Cover multi-service log injection

[jeongsoolee09]

What this PR contributes

Add five additional log injection cases

log-injection-without-protocol-none

True positive case with two problematic flows.

• Action send1 of Service1 containing a string can be triggered from outside by OData
• Action send2 of Service2 containing a string can be triggered from outside by OData
• Upon receiving action send1, Service1 sends send2 of Service2 with the data it received with send1
• Upon receiving action send2, Service2 logs the data to the standard output

log-injection-with-service1-protocol-none

True positive case with one problematic flow.

• Action send1 of Service1 containing a string can be triggered from outside by OData
• Action send2 of Service2 containing a string cannot be triggered from outside by OData
• Upon receiving action send1, Service1 sends send2 of Service2 with the data it received with send1
• Upon receiving action send2, Service2 logs the data to the standard output

log-injection-with-service2-protocol-none

True positive case with one problematic flow.

• Action send1 of Service1 containing a string cannot be triggered from outside by OData
• Action send2 of Service2 containing a string can be triggered from outside by OData
• Upon receiving action send1, Service1 sends send2 of Service2 with the data it received with send1
• Upon receiving action send2, Service2 logs the data to the standard output

log-injection-with-complete-protocol-none

False positive case with no problematic flows.

• Action send1 of Service1 containing a string cannot be triggered from outside by OData
• Action send2 of Service2 containing a string cannot be triggered from outside by OData
• Upon receiving action send1, Service1 sends send2 of Service2 with the data it received with send1
• Upon receiving action send2, Service2 logs the data to the standard output

log-injection-not-depending-on-request

False positive case with no problematic flows.

• Action send1 of Service1 containing a string can be triggered from outside by OData, but the data is not consumed
• Action send2 of Service2 containing a string cannot be triggered from outside by OData
• Upon receiving action send1, Service1 freshly creates a Datetime object and sends send2 of Service2 with it
• Upon receiving action send2, Service2 logs the data to the standard output

Add more vocabularies

• Augment CDS.qll with more classes
• Add CDL.qll to reason about .cds files compiled to .json
• Add Application.qll to reason about the application as a whole, e.g. the root directory of the application.
• Add PackageJson.qll to reason about CAP-specific manifests in the "cds" section of the package.json file.

Move definitions to dataflow directory

This is to more closely resemble the structure of the standard library's.

• dataflow/DataFlow.qll, whose import path is advanced_security.javascript.frameworks.cap.dataflow.DataFlow, contains all security-related DataFlow::Nodes or relations between them.
• dataflow/FlowSteps.qll, whose import path is advanced_security.javascript.frameworks.cap.dataflow.FlowSteps, contains additional flow steps to be registered to DataFlow::SharedFlowStep.
  • A major contribution in this aspect is the modeling of a flow step between two services either via REST-style or CRUD-style API, or emitting and subscribing of events.

Move log injection customizations to CAPLogInjectionQuery.qll

This is to more closely resemble the structure of the standard library's.

[mbaluda]

LGTM!