Experimental CodeInjection query for JavaScript doesn't seem to work

I noticed that the sources and sinks for some of the code injection CVEs in JavaScript were spread out among different queries making it difficult or impossible to find the issues in some cases. I also saw that there is an experimental suite of Javascript Security queries that add additional sources.

I tested the experimental query for code injection located [here](https://github.com/github/codeql/blob/edb9b47111518c0e3791a5db9d47f42e1476a487/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-094/CodeInjection.ql) on some simple js code that contains a use of `JSON.stringify` as source and `eval` as sink. I know this should be covered because there is a private class for `JSON.stringify` in the AdditionalSources.qll that CodeInjection.ql imports.

```
/**
* A use of `JSON.stringify`, viewed as a source for command-line injections
* since it does not properly escape single quotes and dollar symbols.
*/
private class JsonStringifyAsCommandInjectionSource extends HeuristicSource,
CommandInjection::Source instanceof JsonStringifyCall
{
override string getSourceType() { result = "a string from JSON.stringify" }
}

```

When I run it on this code, I get 0 results:

```
import fs from 'fs';

function encodeStatements(statements) {

eval(JSON.stringify(statements))

}

module.exports = encodeStatements;

```

I tested with this query to ensure that the sink was recognized which it was.

```

import javascript
import semmle.javascript.security.dataflow.CodeInjectionQuery
import CodeInjectionFlow::PathGraph
import semmle.javascript.heuristics.AdditionalSources

from DataFlow::Node sink
where CodeInjectionConfig::isSink(sink)
select sink, "Sink found"
```

When I tried the same thing for sources I got received 0 results in the source code. However I ran this query which confirmed that `JSON.stringify` is part of the sources added as HeuristicSource, so I'm very confused as to why this doesn't work.

```
import javascript
import semmle.javascript.security.dataflow.CodeInjectionQuery
import CodeInjectionFlow::PathGraph
import semmle.javascript.heuristics.AdditionalSources

from DataFlow::Node source
where source instanceof HeuristicSource
select source, "User input"

```

Not sure where the error here lies but I could use some help diagnosing it. Thanks!

Start with the experimental Security/CWE-094/CodeInjection.ql query and the AdditionalSources.qll definitions, then run the supplied JavaScript example and the two diagnostic queries. Done means determining why JSON.stringify is not recognized as a source in the CodeInjection query and documenting or correcting that behavior so the example produces the expected result.

由索引模型根據 Issue 內容生成。