[Python]: Improve existing Xpath Injection query

Query

Relevant PR: github/codeql#6331

Report

This PR improves my earlier Xpath injection query to use APIGraphs.

My earlier ticket #92 was closed sans bounty as the query couldn't get atleast one result then. With the new improvements to the Python tooling and the upgrades to the PR I make now, the earlier undetected vulnerability in andresriancho/django-moth is now detected.

Result(s)

I can confirm that this change leads to atleast one additional detection in andresriancho/django-moth.

[antonio-morales]

Hi @porcupineyhairs,

to be considered, your submission should include details of a vulnerability found in an open-source project that is actually used (no demo, training, vulnerable on purpose).

It looks like django-moth is an application vulnerable on purpose: "Django vulnerable Web application for testing the w3af framework", so I can not consider your submission as valid.

Would you be able to provide another example for this query to meet the submission criteria?

Regards,
Antonio.

@antonio-morales I can't find any CVE's for this one. So I think this issue can now be closed. As for the PR, it hasn't received any review yet. Do you want me to keep it open for a merge sans bounty?

[RasmusWL]

@porcupineyhairs I'll take a look at the PR now that the bounty status has been resolved.

[ghsecuritylab]

Your submission is now in status Closed.

For information, the evaluation workflow is the following:
SecLab review > Generate Query Results > FP Check > CodeQL review > SecLab finalize > Pay > Closed