diff --git a/javascript/ql/src/semmle/javascript/DOM.qll b/javascript/ql/src/semmle/javascript/DOM.qll index a1facf39505..6ddd236a88b 100644 --- a/javascript/ql/src/semmle/javascript/DOM.qll +++ b/javascript/ql/src/semmle/javascript/DOM.qll @@ -346,13 +346,6 @@ module DOM { call.getNumArgument() = 1 and forex(InferredType t | t = call.getArgument(0).analyze().getAType() | t = TTNumber()) ) - or - // A `this` node from a callback given to a `$().each(callback)` call. - // purposely not using JQuery::MethodCall to avoid `jquery.each()`. - exists(DataFlow::CallNode eachCall | eachCall = JQuery::objectRef().getAMethodCall("each") | - this = DataFlow::thisNode(eachCall.getCallback(0).getFunction()) or - this = eachCall.getABoundCallbackParameter(0, 1) - ) } } } diff --git a/javascript/ql/src/semmle/javascript/frameworks/jQuery.qll b/javascript/ql/src/semmle/javascript/frameworks/jQuery.qll index 5f5be4a2fc4..17babb912c0 100644 --- a/javascript/ql/src/semmle/javascript/frameworks/jQuery.qll +++ b/javascript/ql/src/semmle/javascript/frameworks/jQuery.qll @@ -533,14 +533,6 @@ module JQuery { } } - /** - * A `this` node in a JQuery plugin function, which is a JQuery object. - */ - private class JQueryPluginThisObject extends Range { - JQueryPluginThisObject() { - this = DataFlow::thisNode(any(JQueryPluginMethod method).getFunction()) - } - } } /** A source of jQuery objects from the AST-based `JQueryObject` class. */ diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll b/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll index ea911f95300..0a278ed339b 100644 --- a/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll +++ b/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll @@ -172,15 +172,6 @@ module DomBasedXss { this = any(Typeahead::TypeaheadSuggestionFunction f).getAReturn() or this = any(Handlebars::SafeString s).getAnArgument() - or - this = any(JQuery::MethodCall call | call.getMethodName() = "jGrowl").getArgument(0) - or - // A construction of a JSDOM object (server side DOM), where scripts are allowed. - exists(DataFlow::NewNode instance | - instance = API::moduleImport("jsdom").getMember("JSDOM").getInstance().getAnImmediateUse() and - this = instance.getArgument(0) and - instance.getOptionArgument(1, "runScripts").mayHaveStringValue("dangerously") - ) } }