JEXL sinks for detecting JEXL injections with CodeQL

JexlEvaluationSink.ql

private class JexlEvaluationSink extends DataFlow::ExprNode {
  JexlEvaluationSink() {
    exists(MethodAccess ma, Method m, Expr taintFrom |
      ma.getMethod() = m and taintFrom = this.asExpr()
    |
      m instanceof DirectJexlEvaluationMethod and ma.getQualifier() = taintFrom
      or
      m instanceof CreateJexlCallableMethod and ma.getQualifier() = taintFrom
      or
      m instanceof JexlEngineGetSetPropertyMethod and
      taintFrom.getType() instanceof TypeString and
      ma.getAnArgument() = taintFrom
    )
  }
}