codeql/javascript/ql/test/query-tests/Security/CWE-776/closure.js

function test() {
  var src = document.location.search; // $ Source
  goog.dom.xml.loadXml(src); // $ Alert - Closure expands internal entities by default
}