use isWildcardLike in MetacharEscapeSanitizer

2026-04-30 03:05:15 +02:00 · 2021-04-28 11:46:50 +02:00
parent d07c71c99d
commit d5450f1df6
1 changed files with 2 additions and 4 deletions
--- a/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
+++ b/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
@@ -37,10 +37,8 @@ module Shared {
      (
        RegExp::alwaysMatchesMetaCharacter(getRegExp().getRoot(), ["<", "'", "\""])
        or
-        // or it's a global inverted char class.
-        getRegExp().getRoot().(RegExpCharacterClass).isInverted()
-        or
-        getRegExp().getRoot().(RegExpQuantifier).getAChild().(RegExpCharacterClass).isInverted()
+        // or it's like a wild-card.
+        RegExp::isWildcardLike(getRegExp().getRoot())
      )
    }
  }