move LocalUrlSanitizingGuard out of the customizations file

erik-krogh · erik-krogh · commit 9631b68de91d · 2022-04-20T18:10:52.000+02:00
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/ServerSideUrlRedirectCustomizations.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/ServerSideUrlRedirectCustomizations.qll
@@ -47,20 +47,6 @@ module ServerSideUrlRedirect {
     }
   }
 
-  /**
-   * A call to a function called `isLocalUrl` or similar, which is
-   * considered to sanitize a variable for purposes of URL redirection.
-   */
-  class LocalUrlSanitizingGuard extends TaintTracking::SanitizerGuardNode, DataFlow::CallNode {
-    LocalUrlSanitizingGuard() { this.getCalleeName().regexpMatch("(?i)(is_?)?local_?url") }
-
-    override predicate sanitizes(boolean outcome, Expr e) {
-      // `isLocalUrl(e)` sanitizes `e` if it evaluates to `true`
-      this.getAnArgument().asExpr() = e and
-      outcome = true
-    }
-  }
-
   /**
    * A URL attribute for a React Native `WebView`.
    */
diff --git a/javascript/ql/lib/semmle/javascript/security/dataflow/ServerSideUrlRedirectQuery.qll b/javascript/ql/lib/semmle/javascript/security/dataflow/ServerSideUrlRedirectQuery.qll
@@ -36,3 +36,17 @@ class Configuration extends TaintTracking::Configuration {
     guard instanceof HostnameSanitizerGuard
   }
 }
+
+/**
+ * A call to a function called `isLocalUrl` or similar, which is
+ * considered to sanitize a variable for purposes of URL redirection.
+ */
+class LocalUrlSanitizingGuard extends TaintTracking::SanitizerGuardNode, DataFlow::CallNode {
+  LocalUrlSanitizingGuard() { this.getCalleeName().regexpMatch("(?i)(is_?)?local_?url") }
+
+  override predicate sanitizes(boolean outcome, Expr e) {
+    // `isLocalUrl(e)` sanitizes `e` if it evaluates to `true`
+    this.getAnArgument().asExpr() = e and
+    outcome = true
+  }
+}
