JS: Fix issue with new RegExp().exec()

Author: asgerf

javascript/ql/lib/semmle/javascript/security/TaintedUrlSuffix.qll

@@ -108,7 +108,7 @@ module TaintedUrlSuffix {
       or
       // Assume calls to regexp.exec always extract query/fragment parameters.
       exists(MethodCallNode call |
-        call = any(RegExpLiteral re).flow().(DataFlow::SourceNode).getAMethodCall("exec") and
+        call = any(DataFlow::RegExpCreationNode re).getAMethodCall("exec") and
         src = call.getArgument(0) and
         dst = call
       )

javascript/ql/test/query-tests/Security/CWE-601/ClientSideUrlRedirect/tst.js

@@ -6,15 +6,15 @@ window.location = /.*redirect=([^&]*).*/.exec(document.location.href)[1];
 	window.location = indirect.exec(document.location.href)[1];
 });
 
-// NOT OK [INCONSISTENCY]
+// NOT OK
 window.location = new RegExp('.*redirect=([^&]*).*').exec(document.location.href)[1];
 
 (function(){
 	var indirect = new RegExp('.*redirect=([^&]*).*')
 	window.location = indirect.exec(document.location.href)[1];
 });
 
-// NOT OK [INCONSISTENCY]
+// NOT OK
 window.location = new RegExp(/.*redirect=([^&]*).*/).exec(document.location.href)[1];
 
 (function(){
@@ -23,7 +23,7 @@ window.location = new RegExp(/.*redirect=([^&]*).*/).exec(document.location.href
 });
 
 function foo(win) {
-	win.location.assign(new RegExp(/.*redirect=([^&]*).*/).exec(win.location.href)[1]); // NOT OK [INCONSISTENCY]
+	win.location.assign(new RegExp(/.*redirect=([^&]*).*/).exec(win.location.href)[1]); // NOT OK
 }
 
 foo(window);