unified: Mostly restore path-injection results

Switched to TaintTracking and adds some very ad-hoc steps to recover
most of the results.

Some more tests pass and others fail; these are now consistent with what
we actually model.

Author: asgerf

unified/ql/lib/codeql/unified/internal/dataflow/DataFlowPluginSwift.qll

@@ -25,5 +25,21 @@ private class SwiftDataFlowPlugin extends DataFlowPlugin {
       step.value() and
       node2.isResultValue(call)
     )
+    or
+    // Taint flow through unary "!" (TODO: model as a read of Optional.some, possibly with implicit taint read)
+    exists(UnaryExpr expr |
+      expr.getOperator().(PostfixOperator).getValue() = "!" and
+      node1.isResultValue(expr.getOperand()) and
+      step.taint() and
+      node2.isResultValue(expr)
+    )
+    or
+    // Taint flow through URL(string: x). TODO: Model with MaD and flow summaries
+    exists(CallExpr call |
+      call.getCallee().(Identifier).getValue() = ["URL", "NSURL"] and
+      node1.isResultValue(call.getNamedArgument("string")) and
+      step.taint() and
+      node2.isResultValue(call)
+    )
   }
 }

unified/ql/src/queries/security/CWE-022/PathInjection.ql

@@ -54,7 +54,7 @@ module PathInjectionConfig implements DataFlow::ConfigSig {
   }
 }
 
-module PathInjectionFlow = DataFlow::Global<PathInjectionConfig>;
+module PathInjectionFlow = TaintTracking::Global<PathInjectionConfig>;
 
 import PathInjectionFlow::PathGraph