JS: Migrate to new *Query.qll convention for files only to be imported by queries

javascript/change-notes/2021-08-16-query-suffix-convention2.md

@@ -0,0 +1,6 @@
+lgtm,codescanning
+* Some library files have been deprecated, which may affect custom queries.
+  Queries importing a data-flow configuration from `semmle.javascript.security.dataflow` should
+  ensure that the imported file ends with `Query`, and only import its top-level module.
+  For example, a query that imported `DomBasedXss::DomBasedXss` should from now on import `DomBasedXssQuery`
+  instead.

javascript/ql/examples/queries/dataflow/StoredXss/StoredXss.ql

@@ -8,8 +8,7 @@
  */
 
 import javascript
-import DataFlow
-import semmle.javascript.security.dataflow.StoredXss
+import semmle.javascript.security.dataflow.StoredXssQuery
 import DataFlow::PathGraph
 
 /**
@@ -21,17 +20,17 @@ import DataFlow::PathGraph
  * connection.query(..., (e, data) => { ... });
  * ```
  */
-class MysqlSource extends StoredXss::Source {
+class MysqlSource extends Source {
   MysqlSource() {
     this =
-      moduleImport("mysql")
+      DataFlow::moduleImport("mysql")
           .getAMemberCall("createConnection")
           .getAMethodCall("query")
           .getCallback(1)
           .getParameter(1)
   }
 }
 
-from StoredXss::Configuration cfg, PathNode source, PathNode sink
+from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "Stored XSS from $@.", source.getNode(), "database value."

javascript/ql/examples/queries/dataflow/StoredXss/StoredXssTypeTracking.ql

@@ -9,16 +9,15 @@
  */
 
 import javascript
-import DataFlow
-import semmle.javascript.security.dataflow.StoredXss
+import semmle.javascript.security.dataflow.StoredXssQuery
 import DataFlow::PathGraph
 
 /**
  * An instance of `mysql.createConnection()`, tracked globally.
  */
 DataFlow::SourceNode mysqlConnection(DataFlow::TypeTracker t) {
   t.start() and
-  result = moduleImport("mysql").getAMemberCall("createConnection")
+  result = DataFlow::moduleImport("mysql").getAMemberCall("createConnection")
   or
   exists(DataFlow::TypeTracker t2 | result = mysqlConnection(t2).track(t2, t))
 }
@@ -42,10 +41,10 @@ DataFlow::SourceNode mysqlConnection() { result = mysqlConnection(DataFlow::Type
  * }
  * ```
  */
-class MysqlSource extends StoredXss::Source {
+class MysqlSource extends Source {
   MysqlSource() { this = mysqlConnection().getAMethodCall("query").getCallback(1).getParameter(1) }
 }
 
-from StoredXss::Configuration cfg, PathNode source, PathNode sink
+from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)
 select sink.getNode(), source, sink, "Stored XSS from $@.", source.getNode(), "database value."

javascript/ql/src/Security/CWE-020/ExternalAPIsUsedWithUntrustedData.ql

@@ -9,7 +9,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.ExternalAPIUsedWithUntrustedData::ExternalAPIUsedWithUntrustedData
+import semmle.javascript.security.dataflow.ExternalAPIUsedWithUntrustedDataQuery
 
 from ExternalAPIUsedWithUntrustedData externalAPI
 select externalAPI, count(externalAPI.getUntrustedDataNode()) as numberOfUses,

javascript/ql/src/Security/CWE-020/UntrustedDataToExternalAPI.ql

@@ -10,7 +10,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.ExternalAPIUsedWithUntrustedData::ExternalAPIUsedWithUntrustedData
+import semmle.javascript.security.dataflow.ExternalAPIUsedWithUntrustedDataQuery
 import DataFlow::PathGraph
 
 from Configuration config, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-022/TaintedPath.ql

@@ -16,7 +16,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.TaintedPath::TaintedPath
+import semmle.javascript.security.dataflow.TaintedPathQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-022/ZipSlip.ql

@@ -13,7 +13,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.ZipSlip::ZipSlip
+import semmle.javascript.security.dataflow.ZipSlipQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-073/TemplateObjectInjection.ql

