remove postmessage events as source for js/resource-exhaustion

Author: erik-krogh

javascript/ql/lib/semmle/javascript/security/dataflow/ResourceExhaustionCustomizations.qll

@@ -29,7 +29,11 @@ module ResourceExhaustion {
 
   /** A source of remote user input, considered as a data flow source for resource exhaustion vulnerabilities. */
   class RemoteFlowSourceAsSource extends Source instanceof RemoteFlowSource {
-    RemoteFlowSourceAsSource() { not this instanceof ClientSideRemoteFlowSource }
+    RemoteFlowSourceAsSource() {
+      // exclude source that only happen client-side
+      not this instanceof ClientSideRemoteFlowSource and
+      not this = DataFlow::parameterNode(any(PostMessageEventHandler pmeh).getEventParameter())
+    }
   }
 
   /**

javascript/ql/test/query-tests/Security/CWE-770/ResourceExhaustion/resource-exhaustion.js

@@ -98,4 +98,8 @@ function browser() {
     setTimeout(() => {
         console.log("f00");
     }, delay); // OK - source is client side
+
+    window.onmessage = (e) => {
+        setTimeout(() => {}, e.data); // OK - source is client side
+    }
 }