JS: add a getMaybePromisified predicate to API-graphs, and use it to model child_process

[erik-krogh]

Recognizes the sink for CVE-2021-29300.

Recognizing the new sink just required using API-graphs.
But recognizing existing sinks using API-graphs required a promisified label in API-graphs.

So I generalized the promisified part of API-graphs a bit.

No change in alerts.
And a performance evaluation on the security suite looks fine.

[asgerf]

After grokking through this change to API graphs, I'm a little hesitant to go along with it.

The main issue is that the monomorphic API use assumption will now kick in whenever a function is promisified. So if the promisify call is wrapped in a little helper function, all promisified functions flowing there will get mixed up.

But I also think the change may have been overkill to begin with, and we need to be clear about what problem it's meant to fix.

The way I see it, the getParameter() predicate already looks through promisification transparently, without the model needing to know about it at all. But getACall() does not do this, and that's the real problem. Models that do getParameter(i) will magically just work, but if you do getACall().getParameter(i) then it won't handle promisification.

We could make getACall include promisified calls automatically, but perhaps that's a bit risky. How about adding getAPromisifiedCall? (and a "maybe" version of it for convenience). It seems like that should have been enough, and it can be added without changing the underlying API graph or its type tracking predicates.

For the library model, there isn't much difference between getPromisified().getACall() and getAPromisifiedCall(). And there is never a reason to follow getPromisified() with anything other than getACall() because it already works for getParameter().

[erik-krogh]

How about adding getAPromisifiedCall? (and a "maybe" version of it for convenience). It seems like that should have been enough, and it can be added without changing the underlying API graph or its type tracking predicates.

That sounds like a good idea. I've just added a getMaybePromisifiedCall.

A new evaluation looks clean.