@@ -13,7 +13,7 @@
 
 import javascript
 import DataFlow::PathGraph
-import semmle.javascript.security.dataflow.TemplateObjectInjection::TemplateObjectInjection
+import semmle.javascript.security.dataflow.TemplateObjectInjectionQuery
 
 from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink
 where cfg.hasFlowPath(source, sink)

javascript/ql/src/Security/CWE-078/CommandInjection.ql

@@ -14,7 +14,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.CommandInjection::CommandInjection
+import semmle.javascript.security.dataflow.CommandInjectionQuery
 import DataFlow::PathGraph
 
 from

javascript/ql/src/Security/CWE-078/IndirectCommandInjection.ql

@@ -16,7 +16,7 @@
 
 import javascript
 import DataFlow::PathGraph
-import semmle.javascript.security.dataflow.IndirectCommandInjection::IndirectCommandInjection
+import semmle.javascript.security.dataflow.IndirectCommandInjectionQuery
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, DataFlow::Node highlight
 where

javascript/ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.ql

@@ -15,7 +15,7 @@
 
 import javascript
 import DataFlow::PathGraph
-import semmle.javascript.security.dataflow.ShellCommandInjectionFromEnvironment::ShellCommandInjectionFromEnvironment
+import semmle.javascript.security.dataflow.ShellCommandInjectionFromEnvironmentQuery
 
 from
   Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, DataFlow::Node highlight,

javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.ql

@@ -14,7 +14,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.UnsafeShellCommandConstruction::UnsafeShellCommandConstruction
+import semmle.javascript.security.dataflow.UnsafeShellCommandConstructionQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Sink sinkNode

javascript/ql/src/Security/CWE-079/ExceptionXss.ql

@@ -13,7 +13,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.ExceptionXss::ExceptionXss
+import semmle.javascript.security.dataflow.ExceptionXssQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-079/ReflectedXss.ql

@@ -13,7 +13,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.ReflectedXss::ReflectedXss
+import semmle.javascript.security.dataflow.ReflectedXssQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-079/StoredXss.ql

@@ -13,7 +13,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.StoredXss::StoredXss
+import semmle.javascript.security.dataflow.StoredXssQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-079/UnsafeHtmlConstruction.ql

@@ -14,7 +14,7 @@
 
 import javascript
 import DataFlow::PathGraph
-import semmle.javascript.security.dataflow.UnsafeHtmlConstruction::UnsafeHtmlConstruction
+import semmle.javascript.security.dataflow.UnsafeHtmlConstructionQuery
 
 from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, Sink sinkNode
 where cfg.hasFlowPath(source, sink) and sink.getNode() = sinkNode

javascript/ql/src/Security/CWE-079/UnsafeJQueryPlugin.ql

@@ -13,7 +13,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.UnsafeJQueryPlugin::UnsafeJQueryPlugin
+import semmle.javascript.security.dataflow.UnsafeJQueryPluginQuery
 import DataFlow::PathGraph
 
 from

javascript/ql/src/Security/CWE-079/Xss.ql

@@ -13,7 +13,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.DomBasedXss::DomBasedXss
+import semmle.javascript.security.dataflow.DomBasedXssQuery
 import DataFlow::PathGraph
 
 from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-079/XssThroughDom.ql

@@ -13,7 +13,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.XssThroughDom::XssThroughDom
+import semmle.javascript.security.dataflow.XssThroughDomQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-089/SqlInjection.ql

@@ -12,8 +12,8 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.SqlInjection
-import semmle.javascript.security.dataflow.NosqlInjection
+import semmle.javascript.security.dataflow.SqlInjectionQuery as SqlInjection
+import semmle.javascript.security.dataflow.NosqlInjectionQuery as NosqlInjection
 import DataFlow::PathGraph
 
 from DataFlow::Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-094/CodeInjection.ql

@@ -14,7 +14,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.CodeInjection::CodeInjection
+import semmle.javascript.security.dataflow.CodeInjectionQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-094/ImproperCodeSanitization.ql

@@ -13,7 +13,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.ImproperCodeSanitization::ImproperCodeSanitization
+import semmle.javascript.security.dataflow.ImproperCodeSanitizationQuery
 import DataFlow::PathGraph
 private import semmle.javascript.heuristics.HeuristicSinks
 private import semmle.javascript.security.dataflow.CodeInjectionCustomizations

javascript/ql/src/Security/CWE-094/UnsafeDynamicMethodAccess.ql

@@ -11,7 +11,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.UnsafeDynamicMethodAccess::UnsafeDynamicMethodAccess
+import semmle.javascript.security.dataflow.UnsafeDynamicMethodAccessQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-116/IncompleteHtmlAttributeSanitization.ql

