add JSON.stringify as a code-injection sanitizer

Author: erik-krogh

javascript/ql/lib/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll

@@ -375,4 +375,9 @@ module CodeInjection {
       this = LodashUnderscore::member("template").getACall().getArgument(0)
     }
   }
+
+  /**
+   * A call to JSON.stringify() seen as a sanitizer.
+   */
+  class JSONStringifySanitizer extends Sanitizer, JsonStringifyCall { }
 }

javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/express.js

@@ -25,4 +25,6 @@ const cp = require('child_process');
 app.get('/other/path', function(req, res) {
   const taint = req.param("wobble");
   cp.execFileSync('node', ['-e', taint]); // NOT OK
+
+  cp.execFileSync('node', ['-e', `console.log(${JSON.stringify(taint)})`]); // OK
 });