JS: include referer header as reflected XSS source

javascript/ql/src/semmle/javascript/frameworks/HTTP.qll

@@ -412,6 +412,9 @@ module HTTP {
      *
      * In these cases, the request is technically sent from the user's browser, but
      * the user is not in direct control of the URL or POST body.
+     *
+     * Headers are never considered third-party controllable by this predicate, although the
+     * third party does have some control over the the Referer and Origin headers.
      */
     predicate isThirdPartyControllable() {
       exists (string kind | kind = getKind() |

javascript/ql/src/semmle/javascript/security/dataflow/ReflectedXss.qll

@@ -47,6 +47,8 @@ module ReflectedXss {
   class ThirdPartyRequestInputAccessAsSource extends Source {
     ThirdPartyRequestInputAccessAsSource() {
       this.(HTTP::RequestInputAccess).isThirdPartyControllable()
+      or
+      this.(HTTP::RequestHeaderAccess).getAHeaderName() = "referer"
     }
   }