Rust: Enable local threat models in tests and use active threat models for regex query

Author: paldepind

rust/ql/src/queries/security/CWE-730/RegexInjection.ql

@@ -21,7 +21,7 @@ private import codeql.rust.security.regex.RegexInjectionExtensions
  * A taint configuration for detecting regular expression injection vulnerabilities.
  */
 module RegexInjectionConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { source instanceof ThreatModelSource }
+  predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof RegexInjectionSink }
 

rust/ql/test/default-threat-models.model.yml

@@ -0,0 +1,6 @@
+extensions:
+  - addsTo:
+      pack: codeql/threat-models
+      extensible: threatModelConfiguration
+    data:
+      - ["local", true, 0]

rust/ql/test/qlpack.yml

@@ -6,3 +6,5 @@ dependencies:
 extractor: rust
 tests: .
 warnOnImplicitThis: true
+dataExtensions:
+  - default-threat-models.model.yml