode = parse.getSourceArgument() |
+      exists(ExperimentalXML::XMLParsing parsing, ExperimentalXML::XMLVulnerabilityKind kind |
-        parse.resolvesEntities(XML::InternalEntity())
+        (kind.isBillionLaughs() or kind.isQuadraticBlowup()) and
+        parsing.vulnerableTo(kind) and
+        this = parsing.getAnInput()
       )
     }
   }

python/ql/src/experimental/semmle/python/security/dataflow/XmlBombQuery.qll

@@ -1,17 +1,18 @@
 /**
- * Provides a taint tracking configuration for reasoning about
+ * Provides a taint-tracking configuration for detecting "XML bomb" vulnerabilities.
- * XML-bomb vulnerabilities.
  *
  * Note, for performance reasons: only import this file if
- * `XmlBomb::Configuration` is needed, otherwise
+ * `Configuration` is needed, otherwise
  * `XmlBombCustomizations` should be imported instead.
  */
 
-import javascript
+import python
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.dataflow.new.TaintTracking
 import XmlBombCustomizations::XmlBomb
 
 /**
- * A taint-tracking configuration for reasoning about XML-bomb vulnerabilities.
+ * A taint-tracking configuration for detecting "XML bomb" vulnerabilities.
  */
 class Configuration extends TaintTracking::Configuration {
   Configuration() { this = "XmlBomb" }

python/ql/src/experimental/semmle/python/security/dataflow/XxeCustomizations.qll

@@ -1,12 +1,18 @@
 /**
- * Provides default sources, sinks and sanitizers for reasoning about
+ * Provides default sources, sinks and sanitizers for detecting
- * XML External Entity (XXE) vulnerabilities, as well as extension
+ * "XML External Entity (XXE)"
- * points for adding your own.
+ * vulnerabilities, as well as extension points for adding your own.
  */
 
-import javascript
+private import python
-import semmle.javascript.security.dataflow.DOM
+private import semmle.python.dataflow.new.DataFlow
+private import experimental.semmle.python.Concepts
+private import semmle.python.dataflow.new.RemoteFlowSources
 
+/**
+ * Provides default sources, sinks and sanitizers for detecting "XML External Entity (XXE)"
+ * vulnerabilities, as well as extension points for adding your own.
+ */
 module Xxe {
   /**
    * A data flow source for XXE vulnerabilities.
@@ -28,24 +34,16 @@ module Xxe {
     RemoteFlowSourceAsSource() { this instanceof RemoteFlowSource }
   }
 
-  /**
-   * An access to `document.location`, considered as a flow source for XXE vulnerabilities.
-   */
-  class LocationAsSource extends Source, DataFlow::ValueNode {
-    LocationAsSource() { isLocation(astNode) }
-  }
-
   /**
    * A call to an XML parser that performs external entity expansion, viewed
    * as a data flow sink for XXE vulnerabilities.
    */
-  class XmlParsingWithExternalEntityResolution extends Sink, DataFlow::ValueNode {
+  class XmlParsingWithExternalEntityResolution extends Sink {
     XmlParsingWithExternalEntityResolution() {
-      exists(XML::ParserInvocation parse | astNode = parse.getSourceArgument() |
+      exists(ExperimentalXML::XMLParsing parsing, ExperimentalXML::XMLVulnerabilityKind kind |
-        parse.resolvesEntities(XML::ExternalEntity(_))
+        kind.isXxe() and
-        or
+        parsing.vulnerableTo(kind) and
-        parse.resolvesEntities(XML::ParameterEntity(true)) and
+        this = parsing.getAnInput()
-        parse.resolvesEntities(XML::InternalEntity())
       )
     }
   }

python/ql/src/experimental/semmle/python/security/dataflow/XxeQuery.qll

@@ -1,17 +1,18 @@
 /**
- * Provides a taint tracking configuration for reasoning about XML
+ * Provides a taint-tracking configuration for detecting "XML External Entity (XXE)" vulnerabilities.
- * External Entity (XXE) vulnerabilities.
  *
  * Note, for performance reasons: only import this file if
- * `Xxe::Configuration` is needed, otherwise `XxeCustomizations`
+ * `Configuration` is needed, otherwise
- * should be imported instead.
+ * `XxeCustomizations` should be imported instead.
  */
 
-import javascript
+import python
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.dataflow.new.TaintTracking
 import XxeCustomizations::Xxe
 
 /**
- * A taint-tracking configuration for reasoning about XXE vulnerabilities.
+ * A taint-tracking configuration for detecting "XML External Entity (XXE)" vulnerabilities.
  */
 class Configuration extends TaintTracking::Configuration {
   Configuration() { this = "Xxe" }