import javascript

import semmle.javascript.security.dataflow.DomBasedXssQuery

import DataFlow::DeduplicatePathGraph<DomBasedXssFlow::PathNode, DomBasedXssFlow::PathGraph>

from PathNode source, PathNode sink

where DomBasedXssFlow::flowPath(source.getAnOriginalPathNode(), sink.getAnOriginalPathNode())

select sink.getNode(), source, sink,

sink.getNode().(Sink).getVulnerabilityKind() + " vulnerability due to $@.", source.getNode(),

"user-provided value"