UserControlled/DataFromInternet file content deserializatio rule

Summary:
creates a rule for new category FileContentDeserializationSink.
sources UserControlled/DataFromInternet to new sink FileContentDeserializationSink

Reviewed By: r0rshark

Differential Revision: D47438813

fbshipit-source-id: 7e56ab6cf2323807ad50eafe60d204530c59adae

stubs/taint/core_privacy_security/taint.config

@@ -388,6 +388,17 @@
         "CLIUserControlled"
       ]
     },
+    {
+      "code": 5067,
+      "message_format": "Data from [{$sources}] source(s) may reach [{$sinks}] sink(s)",
+      "name": "Unsafe UserControlled file handle before content deserialization may result in RCE",
+      "sinks": [
+        "FileContentDeserializationSink"
+      ],
+      "sources": [
+        "UserControlled"
+      ]
+    },
     {
       "code": 6060,
       "message_format": "Data from [{$sources}] source(s) may reach [{$sinks}] sink(s)",
@@ -591,6 +602,17 @@
           "DataFromInternet"
         ]
       },
+      {
+        "code": 5367,
+        "message_format": "Data from [{$sources}] source(s) may reach [{$sinks}] sink(s)",
+        "name": "External/Internet request response data controls file handle before content deserialization may result in RCE",
+        "sinks": [
+          "FileContentDeserializationSink"
+        ],
+        "sources": [
+          "DataFromInternet"
+        ]
+      },
       {
         "code": 5373,
         "message_format": "Data from Internet may eventually flow into a Server Side Template Injection sink",