JS: Exclude client-side sources from RegExpInjection

javascript/ql/src/semmle/javascript/security/dataflow/RegExpInjectionCustomizations.qll

@@ -27,7 +27,10 @@ module RegExpInjection {
    * expression injection.
    */
   class RemoteFlowSourceAsSource extends Source {
-    RemoteFlowSourceAsSource() { this instanceof RemoteFlowSource }
+    RemoteFlowSourceAsSource() {
+      this instanceof RemoteFlowSource and
+      not this instanceof ClientSideRemoteFlowSource
+    }
   }
 
   /**

javascript/ql/test/query-tests/Security/CWE-730/client-side.js

@@ -0,0 +1,4 @@
+function foo() {
+    let taint = window.location.hash.substring(1);
+    new RegExp(taint); // OK - we do not flag RegExp injection on the client side as the impact is too low
+}