Merge pull request #6399 from erik-krogh/nunjucks

Approved by esbena

Author: codeql-ci

javascript/ql/src/DOM/TargetBlank.ql

@@ -43,8 +43,8 @@ predicate hasDynamicHrefHostAttributeValue(DOM::ElementDefinition elem) {
       url.regexpMatch(Templating::getDelimiterMatchingRegexpWithPrefix("[^?#]*")) and
       // ... that does not start with a fixed host or a relative path (common formats)
       not url.regexpMatch("(?i)((https?:)?//)?[-a-z0-9.]*/.*") and
-      // .. that is not a call to `url_for` in a Flask application
-      not url.regexpMatch("\\{\\{\\s*url_for.*")
+      // .. that is not a call to `url_for` in a Flask / nunjucks application
+      not url.regexpMatch("\\{\\{\\s*url(_for)?\\(.+\\).*")
     )
   )
 }

javascript/ql/test/query-tests/DOM/TargetBlank/tst.js

@@ -62,4 +62,7 @@ function f() {
 // OK, Flask application with internal links
 <a href="{{url_for('foo.html', 'foo')}}" target="_blank">Example</a>;
 <a href="{{ url_for('foo.html', 'foo')}}" target="_blank">Example</a>;
-<a href="{{ 	url_for('foo.html', 'foo')}}" target="_blank">Example</a>;
+<a href="{{ 	url_for('foo.html', 'foo')}}" target="_blank">Example</a>;
+
+// OK, nunjucks template
+<a href="{{ url('foo', query={bla}) }}" target="_blank">Example</a>