PS: Add dot sourcing as a sink.

Author: MathiasVP

powershell/ql/lib/semmle/code/powershell/ast/internal/Command.qll

@@ -83,7 +83,7 @@ class CallOperator extends CmdCall {
 class DotSourcingOperator extends CmdCall {
   DotSourcingOperator() { getRawAst(this) instanceof Raw::DotSourcingOperator }
 
-  Expr getPath() { result = this.getCallee() }
+  Expr getCommand() { result = this.getCallee() }
 }
 
 class JoinPath extends CmdCall {

powershell/ql/lib/semmle/code/powershell/controlflow/CfgNodes.qll

@@ -608,6 +608,21 @@ module ExprNodes {
     ExprCfgNode getCommand() { result = this.getCallee() }
   }
 
+  private class DotSourcingOperatorChildMapping extends CallExprChildMapping instanceof DotSourcingOperator
+  {
+    override predicate relevantChild(Ast child) { super.relevantChild(child) }
+  }
+
+  class DotSourcingOperatorCfgNode extends CallExprCfgNode {
+    override string getAPrimaryQlClass() { result = "DotSourcingOperatorCfgNode" }
+
+    override DotSourcingOperatorChildMapping e;
+
+    override DotSourcingOperator getExpr() { result = e }
+
+    ExprCfgNode getCommand() { result = this.getCallee() }
+  }
+
   private class ToStringCallChildmapping extends CallExprChildMapping instanceof ToStringCall {
     override predicate relevantChild(Ast child) { super.relevantChild(child) }
   }

powershell/ql/lib/semmle/code/powershell/dataflow/internal/DataFlowPublic.qll

@@ -544,7 +544,14 @@ class CallNode extends ExprNode {
 class CallOperatorNode extends CallNode {
   override CfgNodes::ExprNodes::CallOperatorCfgNode call;
 
-  Node getCommand() { result.asExpr() = call.getCommand() } // TODO: Alternatively, we could remap calls to & as command expressions.
+  Node getCommand() { result.asExpr() = call.getCommand() }
+}
+
+/** A call to operator `.`, viewed as a node in a data flow graph. */
+class DotSourcingOperatorNode extends CallNode {
+  override CfgNodes::ExprNodes::DotSourcingOperatorCfgNode call;
+
+  Node getCommand() { result.asExpr() = call.getCommand() }
 }
 
 /**

powershell/ql/lib/semmle/code/powershell/security/CommandInjectionCustomizations.qll

@@ -46,8 +46,10 @@ module CommandInjection {
         call.getAnArgument() = this
       )
       or
-      // Or the call command itself in case it's a use of operator &.
+      // Or the call command itself in case it's a use of "operator &" or "operator .".
       any(DataFlow::CallOperatorNode call).getCommand() = this
+      or
+      any(DataFlow::DotSourcingOperatorNode call).getCommand() = this
     }
 
     override string getSinkType() { result = "call to Invoke-Expression" }