diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeJQueryPluginCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeJQueryPluginCustomizations.qll index 710e87ae026..b3e2057336e 100644 --- a/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeJQueryPluginCustomizations.qll +++ b/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeJQueryPluginCustomizations.qll @@ -31,6 +31,13 @@ module UnsafeJQueryPlugin { */ abstract class Sanitizer extends DataFlow::Node { } + /** + * The receiver of a function, seen as a sanitizer. + * + * Plugins often do `$(this)` to coerce an existing DOM element to a jQuery object. + */ + private class ThisSanitizer extends Sanitizer instanceof DataFlow::ThisNode { } + /** * An argument that may act as an HTML fragment rather than a CSS selector, as a sink for remote unsafe jQuery plugins. */ diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeJQueryPluginQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeJQueryPluginQuery.qll index 7e87da2ee42..1c82f7ff0c6 100644 --- a/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeJQueryPluginQuery.qll +++ b/javascript/ql/lib/semmle/javascript/security/dataflow/UnsafeJQueryPluginQuery.qll @@ -23,9 +23,6 @@ class Configuration extends TaintTracking::Configuration { node instanceof DomBasedXss::Sanitizer or node instanceof Sanitizer - or - // Plugins usually do `$(this)` to coerce an existing DOM element to a jQuery object. - node instanceof DataFlow::ThisNode } override predicate isAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {