Merge pull request #4392 from erik-krogh/flask

Approved by asgerf

Author: codeql-ci

javascript/ql/src/DOM/TargetBlank.ql

@@ -31,7 +31,9 @@ predicate hasDynamicHrefHostAttributeValue(DOM::ElementDefinition elem) {
       // fixed string with templating
       url.regexpMatch(Templating::getDelimiterMatchingRegexpWithPrefix("[^?#]*")) and
       // ... that does not start with a fixed host or a relative path (common formats)
-      not url.regexpMatch("(?i)((https?:)?//)?[-a-z0-9.]*/.*")
+      not url.regexpMatch("(?i)((https?:)?//)?[-a-z0-9.]*/.*") and
+      // .. that is not a call to `url_for` in a Flask application
+      not url.regexpMatch("\\{\\{\\s*url_for.*")
     )
   )
 }

javascript/ql/test/query-tests/DOM/TargetBlank/tst.js

@@ -58,3 +58,8 @@ function f() {
 <a href="index.html/{{X}}" target="_blank">Example</a>;
 <a href="../index.html/{{X}}" target="_blank">Example</a>;
 <a href="/{{X}}" target="_blank">Example</a>;
+
+// OK, Flask application with internal links
+<a href="{{url_for('foo.html', 'foo')}}" target="_blank">Example</a>;
+<a href="{{ url_for('foo.html', 'foo')}}" target="_blank">Example</a>;
+<a href="{{ 	url_for('foo.html', 'foo')}}" target="_blank">Example</a>;