add comment about filtering away jQuery from the source

This commit is contained in:
Erik Krogh Kristensen
2021-05-10 10:05:18 +02:00
parent b53759c5a0
commit 3fe5dd0f35

View File

@@ -25,6 +25,7 @@ module UnsafeHtmlConstruction {
class ExternalInputSource extends Source, DataFlow::ParameterNode {
ExternalInputSource() {
this = Exports::getALibraryInputParameter() and
// An AMD-style module sometimes loads the jQuery library in a way which looks like library input.
not this = JQuery::dollarSource()
}
}