Python: Fix flask request modeling

This takes us part of the way. We still get multiple paths for the same
alert, but that will be fixed in a different PR.

Author: RasmusWL

python/ql/lib/semmle/python/frameworks/Flask.qll

@@ -354,13 +354,7 @@ module Flask {
    * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.Request
    */
   private class FlaskRequestSource extends RemoteFlowSource::Range {
-    FlaskRequestSource() {
-      this = request().getAValueReachableFromSource() and
-      not any(Import imp).contains(this.asExpr()) and
-      not exists(ControlFlowNode def | this.asVar().getSourceVariable().hasDefiningNode(def) |
-        any(Import imp).contains(def.getNode())
-      )
-    }
+    FlaskRequestSource() { this = request().asSource() }
 
     override string getSourceType() { result = "flask.request" }
   }

python/ql/src/change-notes/2022-09-29-flask-source-modeling.md

@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed how `flask.request` is modeled as a RemoteFlowSource, such that we show fewer duplicated alert messages for Code Scanning alerts. The import, such as `from flask import request`, will now be shown as the first step in a path explanation.