Python: Use Query.qll suffix for dataflow configuration definitions

[RasmusWL]

Adopting the standard setup of defining the data flow configurations for our path-problem queries in a file called ...Query.qll, so it's very obvious that this file should only be used by the query. (there is a CI check for this on our own codebase).

Like JS did in #6450

When adopting this, I wanted us to do the same as other languages in terms of setup. For simple queries that only require a single data-flow configuration, all langauges define that in the ...Query.qll file. JS/Ruby always use the name Configuration for this configuration, which is also the most straightforward thing for us to do.

• JS .ql file, Query.qll file
• Ruby .ql file, Query.qll file
• C# .ql file, Query.qll file
• Java
  • for the command injection query that I checked for other languages, they use a setup with a private configuration, and a predicate that exposes the results:
    .ql file, Query.qll file
  • but for something like XSLT injection, they do like the rest, exposing the configuration from the Query.qll file, and using that directly in the .ql file, Query.qll file

However, it's not quite as obvious how we should handle cases where we need multiple configurations, currently ServerSideRequestForgeryQuery.qll, WeakSensitiveDataHashingQuery.qll, and LdapInjectionQuery.qll. I noted that LdapInjectionQuery.qll actually used a very different pattern than the two others. Instead of defining separate modules for each configuration, they just had different names within the same module 🤔

Honestly, the approach in LdapInjectionQuery.qll seems simpler and requires less boiler-plate code, so I will suggest adopting that approach for ServerSideRequestForgeryQuery.qll. For WeakSensitiveDataHashingQuery.qll I really do think that having the two separate ql-modules makes sense, since they both use different sinks/sources, and could have different sanitizers (exposing them as top-level configurations means that we have to rewrite source instanceof Source to source instanceof WeakSensitiveDataHashingCustomizations::NormalHashFunction::Source 😠)

According to git grep "extends TaintTracking::Configuration" **/*Query.qll | cut -d ':' -f 1 | uniq -c | grep -v "1 " the only file that has more than one extends TaintTracking::Configuration is csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll -- all 3 used directly in the query. So not too much inspiration to match against.

[yoff]

LGTM
It took me a few iterations and jumping between the single-commit-view and the all-commits-view, but I think the commit structure actually made it quite easy to understand the transformation (I just had to check that nothing was missed) 👍

[RasmusWL]

It took me a few iterations and jumping between the single-commit-view and the all-commits-view, but I think the commit structure actually made it quite easy to understand the transformation (I just had to check that nothing was missed)

After doing this I wasn't quite sure if I had made the right choice, so that makes me happy ☺️