JS: Don't create new flow labels in *Customizations.qll files

Author: asgerf

javascript/ql/src/semmle/javascript/security/dataflow/ClientSideUrlRedirect.qll

@@ -14,6 +14,11 @@ import UrlConcatenation
 module ClientSideUrlRedirect {
   import ClientSideUrlRedirectCustomizations::ClientSideUrlRedirect
 
+  // Materialize flow labels
+  private class ConcreteDocumentUrl extends DocumentUrl {
+    ConcreteDocumentUrl() { this = this }
+  }
+
   /**
    * A taint-tracking configuration for reasoning about unvalidated URL redirections.
    */

javascript/ql/src/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll

@@ -29,7 +29,7 @@ module ClientSideUrlRedirect {
    * A flow label for values that represent the URL of the current document, and
    * hence are only partially user-controlled.
    */
-  class DocumentUrl extends DataFlow::FlowLabel {
+  abstract class DocumentUrl extends DataFlow::FlowLabel {
     DocumentUrl() { this = "document.url" }
   }
 

javascript/ql/src/semmle/javascript/security/dataflow/InsecureDownload.qll

@@ -14,6 +14,14 @@ import javascript
 module InsecureDownload {
   import InsecureDownloadCustomizations::InsecureDownload
 
+  // Materialize flow labels
+  private class ConcreteSensitiveInsecureURL extends Label::SensitiveInsecureURL {
+    ConcreteSensitiveInsecureURL() { this = this }
+  }
+  private class ConcreteInsecureURL extends Label::InsecureURL {
+    ConcreteInsecureURL() { this = this }
+  }
+
   /**
    * A taint tracking configuration for download of sensitive file through insecure connection.
    */

javascript/ql/src/semmle/javascript/security/dataflow/PostMessageStar.qll

@@ -12,6 +12,11 @@ import javascript
 module PostMessageStar {
   import PostMessageStarCustomizations::PostMessageStar
 
+  // Materialize flow labels
+  private class ConcretePartiallyTaintedObject extends PartiallyTaintedObject {
+    ConcretePartiallyTaintedObject() { this = this }
+  }
+
   /**
    * A taint tracking configuration for cross-window communication with unrestricted origin.
    *

javascript/ql/src/semmle/javascript/security/dataflow/PostMessageStarCustomizations.qll

@@ -26,7 +26,7 @@ module PostMessageStar {
   /**
    * A flow label representing an object with at least one tainted property.
    */
-  class PartiallyTaintedObject extends DataFlow::FlowLabel {
+  abstract class PartiallyTaintedObject extends DataFlow::FlowLabel {
     PartiallyTaintedObject() { this = "partially tainted object" }
   }
 

javascript/ql/src/semmle/javascript/security/dataflow/PrototypePollution.qll

@@ -15,6 +15,11 @@ import semmle.javascript.dependencies.SemVer
 module PrototypePollution {
   import PrototypePollutionCustomizations::PrototypePollution
 
+  // Materialize flow labels
+  private class ConcreteTaintedObjectWrapper extends TaintedObjectWrapper {
+    ConcreteTaintedObjectWrapper() { this = this }
+  }
+
   /**
    * A taint tracking configuration for user-controlled objects flowing into deep `extend` calls,
    * leading to prototype pollution.

javascript/ql/src/semmle/javascript/security/dataflow/PrototypePollutionCustomizations.qll

@@ -24,11 +24,13 @@ module PrototypePollution {
    * }
    * ```
    */
-  module TaintedObjectWrapper {
-    private class TaintedObjectWrapper extends DataFlow::FlowLabel {
-      TaintedObjectWrapper() { this = "tainted-object-wrapper" }
-    }
+  abstract class TaintedObjectWrapper extends DataFlow::FlowLabel {
+    TaintedObjectWrapper() { this = "tainted-object-wrapper" }
+  }
 
+  /** Companion module to the `TaintedObjectWrapper` class. */
+  module TaintedObjectWrapper {
+    /** Gets the instance of the `TaintedObjectWrapper` label. */
     TaintedObjectWrapper label() { any() }
   }
 

javascript/ql/src/semmle/javascript/security/dataflow/TaintedPath.qll

@@ -12,6 +12,14 @@ import javascript
 module TaintedPath {
   import TaintedPathCustomizations::TaintedPath
 
+  // Materialize flow labels
+  private class ConcretePosixPath extends Label::PosixPath {
+    ConcretePosixPath() { this = this }
+  }
+  private class ConcreteSplitPath extends Label::SplitPath {
+    ConcreteSplitPath() { this = this }
+  }
+
   /**
    * A taint-tracking configuration for reasoning about tainted-path vulnerabilities.
    */

javascript/ql/src/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll

@@ -55,7 +55,7 @@ module TaintedPath {
      * There are currently four flow labels, representing the different combinations of
      * normalization and absoluteness.
      */
-    class PosixPath extends DataFlow::FlowLabel {
+    abstract class PosixPath extends DataFlow::FlowLabel {
       Normalization normalization;
       Relativeness relativeness;
 
@@ -113,7 +113,7 @@ module TaintedPath {
     /**
      * A flow label representing an array of path elements that may include "..".
      */
-    class SplitPath extends DataFlow::FlowLabel {
+    abstract class SplitPath extends DataFlow::FlowLabel {
       SplitPath() { this = "splitPath" }
     }
   }

javascript/ql/src/semmle/javascript/security/dataflow/UnsafeDynamicMethodAccess.qll

@@ -14,6 +14,11 @@ module UnsafeDynamicMethodAccess {
   private import DataFlow::FlowLabel
   import UnsafeDynamicMethodAccessCustomizations::UnsafeDynamicMethodAccess
 
+  // Materialize flow labels
+  private class ConcreteUnsafeFunction extends UnsafeFunction {
+    ConcreteUnsafeFunction() { this = this }
+  }
+
   /**
    * A taint-tracking configuration for reasoning about unsafe dynamic method access.
    */