@@ -16,7 +16,7 @@
 
 import javascript
 import DataFlow::PathGraph
-import semmle.javascript.security.dataflow.IncompleteHtmlAttributeSanitization::IncompleteHtmlAttributeSanitization
+import semmle.javascript.security.dataflow.IncompleteHtmlAttributeSanitizationQuery
 import semmle.javascript.security.IncompleteBlacklistSanitizer
 
 /**

javascript/ql/src/Security/CWE-117/LogInjection.ql

@@ -13,7 +13,7 @@
 
 import javascript
 import DataFlow::PathGraph
-import semmle.javascript.security.dataflow.LogInjection::LogInjection
+import semmle.javascript.security.dataflow.LogInjectionQuery
 
 from LogInjectionConfiguration config, DataFlow::PathNode source, DataFlow::PathNode sink
 where config.hasFlowPath(source, sink)

javascript/ql/src/Security/CWE-134/TaintedFormatString.ql

@@ -11,7 +11,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.TaintedFormatString::TaintedFormatString
+import semmle.javascript.security.dataflow.TaintedFormatStringQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-200/FileAccessToHttp.ql

@@ -11,7 +11,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.FileAccessToHttp::FileAccessToHttp
+import semmle.javascript.security.dataflow.FileAccessToHttpQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-201/PostMessageStar.ql

@@ -14,7 +14,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.PostMessageStar::PostMessageStar
+import semmle.javascript.security.dataflow.PostMessageStarQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-209/StackTraceExposure.ql

@@ -13,7 +13,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.StackTraceExposure::StackTraceExposure
+import semmle.javascript.security.dataflow.StackTraceExposureQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-312/BuildArtifactLeak.ql

@@ -14,7 +14,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.BuildArtifactLeak::BuildArtifactLeak
+import semmle.javascript.security.dataflow.BuildArtifactLeakQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-312/CleartextLogging.ql

@@ -14,7 +14,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.CleartextLogging::CleartextLogging
+import semmle.javascript.security.dataflow.CleartextLoggingQuery
 import DataFlow::PathGraph
 
 /**

javascript/ql/src/Security/CWE-312/CleartextStorage.ql

@@ -14,7 +14,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.CleartextStorage::CleartextStorage
+import semmle.javascript.security.dataflow.CleartextStorageQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-327/BrokenCryptoAlgorithm.ql

@@ -11,7 +11,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.BrokenCryptoAlgorithm::BrokenCryptoAlgorithm
+import semmle.javascript.security.dataflow.BrokenCryptoAlgorithmQuery
 import semmle.javascript.security.SensitiveActions
 import DataFlow::PathGraph
 

javascript/ql/src/Security/CWE-338/InsecureRandomness.ql

@@ -13,7 +13,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.InsecureRandomness::InsecureRandomness
+import semmle.javascript.security.dataflow.InsecureRandomnessQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-346/CorsMisconfigurationForCredentials.ql

@@ -12,7 +12,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.CorsMisconfigurationForCredentials::CorsMisconfigurationForCredentials
+import semmle.javascript.security.dataflow.CorsMisconfigurationForCredentialsQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-400/DeepObjectResourceExhaustion.ql

@@ -12,7 +12,7 @@
 
 import javascript
 import DataFlow::PathGraph
-import semmle.javascript.security.dataflow.DeepObjectResourceExhaustion::DeepObjectResourceExhaustion
+import semmle.javascript.security.dataflow.DeepObjectResourceExhaustionQuery
 
 from
   Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink, DataFlow::Node link,

javascript/ql/src/Security/CWE-400/RemotePropertyInjection.ql

@@ -13,7 +13,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.RemotePropertyInjection::RemotePropertyInjection
+import semmle.javascript.security.dataflow.RemotePropertyInjectionQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-502/UnsafeDeserialization.ql

@@ -12,7 +12,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.UnsafeDeserialization::UnsafeDeserialization
+import semmle.javascript.security.dataflow.UnsafeDeserializationQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink

javascript/ql/src/Security/CWE-506/HardcodedDataInterpretedAsCode.ql

@@ -13,7 +13,7 @@
  */
 
 import javascript
-import semmle.javascript.security.dataflow.HardcodedDataInterpretedAsCode::HardcodedDataInterpretedAsCode
+import semmle.javascript.security.dataflow.HardcodedDataInterpretedAsCodeQuery
 import DataFlow::PathGraph
 
 from Configuration cfg, DataFlow::PathNode source, DataFlow::PathNode sink