JavaScript: Make configuration IDs explicit in the API.

Author: Max Schaefer

javascript/ql/src/Security/Summaries/Shared.qll

@@ -5,11 +5,11 @@
 import javascript
 
 /**
- * Holds if `config` matches `spec`, that is, either `spec` is the name of `config`
+ * Holds if `config` matches `spec`, that is, either `spec` is the ID of `config`
  * or `spec` is the empty string and `config` is an arbitrary configuration.
  */
 predicate configSpec(DataFlow::Configuration config, string spec) {
-  config.toString() = spec
+  config.getId() = spec
   or
   spec = ""
 }

javascript/ql/src/semmle/javascript/dataflow/Configuration.qll

@@ -86,6 +86,12 @@ abstract class Configuration extends string {
   bindingset[this]
   Configuration() { any() }
 
+  /**
+   * Gets the unique identifier of this configuration among all data flow tracking
+   * configurations.
+   */
+  string getId() { result = this }
+
   /**
    * Holds if `source` is a relevant data flow source for this configuration.
    */