JS: add RemoteServerResponse as a heuristic remote flow source

Author: Esben Sparre Andreasen

javascript/ql/src/semmle/javascript/heuristics/AdditionalSources.qll

@@ -31,4 +31,25 @@ private class JSONStringifyAsCommandInjectionSource extends HeuristicSource,
   JSONStringifyAsCommandInjectionSource() {
     this = DataFlow::globalVarRef("JSON").getAMemberCall("stringify")
   }
+
+  override string getSourceType() { result = "a string from JSON.stringify" }
+}
+
+/**
+ * A response from a remote server.
+ */
+class RemoteServerResponse extends HeuristicSource, RemoteFlowSource {
+  RemoteServerResponse() {
+    exists(ClientRequest r |
+      this = r.getAResponseDataNode() and
+      not exists(string url, string protocolPattern |
+        // exclude URLs to the current host
+        r.getUrl().mayHaveStringValue(url) and
+        protocolPattern = "(?[a-z+]{3,10}:)" and
+        not url.regexpMatch(protocolPattern + "?//.*")
+      )
+    )
+  }
+
+  override string getSourceType() { result = "a response from a remote server" }
 }