move the XssThroughDom sources into the Customizations file

erik-krogh · erik-krogh · commit 25708c5091c4 · 2022-04-20T18:10:53.000+02:00
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/Xss.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/Xss.qll
@@ -170,10 +170,12 @@ deprecated module StoredXss {
   import StoredXssCustomizations::StoredXss
 }
 
-/** Provides classes and predicates for the XSS through DOM query. */
-module XssThroughDom {
-  /** A data flow source for XSS through DOM vulnerabilities. */
-  abstract class Source extends Shared::Source { }
+/**
+ * DEPRECATED: Use the `XssThroughDomCustomizations.qll` file instead.
+ * Provides classes and predicates for the XSS through DOM query.
+ */
+deprecated module XssThroughDom {
+  import XssThroughDomCustomizations::XssThroughDom
 }
 
 /** Provides classes for customizing the `ExceptionXss` query. */
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/XssThroughDomCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/XssThroughDomCustomizations.qll
@@ -9,10 +9,13 @@ import javascript
  * Sources for cross-site scripting vulnerabilities through the DOM.
  */
 module XssThroughDom {
-  import Xss::XssThroughDom
+  private import Xss::Shared as Shared
   private import semmle.javascript.dataflow.InferredTypes
   private import semmle.javascript.security.dataflow.DomBasedXssCustomizations
 
+  /** A data flow source for XSS through DOM vulnerabilities. */
+  abstract class Source extends Shared::Source { }
+
   /**
    * Gets an attribute name that could store user-controlled data.
    *
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/XssThroughDomQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/XssThroughDomQuery.qll
@@ -5,7 +5,6 @@
 
 import javascript
 private import semmle.javascript.dataflow.InferredTypes
-import Xss::XssThroughDom
 private import XssThroughDomCustomizations::XssThroughDom
 private import semmle.javascript.security.dataflow.DomBasedXssCustomizations
 private import semmle.javascript.security.dataflow.UnsafeJQueryPluginCustomizations::UnsafeJQueryPlugin as UnsafeJQuery
