JS: Collection methods can be called on DOM elements

asgerf · asgerf · commit 12a793aa75a8 · 2025-03-27T16:23:02.000+01:00
diff --git a/javascript/ql/lib/semmle/javascript/DOM.qll b/javascript/ql/lib/semmle/javascript/DOM.qll
@@ -247,7 +247,7 @@ module DOM {
         ]
     |
       (
-        result = documentRef().getAMethodCall(collectionName) or
+        result = domValueRef().getAMethodCall(collectionName) or
         result = DataFlow::globalVarRef(collectionName).getACall()
       )
     )

Original file line number	Diff line number	Diff line change
`@@ -247,7 +247,7 @@ module DOM {`
`247`	`247`	`]`
`248`	`248`	`\|`
`249`	`249`	`(`
`250`		`- result = documentRef().getAMethodCall(collectionName) or`
	`250`	`+ result = domValueRef().getAMethodCall(collectionName) or`
`251`	`251`	`result = DataFlow::globalVarRef(collectionName).getACall()`
`252`	`252`	`)`
`253`	`253`	`)`