Allow MaD sanitizers for java/error-message-exposure and java/stack-trace-exposure

Author: owen-mc

java/ql/lib/semmle/code/java/security/InformationLeak.qll

@@ -17,3 +17,10 @@ private class DefaultInformationLeakSink extends InformationLeakSink {
     this instanceof XssSink
   }
 }
+
+/** A sanitizer for information leak. */
+abstract class InformationLeakSanitizer extends DataFlow::Node { }
+
+private class ExternalInformationLeakSanitizer extends InformationLeakSanitizer {
+  ExternalInformationLeakSanitizer() { barrierNode(this, "information-leak") }
+}

java/ql/lib/semmle/code/java/security/SensitiveDataExposureThroughErrorMessageQuery.qll

@@ -21,6 +21,8 @@ private module GetMessageFlowSourceToHttpResponseSinkFlowConfig implements DataF
   predicate isSource(DataFlow::Node src) { src instanceof GetMessageFlowSource }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof InformationLeakSink }
+
+  predicate isBarrier(DataFlow::Node node) { node instanceof InformationLeakSanitizer }
 }
 
 private module GetMessageFlowSourceToHttpResponseSinkFlow =

java/ql/lib/semmle/code/java/security/StackTraceExposureQuery.qll

@@ -70,6 +70,8 @@ private module StackTraceStringToHttpResponseSinkFlowConfig implements DataFlow:
   predicate isSource(DataFlow::Node src) { stackTraceExpr(_, src.asExpr()) }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof InformationLeakSink }
+
+  predicate isBarrier(DataFlow::Node node) { node instanceof InformationLeakSanitizer }
 }
 
 private module StackTraceStringToHttpResponseSinkFlow =