I suggest not quantifying over the local source node, since it will just be rfs. Instead I suggest adding a shorthand for this.getFunction().(Attribute). And then to use DataFlow::AttrRead instead of Attribute as it operates on a higher level. Finally, I would comment the long chain of casts.

A similar rewrite could be made to the one for Flask.

I would rename this to ClientSuppliedIp (and similarly drop the suffix on all the implementations) since that is what we know about these nodes. It also reads better in the configuration: "A client supplied IP (source) flows to a security check (sink)".

I would rename this class to PossibleSecurityCheck or SecurityCheck.

I would rename this class to SqlOperationAsSecurityCheck

Should the sanitizer (node) not be the result of the subscripting rather than object? Consider the code

  client_ip = request.headers.get('x-forwarded-for')
  dummy = client_ip.split(",")[2]
  if not client_ip == '127.0.0.1':
         raise Exception('ip illegal')

This would be deemed sanitized as the flow is blocked in the line assigning dummy. Yet, no change was made to client_ip prior to testing it. (If the sanitizer is the subscript, the flow is blocked into dummy, but there is still use-use-flow to the variable on the next line.)

Is there such a way of writing in real open source projects?

FYI: https://github.com/github/codeql/blob/main/java/ql/src/experimental/Security/CWE/CWE-348/ClientSuppliedIpUsedInSecurityCheck.ql#L37-L41

X-Forwarded-For is a superposition process when used, format: client, proxy1, proxy2. X-Real-IP is a process of coverage when in use.

It is possible that we have found a possible improvement to the java query :-) While this particular pattern looks unlikely, I think it could easily happen as a typo, at which point an alert would be great. And other patterns could be constructed as well, so we should always strive to point to the correct node. In any case, it should not be hard to fix.

OK. Can you elaborate on this disinfectant? Let me optimize the configuration.

override predicate isSanitizer(DataFlow::Node node) {
    exists(Subscript ss |
      ss.getObject().(Call).getFunc().(Attribute).getName() = "split" and
      ss.getObject().(Call).getArg(0).(StrConst).getText() = "," and
      ss = node.asExpr()
    )
  }

@yoff Do you want this result?

Yes exactly. Except I think you still need to exclude index 0.