Make queries use ActiveThreatModelSource, not RemoteFlowSource

This means that these query will respect the threat
model that is being used, rather than just using remote
flow sources every time. The default threat model is "remote".

Author: owen-mc

python/ql/lib/semmle/python/security/dataflow/NoSqlInjectionCustomizations.qll

@@ -6,7 +6,6 @@
 
 import python
 import semmle.python.dataflow.new.DataFlow
-import semmle.python.dataflow.new.RemoteFlowSources
 import semmle.python.Concepts
 
 /**
@@ -63,8 +62,14 @@ module NoSqlInjection {
     abstract DataFlow::Node getOutput();
   }
 
-  /** A remote flow source considered a source of user controlled strings. */
-  class RemoteFlowSourceAsStringSource extends RemoteFlowSource, StringSource { }
+  /**
+   * DEPRECATED: Use `ActiveThreatModelSource` from Concepts instead!
+   */
+  deprecated class RemoteFlowSourceAsStringSource = ActiveThreatModelSourceAsStringSource;
+
+  /** An active threat-model source considered a source of user controlled strings. */
+  private class ActiveThreatModelSourceAsStringSource extends StringSource instanceof ActiveThreatModelSource
+  { }
 
   /** A NoSQL query that is vulnerable to user controlled strings. */
   class NoSqlExecutionAsStringSink extends StringSink {

python/ql/lib/semmle/python/security/dataflow/XmlBombCustomizations.qll

@@ -7,7 +7,6 @@
 private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.Concepts
-private import semmle.python.dataflow.new.RemoteFlowSources
 
 /**
  * Provides default sources, sinks and sanitizers for detecting "XML bomb"
@@ -29,8 +28,14 @@ module XmlBomb {
    */
   abstract class Sanitizer extends DataFlow::Node { }
 
-  /** A source of remote user input, considered as a flow source for XML bomb vulnerabilities. */
-  class RemoteFlowSourceAsSource extends Source instanceof RemoteFlowSource { }
+  /**
+   * DEPRECATED: Use `ActiveThreatModelSource` from Concepts instead!
+   */
+  deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;
+
+  /** An active threat-model source, considered as a flow source. */
+  private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
+  }
 
   /**
    * A call to an XML parser that is vulnerable to XML bombs.

python/ql/lib/semmle/python/security/dataflow/XxeCustomizations.qll

@@ -7,7 +7,6 @@
 private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.Concepts
-private import semmle.python.dataflow.new.RemoteFlowSources
 
 /**
  * Provides default sources, sinks and sanitizers for detecting "XML External Entity (XXE)"
@@ -29,8 +28,14 @@ module Xxe {
    */
   abstract class Sanitizer extends DataFlow::Node { }
 
-  /** A source of remote user input, considered as a flow source for XXE vulnerabilities. */
-  class RemoteFlowSourceAsSource extends Source instanceof RemoteFlowSource { }
+  /**
+   * DEPRECATED: Use `ActiveThreatModelSource` from Concepts instead!
+   */
+  deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;
+
+  /** An active threat-model source, considered as a flow source. */
+  private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
+  }
 
   /**
    * A call to an XML parser that is vulnerable to XXE.

python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll

@@ -6,7 +6,7 @@
 private import python
 import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.TaintTracking
-private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.Concepts
 private import semmle.python.ApiGraphs
 private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
 private import semmle.python.dataflow.new.internal.TaintTrackingPrivate as TaintTrackingPrivate
@@ -168,7 +168,7 @@ class ExternalApiDataNode extends DataFlow::Node {
 }
 
 private module UntrustedDataToExternalApiConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+  predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }
 
@@ -177,7 +177,7 @@ private module UntrustedDataToExternalApiConfig implements DataFlow::ConfigSig {
   }
 }
 
-/** Global taint-tracking from `RemoteFlowSource`s to `ExternalApiDataNode`s. */
+/** Global taint-tracking from active threat-model sources to `ExternalApiDataNode`s. */
 module UntrustedDataToExternalApiFlow = TaintTracking::Global<UntrustedDataToExternalApiConfig>;
 
