JS: Use clearsContent from variable-capture output by asgerf · Pull Request #21398 · github/codeql

Expand Up @@ -1616,6 +1616,11 @@ predicate clearsContent(Node n, ContentSet c) { VariableCaptureOutput::storeStep(getClosureNode(n), _, _) and c = MkAnyCapturedContent() or exists(LocalVariableOrThis v | VariableCaptureOutput::clearsContent(getClosureNode(n), v) and c.asSingleton().asCapturedVariable() = v ) or // Block flow into the "window.location" property, as any assignment/mutation to this causes a page load and stops execution. // The use of clearsContent here ensures we also block assignments like `window.location.href = ...` exists(DataFlow::PropRef ref | Expand Down