Java: convert sinks to CSV

[tamasvajk]

Differences job
Differences job
Differences job

[aschackmull]

As an overall comment, we're getting a bunch of opaque sink identifiers, which really could use qldoc. The best way to add qldoc to these identifiers is probably to introduce the convention that all references to sinkNode(n, "some-sink-id") occur as charpreds of simple wrapper classes. E.g.:

class XssSink extends DataFlow::Node {
  XssSink() { sinkNode(this, "xss") }
}

This allows us a place to introduce a nice QL class name and suitable qldoc that explains what the sink is.

[aschackmull]

Suggested change

	private class URLOpenSink extends DataFlow::Node {
	private class UrlOpenSink extends DataFlow::Node {

[tamasvajk]

I don't mind changing this to UrlOpenSink, but a couple of lines above we already have HTTPStringToURLOpenMethodFlowConfig, so it would look a bit strange, wouldn't it?

[aschackmull]

Right, that ought to be renamed to HttpStringToUrlOpenMethodFlowConfig.