//
// Modern version of ReflectedXssWithCustomSanitizer_old.ql
//
import javascript
import semmle.javascript.security.dataflow.ReflectedXssQuery

class IsVarNameSanitizer extends TaintTracking::AdditionalSanitizerGuardNode, DataFlow::CallNode {
  IsVarNameSanitizer() { getCalleeName() = "isVarName" }

  override predicate sanitizes(boolean outcome, Expr e) {
    outcome = true and
    e = getArgument(0).asExpr()
  }

  override predicate appliesTo(TaintTracking::Configuration cfg) { cfg instanceof Configuration }
}

from Configuration xss, Source source, Sink sink
where xss.hasFlow(source, sink)
select sink, "Cross-site scripting vulnerability due to $@.", source, "user-provided value"