JS: Model newer yargs command-line parsing pattern

Author: RasmusWL

javascript/ql/lib/semmle/javascript/frameworks/CommandLineArguments.qll

@@ -74,6 +74,8 @@ private class DefaultModels extends CommandLineArguments::Range {
     or
     // `require('commander').opt()` => `{a: ..., b: ...}`
     this = commander().getMember("opts").getACall()
+    or
+    this = API::moduleImport("yargs/yargs").getReturn().getMember("argv").asSource()
   }
 }
 

javascript/ql/test/library-tests/threat-models/sources/sources.js

@@ -13,7 +13,7 @@ const yargs = require('yargs/yargs');
 const { hideBin } = require('yargs/helpers');
 const argv = yargs(hideBin(process.argv)).argv; // $ threat-source=commandargs
 
-SINK(argv.foo); // $ MISSING: hasFlow
+SINK(argv.foo); // $ hasFlow
 
 // older version
 // https://www.npmjs.com/package/yargs/v/7.1.2