Python: MaD barriers

[yoff]

The example shows how to build a barrier guard from a MaD row. Clearly, this should be done in a convenience predicate.

[Copilot]

Pull request overview

This pull request adds Models-as-Data (MaD) support for barriers and barrier guards across Python, Ruby, and JavaScript, along with convenience predicates to simplify their usage.

Changes:

• Introduces barrierModel and barrierGuardModel extensible predicates in all three languages
• Adds convenience predicates sourceNode, sinkNode, and barrierNode to replace verbose patterns like getASourceNode(kind).asSource()
• Implements ExternalBarrierGuard and ParameterizedBarrierGuard modules for handling barriers defined via MaD
• Migrates several existing barriers to the new MaD framework (e.g., Django's url_has_allowed_host_and_scheme, Ruby's Regexp.escape/quote, JavaScript's encodeURIComponent/encodeURI)

Reviewed changes

Copilot reviewed 60 out of 60 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
python/ruby/javascript: ApiGraphModelsExtensions.qll	Adds extensible predicates for barrier and barrier guard models
python/ruby/javascript: ApiGraphModels.qll	Implements internal support for barrier models and adds convenience predicates (sourceNode, sinkNode, barrierNode)
python/ruby/javascript: empty.model.yml	Registers new extensible predicates in data extension system
python: DataFlowPublic.qll	Adds ParameterizedBarrierGuard and ExternalBarrierGuard modules
ruby: DataFlowPublic.qll	Adds ParameterizedBarrierGuard and ExternalBarrierGuard modules
ruby: SsaImpl.qll	Adds ParameterizedBarrierGuard module at SSA level
javascript: BarrierGuards.qll	Adds ExternalBarrierGuard module
python/ruby/javascript: Multiple customization files	Migrates from verbose .getASinkNode(kind).asSink() to concise sinkNode(node, kind) pattern
ruby: regexp/model.yml	Defines Regexp.escape/quote as barriers for regexp-injection
python: Django.model.yml	Defines url_has_allowed_host_and_scheme as barrier guard for url-redirection
javascript: NodeJSLib.model.yml	Defines encodeURIComponent/encodeURI as barriers for request-forgery
python: Django.qll	Removes hand-coded Django URL validation barrier in favor of MaD model
ruby: RegExpInjectionCustomizations.qll	Removes hand-coded Regexp.escape barrier in favor of MaD model
javascript: IncompleteHtmlAttributeSanitizationCustomizations.qll	Replaces EncodingSanitizer with MaD-based sanitizer
python: UrlRedirectCustomizations.qll	Adds SanitizerFromModel for MaD-defined barriers
Test expectation files	Updates MaD IDs due to new extensible predicates

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The barrier kind "request-forgery" appears to be incorrect for this context. This class is in the IncompleteHtmlAttributeSanitization module, where encodeURIComponent/encodeURI were being used as sanitizers for incomplete HTML attribute sanitization vulnerabilities. The barrier kind should likely be something related to HTML injection or incomplete HTML attribute sanitization, not "request-forgery".

Suggested change

	SanitizerFromModel() { ModelOutput::barrierNode(this, "request-forgery") }
	SanitizerFromModel() { ModelOutput::barrierNode(this, "incomplete-html-attribute-sanitization") }

[aschackmull]

This needs to use barrierNode instead.

Suggested change

	this = DataFlow::ExternalBarrierGuard::getAnExternalBarrierNode("url-redirection")
	ModelOutput::barrierNode(this, "url-redirection")

[aschackmull]

Generally looks good, but I would like to question whether getABarrierNode, getABarrierGuardNode, and ExternalBarrierGuard::getAnExternalBarrierNode all need to be public? Using any of those is likely to be a mistake (as the one I highlighted in the comment above) when all you really need is predicate barrierNode(DataFlow::Node node, string kind). If their public status is mainly an artifact of the current code organisation, then we should at least prefix their qldoc with a big fat INTERNAL: Do not use.

[hvitved]

Remember to run DCA for relevant languages.