I think could be a case where Models as Data comes in handy. A lot of the flow summaries here match on just the method name, which I worry could cause false positives. If we use type summaries we can construct a concept of what a Pathname instance is, and then target just those instances. For example:

  private class PathnameTypeSummary extends ModelInput::TypeModelCsv {
    override predicate row(string row) {
      // package1;type1;package2;type2;path
      row =
        [
          // Pathname.new : Pathname
          ";Pathname;;;Member[Pathname].Instance",
          // pathname.join(path) : Pathname
          ";Pathname;;Pathname;Method[join].ReturnValue"
        ]
    }
  }

  private class PathnameTaintSummary extends ModelInput::SummaryModelCsv {
    override predicate row(string row) {
      row =
        [
          // Pathname.new(path)
          ";;Member[Pathname].Method[new];Argument[0];ReturnValue;taint",
          // pathname.join
          ";Pathname;Method[join];Argument[self,any];ReturnValue;taint",
          // pathname.parent
          ";Pathname;Method[parent];Argument[self];ReturnValue;taint",
        ]
    }
  }
}

This will pass the following test:

def m_join
	a = Pathname.new(source 'a')
	b = Pathname.new('foo')
	c = Pathname.new(source 'c')
	sink a.join(b, c) # $ hasTaintFlow=a $ hasTaintFlow=c
end

def m_parent
	a = Pathname.new(source 'a')
	sink a.parent() # $ hasTaintFlow=a
	
	b = a.join("foo")
	sink b.parent() # $ hasTaintFlow=a
end

The last example, where we call parent on the result of join call, wouldn't work (I think) with just API Graphs.

@hmac thank you – you have no idea how useful your comment was! I had been quietly worried about the flow summaries matching only on the method name, but wasn't sure we had any way of dealing with that. And now, based on your example, I understand how to write MaD-based summaries.

I've replaced the flow summaries with MaD-based ones, beefed them up to cover a few more methods, and also bulked up the test.

It seems like PathnameInstance and PathnameTypeSummary are now trying to do pretty similar things. I wonder if it's possible to avoid that duplication.

It would be interesting to see if we get any DCA change with the new FileNameSource and FileSystemAccess instances. Ah I'm blind - I see you've already done one!