added support for remote flow sinks in the form of parameters to the function

ServiceStack.IRestClient.Get()

Author: mr-sherman

csharp/ql/src/semmle/code/csharp/frameworks/ServiceStack.qll

@@ -78,7 +78,21 @@ module Sources {
         }
     }
 }
-
+/** Flow Sinks for the ServiceStack framework */
+module Sinks {
+    private import semmle.code.csharp.security.dataflow.flowsinks.Remote
+  
+    /** RemoteFlow sinks for service stack */
+    class ServiceStackRemoteRequestParameter extends RemoteFlowSink {
+      ServiceStackRemoteRequestParameter() {
+        exists(MethodCall mc |
+          mc.getTarget().hasQualifiedName("ServiceStack.IRestClient.Get") and
+          mc.getArgument(0) = this.asExpr()
+        )
+      }
+    }
+  }
+  
 /** SQLi support for the ServiceStack framework */
 module SQL {
     private import semmle.code.csharp.security.dataflow.SqlInjection::SqlInjection

csharp/ql/src/semmle/code/csharp/security/dataflow/flowsinks/Remote.qll

@@ -8,6 +8,7 @@ private import ExternalLocationSink
 private import Html
 private import semmle.code.csharp.security.dataflow.XSS
 private import semmle.code.csharp.frameworks.system.web.UI
+import semmle.code.csharp.frameworks.ServiceStack::Sinks
 
 /** A data flow sink of remote user output. */
 abstract class RemoteFlowSink extends DataFlow::Node { }