Fix bad models, add tests for those

Author: atorralba

java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

@@ -627,7 +627,7 @@ module CsvValidation {
           "open-url", "jndi-injection", "ldap", "sql", "jdbc-url", "logging", "mvel", "xpath",
           "groovy", "xss", "ognl-injection", "intent-start", "pending-intent-sent",
           "url-open-stream", "url-redirect", "create-file", "write-file", "set-hostname-verifier",
-          "header-splitting", "information-leak", "xslt", "jexl", "bean-validation"
+          "header-splitting", "information-leak", "xslt", "jexl", "bean-validation", "ssti"
         ] and
       not kind.matches("regex-use%") and
       not kind.matches("qltest%") and

java/ql/lib/semmle/code/java/security/TemplateInjection.qll

@@ -91,9 +91,9 @@ private class TemplateInjectionSinkModels extends SinkModelCsv {
         "org.thymeleaf;ITemplateEngine;true;processThrottled;;;Argument[0];ssti;manual",
         "org.apache.velocity.app;Velocity;true;evaluate;;;Argument[0];ssti;manual",
         "org.apache.velocity.app;Velocity;true;evaluate;;;Argument[3];ssti;manual",
-        "org.apache.velocity,app;VelocityEngine;true;evaluate;;;Argument[0];ssti;manual",
-        "org.apache.velocity,app;VelocityEngine;true;evaluate;;;Argument[3];ssti;manual",
         "org.apache.velocity.app;Velocity;true;mergeTemplate;;;Argument[2];ssti;manual",
+        "org.apache.velocity.app;VelocityEngine;true;evaluate;;;Argument[0];ssti;manual",
+        "org.apache.velocity.app;VelocityEngine;true;evaluate;;;Argument[3];ssti;manual",
         "org.apache.velocity.app;VelocityEngine;true;mergeTemplate;;;Argument[2];ssti;manual",
         "org.apache.velocity.runtime.resource.util;StringResourceRepository;true;putStringResource;;;Argument[1];ssti;manual",
         "org.apache.velocity.runtime;RuntimeServices;true;evaluate;;;Argument[0];ssti;manual",

java/ql/test/query-tests/security/CWE-094/VelocitySSTI.java

@@ -86,6 +86,10 @@ public void bad5(HttpServletRequest request) {
 		StringWriter w = new StringWriter();
 		VelocityEngine engine = null;
 		engine.mergeTemplate("testtemplate.vm", "UTF-8", context, w); // $hasTemplateInjection
+		AbstractContext ctx = null;
+		ctx.put("key", code);
+		engine.evaluate(ctx, null, null, null); // $hasTemplateInjection
+		engine.evaluate(null, null, null, code); // $hasTemplateInjection
 	}
 
 	@GetMapping(value = "bad6")