 /** A node representing untrusted data being passed to an external API. */

python/ql/src/experimental/Security/CWE-176/UnicodeBypassValidationQuery.qll

@@ -9,7 +9,6 @@ import semmle.python.Concepts
 import semmle.python.dataflow.new.internal.DataFlowPublic
 import semmle.python.dataflow.new.TaintTracking
 import semmle.python.dataflow.new.internal.TaintTrackingPrivate
-import semmle.python.dataflow.new.RemoteFlowSources
 import UnicodeBypassValidationCustomizations::UnicodeBypassValidation
 
 abstract private class ValidationState extends string {
@@ -37,7 +36,7 @@ private module UnicodeBypassValidationConfig implements DataFlow::StateConfigSig
   class FlowState = ValidationState;
 
   predicate isSource(DataFlow::Node source, FlowState state) {
-    source instanceof RemoteFlowSource and state instanceof PreValidation
+    source instanceof ActiveThreatModelSource and state instanceof PreValidation
   }
 
   predicate isAdditionalFlowStep(

python/ql/src/experimental/Security/CWE-346/CorsBypass.ql

@@ -10,6 +10,7 @@
 
 import python
 import semmle.python.ApiGraphs
+import semmle.python.Concepts
 import semmle.python.dataflow.new.TaintTracking
 import semmle.python.Flow
 import semmle.python.dataflow.new.RemoteFlowSources
@@ -62,7 +63,7 @@ class CherryPyRequest extends RemoteFlowSource::Range {
 }
 
 module CorsBypassConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node node) { node instanceof RemoteFlowSource }
+  predicate isSource(DataFlow::Node node) { node instanceof ActiveThreatModelSource }
 
   predicate isSink(DataFlow::Node node) {
     exists(StringStartswithCall s |

python/ql/src/experimental/Security/CWE-770/UnicodeDoS.ql

@@ -15,7 +15,6 @@ import semmle.python.ApiGraphs
 import semmle.python.Concepts
 import semmle.python.dataflow.new.TaintTracking
 import semmle.python.dataflow.new.internal.DataFlowPublic
-import semmle.python.dataflow.new.RemoteFlowSources
 
 // The Unicode compatibility normalization calls from unicodedata, unidecode, pyunormalize
 // and textnorm modules. The use of argIdx is to constraint the argument being normalized.
@@ -86,7 +85,7 @@ predicate underAValue(DataFlow::GuardNode g, ControlFlowNode node, boolean branc
 }
 
 private module UnicodeDoSConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+  predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
 
   predicate isBarrier(DataFlow::Node sanitizer) {
     // underAValue is a check to ensure that the length of the user-provided value is limited to a certain amount

python/ql/src/experimental/Security/UnsafeUnpackQuery.qll

@@ -8,7 +8,6 @@ import semmle.python.dataflow.new.internal.DataFlowPublic
 import semmle.python.ApiGraphs
 import semmle.python.dataflow.new.TaintTracking
 import semmle.python.frameworks.Stdlib
-import semmle.python.dataflow.new.RemoteFlowSources
 
 /**
  * Handle those three cases of Tarfile opens:
@@ -41,8 +40,8 @@ class AllTarfileOpens extends API::CallNode {
 
 module UnsafeUnpackConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) {
-    // A source coming from a remote location
-    source instanceof RemoteFlowSource
+    // A source enabled by the active threat model
+    source instanceof ActiveThreatModelSource
     or
     // A source coming from a CLI argparse module
     // see argparse: https://docs.python.org/3/library/argparse.html

python/ql/src/experimental/semmle/python/security/DecompressionBomb.qll

@@ -1,8 +1,8 @@
 import python
 import semmle.python.dataflow.new.TaintTracking
 import semmle.python.ApiGraphs
-import semmle.python.dataflow.new.RemoteFlowSources
 import semmle.python.dataflow.new.internal.DataFlowPublic
+import semmle.python.Concepts
 import FileAndFormRemoteFlowSource::FileAndFormRemoteFlowSource
 import codeql.util.Unit
 
@@ -426,7 +426,7 @@ predicate isAdditionalTaintStepTextIOWrapper(DataFlow::Node nodeFrom, DataFlow::
 
 module BombsConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) {
-    source instanceof RemoteFlowSource
+    source instanceof ActiveThreatModelSource
     or
     source instanceof FastApi
   }

python/ql/src/experimental/semmle/python/security/LdapInsecureAuth.qll

@@ -5,7 +5,7 @@
 import python
 import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
-import semmle.python.dataflow.new.RemoteFlowSources
+import semmle.python.Concepts
 import experimental.semmle.python.Concepts
 
 string getFullHostRegex() { result = "(?i)ldap://.+" }
@@ -90,7 +90,7 @@ class LdapStringVar extends BinaryExpr {
  */
 private module LdapInsecureAuthConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) {
-    source instanceof RemoteFlowSource or
+    source instanceof ActiveThreatModelSource or
     source.asExpr() instanceof LdapFullHost or
     source.asExpr() instanceof LdapBothStrings or
     source.asExpr() instanceof LdapBothVar or