Swift: Add CSV extension points.

Author: geoffw0

swift/ql/lib/codeql/swift/security/SqlInjectionExtensions.qll

@@ -6,6 +6,7 @@
 
 import swift
 import codeql.swift.dataflow.DataFlow
+private import codeql.swift.dataflow.ExternalFlow
 
 /**
  * A dataflow sink for SQL injection vulnerabilities.
@@ -141,3 +142,10 @@ class GrdbDefaultSqlInjectionSink extends SqlInjectionSink {
     )
   }
 }
+
+/**
+ * A sink defined in a CSV model.
+ */
+private class DefaultSqlInjectionSink extends SqlInjectionSink {
+  DefaultSqlInjectionSink() { sinkNode(this, "sql") }
+}

swift/ql/lib/codeql/swift/security/UnsafeJsEvalExtensions.qll

@@ -6,6 +6,7 @@
 import swift
 import codeql.swift.dataflow.DataFlow
 import codeql.swift.dataflow.FlowSources
+private import codeql.swift.dataflow.ExternalFlow
 
 /**
  * A dataflow sink for javascript evaluation vulnerabilities.
@@ -141,3 +142,10 @@ class DefaultUnsafeJsEvalAdditionalTaintStep extends UnsafeJsEvalAdditionalTaint
     )
   }
 }
+
+/**
+ * A sink defined in a CSV model.
+ */
+private class DefaultUnsafeJsEvalSink extends UnsafeJsEvalSink {
+  DefaultUnsafeJsEvalSink() { sinkNode(this, "js-eval") }
+}

swift/ql/lib/codeql/swift/security/UnsafeWebViewFetchExtensions.qll

@@ -5,6 +5,7 @@
 
 import swift
 import codeql.swift.dataflow.DataFlow
+private import codeql.swift.dataflow.ExternalFlow
 
 /**
  * A dataflow sink for unsafe webview fetch vulnerabilities.
@@ -33,10 +34,10 @@ class UnsafeWebViewFetchAdditionalTaintStep extends Unit {
  * A default uncontrolled format string sink, such as certain arguments
  * to `UIWebView.loadHTMLString`.
  */
-class DefaultUnsafeWebViewFetchSink extends UnsafeWebViewFetchSink {
+class UIKitWebKitWebViewFetchSink extends UnsafeWebViewFetchSink {
   Expr baseUrl;
 
-  DefaultUnsafeWebViewFetchSink() {
+  UIKitWebKitWebViewFetchSink() {
     exists(
       MethodDecl funcDecl, CallExpr call, string className, string funcName, int arg, int baseArg
     |
@@ -71,3 +72,13 @@ class DefaultUnsafeWebViewFetchSink extends UnsafeWebViewFetchSink {
 
   override Expr getBaseUrl() { result = baseUrl }
 }
+
+/**
+ * A sink defined in a CSV model.
+ *
+ * Note that sinks defined in this way never have a recognized `baseURL`
+ * argument, which may limit the accuracy of results.
+ */
+private class DefaultUnsafeWebViewFetchSink extends UnsafeWebViewFetchSink {
+  DefaultUnsafeWebViewFetchSink() { sinkNode(this, "webview-fetch") }
+}