JavaScript CodeQL library updates: new Angular sink(s)

javascript/ql/lib/semmle/javascript/security/dataflow/DomBasedXssCustomizations.qll

@@ -251,6 +251,26 @@ module DomBasedXss {
     }
   }
 
+  /**
+   * A write to the `innerHTML` property of a DOM element, viewed as an XSS sink.
+   *
+   * Uses the Angular Renderer2 API, instead of the default `Element.innerHTML` property.
+   */
+  class AngularRender2SetPropertyInnerHtmlSink extends Sink {
+    AngularRender2SetPropertyInnerHtmlSink() {
+      exists(API::CallNode setProperty |
+        setProperty =
+          API::moduleImport("@angular/core")
+              .getMember("Renderer2")
+              .getInstance()
+              .getMember("setProperty")
+              .getACall() and
+        this = setProperty.getParameter(2).asSink() and
+        setProperty.getParameter(1).asSink().asExpr().(StringLiteral).getValue() = "innerHTML"
+      )
+    }
+  }
+
   /**
    * A value being piped into the `safe` pipe in a template file,
    * disabling subsequent HTML escaping.

javascript/ql/lib/semmle/javascript/security/dataflow/RemoteFlowSources.qll

@@ -184,3 +184,39 @@
 
   override string getSourceType() { result = ap.getSourceType() }
 }
+
+/**
+ *  Angular @Input() decorator on a member declaration.
+ */
+class InputMember extends MemberDeclaration {
+  InputMember() {
+    exists(Decorator decorator, Expr expr |
+      decorator.getElement() = this and
+      decorator.getExpression() = expr and
+      expr.(CallExpr).getCallee().(VarRef).getName() = "Input"
+    )
+  }
+}
+
+/**
+ * Use of an Angular @Input() member, modelled as `InputMember`.
+ */
+class InputMemberUse extends DataFlow::Node {
+  InputMemberUse() {
+    exists(InputMember member, string memberName, ThisExpr ta, FieldAccess fa |
+      memberName = member.getName() and
+      fa.getBase() = ta and
+      fa.getPropertyName() = memberName and
+      this.asExpr() = fa
+    )
+  }
+}
+
+/**
+ * A remote flow source that is a member of an Angular component class.
+ */
+private class AngularInputUse extends RemoteFlowSource {
+  AngularInputUse() { this instanceof InputMemberUse }
+
+  override string getSourceType() { result = "Angular @Input()" }
+}