fix bad join order in Xss.qll

erik-krogh · erik-krogh · commit 9e6f28e335bc · 2021-04-19T13:17:49.000+02:00
diff --git a/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll b/javascript/ql/src/semmle/javascript/security/dataflow/Xss.qll
@@ -211,7 +211,7 @@ module DomBasedXss {
       exists(JQuery::MethodCall call |
         call.interpretsArgumentAsHtml(this) and
         call.interpretsArgumentAsSelector(this) and
-        analyze().getAType() = TTString()
+        pragma[only_bind_out](analyze()).getAType() = TTString()
       )
     }
 

Original file line number	Diff line number	Diff line change
`@@ -211,7 +211,7 @@ module DomBasedXss {`
`211`	`211`	`exists(JQuery::MethodCall call \|`
`212`	`212`	`call.interpretsArgumentAsHtml(this) and`
`213`	`213`	`call.interpretsArgumentAsSelector(this) and`
`214`		`- analyze().getAType() = TTString()`
	`214`	`+ pragma[only_bind_out](analyze()).getAType() = TTString()`
`215`	`215`	`)`
`216`	`216`	`}`
`217`	`217`