JavaScript CodeQL library updates: new Angular source and sink

[aegilops]

Pull Request checklist

All query authors

• A change note is added if necessary. See the documentation in this repository.
• All new queries have appropriate .qhelp. See the documentation in this repository.
• QL tests are added if necessary. See Testing custom queries in the GitHub documentation.
• New and changed queries have correct query metadata. See the documentation in this repository.

Internal query authors only

• Autofixes generated based on these changes are valid, only needed if this PR makes significant changes to .ql, .qll, or .qhelp files. See the documentation (internal access required).
• Changes are validated at scale (internal access required).
• Adding a new query? Consider also adding the query to autofix.

[aegilops]

I'm wondering which other properties being set on elements might need to be treated as XSS sinks, so that I don't fix up just innerHTML.

I'll see if I can copy what's done in the existing library.

I'm thinking that a.href and script.src and object.src might need to be XSS sinks, but I don't want to have to think too hard about this and would prefer to just copy existing conclusions!

[asgerf]

Suggested change

	setProperty.getParameter(1).asSink().asExpr().(StringLiteral).getValue() = "innerHTML"
	setProperty.getArgument(1).getStringValue() = "innerHTML"

[asgerf]

As discussed internally, I'd prefer to introduce a threat model kind for view component inputs like this, as they're not truly remote inputs.

[asgerf]

I'm wondering which other properties being set on elements might need to be treated as XSS sinks, so that I don't fix up just innerHTML.

You might be able to model this as an AttributeDefinition instead of directly as a sink. See D3.qll for a simple example.