Merge pull request #9754 from erik-krogh/chownr

JS: add model for chownr

Author: erik-krogh

javascript/externs/nodejs/fs.js

@@ -1696,4 +1696,3 @@ module.exports.R_OK = fs.R_OK;
 module.exports.W_OK = fs.W_OK;
 
 module.exports.X_OK = fs.X_OK;
-

javascript/ql/lib/change-notes/2022-06-30-chownr.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `chownr` library is now modeled as a sink for the `js/path-injection` query.

javascript/ql/lib/semmle/javascript/frameworks/Files.qll

@@ -192,6 +192,18 @@ private class WriteFileAtomic extends FileSystemWriteAccess, DataFlow::CallNode
   override DataFlow::Node getADataNode() { result = this.getArgument(1) }
 }
 
+/**
+ * A call to the library `chownr`.
+ * The library changes the owner of a file or directory recursively.
+ */
+private class Chownr extends FileSystemWriteAccess, DataFlow::CallNode {
+  Chownr() { this = DataFlow::moduleImport("chownr").getACall() }
+
+  override DataFlow::Node getAPathArgument() { result = this.getArgument(0) }
+
+  override DataFlow::Node getADataNode() { none() }
+}
+
 /**
  * A call to the library `recursive-readdir`.
  */