diff --git a/benjamin-button.md b/benjamin-button.md index c009f7d1f43..57f65b9354a 100644 --- a/benjamin-button.md +++ b/benjamin-button.md @@ -26,6 +26,8 @@ Sinks added between 2020-01-01 and 2020-10-06 have been removed. Found by lookin - the commit titles of https://github.com/github/codeql/commits/main/javascript/ql/test/query-tests/Security/CWE-079/Xss.expected - the PR titles of https://github.com/github/codeql/pulls?page=2&q=is%3Apr+label%3AJS+is%3Aclosed+sink +- recursive type tracking for `jQuery::dollar`, `DOM::domValueRef`. + ## SqlInjection.ql Sinks added between 2020-01-01 and 2020-10-06 have been removed. Found by looking at: diff --git a/javascript/ql/lib/semmle/javascript/DOM.qll b/javascript/ql/lib/semmle/javascript/DOM.qll index 70ee5e45daf..a87fb21ccbd 100644 --- a/javascript/ql/lib/semmle/javascript/DOM.qll +++ b/javascript/ql/lib/semmle/javascript/DOM.qll @@ -387,11 +387,6 @@ module DOM { or t.start() and result = domValueRef().getAMethodCall(["item", "namedItem"]) - or - t.startInProp("target") and - result = domEventSource() - or - exists(DataFlow::TypeTracker t2 | result = domValueRef(t2).track(t2, t)) } /** Gets a data flow node that may refer to a value from the DOM. */ diff --git a/javascript/ql/lib/semmle/javascript/frameworks/jQuery.qll b/javascript/ql/lib/semmle/javascript/frameworks/jQuery.qll index e65f6d70dcf..a9fdd7b03c0 100644 --- a/javascript/ql/lib/semmle/javascript/frameworks/jQuery.qll +++ b/javascript/ql/lib/semmle/javascript/frameworks/jQuery.qll @@ -428,8 +428,6 @@ module JQuery { private DataFlow::SourceNode dollar(DataFlow::TypeTracker t) { t.start() and result = dollarSource() - or - exists(DataFlow::TypeTracker t2 | result = dollar(t2).track(t2, t)) } /**