github
diff --git a/‎…0/FunctionalityFromUntrustedDomain.qhelp‎ ‎…0/FunctionalityFromUntrustedDomain.qhelp‎javascript/ql/src/experimental/Security/CWE-830/FunctionalityFromUntrustedDomain.qhelp renamed to javascript/ql/src/Security/CWE-830/FunctionalityFromUntrustedDomain.qhelp b/‎…0/FunctionalityFromUntrustedDomain.qhelp‎ ‎…0/FunctionalityFromUntrustedDomain.qhelp‎javascript/ql/src/experimental/Security/CWE-830/FunctionalityFromUntrustedDomain.qhelp renamed to javascript/ql/src/Security/CWE-830/FunctionalityFromUntrustedDomain.qhelp
diff --git a/‎…-830/FunctionalityFromUntrustedDomain.ql‎ ‎…-830/FunctionalityFromUntrustedDomain.ql‎javascript/ql/src/experimental/Security/CWE-830/FunctionalityFromUntrustedDomain.ql renamed to javascript/ql/src/Security/CWE-830/FunctionalityFromUntrustedDomain.ql b/‎…-830/FunctionalityFromUntrustedDomain.ql‎ ‎…-830/FunctionalityFromUntrustedDomain.ql‎javascript/ql/src/experimental/Security/CWE-830/FunctionalityFromUntrustedDomain.ql renamed to javascript/ql/src/Security/CWE-830/FunctionalityFromUntrustedDomain.ql
diff --git a/‎…curity/CWE-830/polyfill-compromised.html‎ ‎…curity/CWE-830/polyfill-compromised.html‎javascript/ql/src/experimental/Security/CWE-830/polyfill-compromised.html renamed to javascript/ql/src/Security/CWE-830/polyfill-compromised.html b/‎…curity/CWE-830/polyfill-compromised.html‎ ‎…curity/CWE-830/polyfill-compromised.html‎javascript/ql/src/experimental/Security/CWE-830/polyfill-compromised.html renamed to javascript/ql/src/Security/CWE-830/polyfill-compromised.html
diff --git a/‎…ental/Security/CWE-830/polyfill-sri.html‎ ‎…l/src/Security/CWE-830/polyfill-sri.html‎javascript/ql/src/experimental/Security/CWE-830/polyfill-sri.html renamed to javascript/ql/src/Security/CWE-830/polyfill-sri.html b/‎…ental/Security/CWE-830/polyfill-sri.html‎ ‎…l/src/Security/CWE-830/polyfill-sri.html‎javascript/ql/src/experimental/Security/CWE-830/polyfill-sri.html renamed to javascript/ql/src/Security/CWE-830/polyfill-sri.html
diff --git a/‎…l/Security/CWE-830/polyfill-trusted.html‎ ‎…c/Security/CWE-830/polyfill-trusted.html‎javascript/ql/src/experimental/Security/CWE-830/polyfill-trusted.html renamed to javascript/ql/src/Security/CWE-830/polyfill-trusted.html b/‎…l/Security/CWE-830/polyfill-trusted.html‎ ‎…c/Security/CWE-830/polyfill-trusted.html‎javascript/ql/src/experimental/Security/CWE-830/polyfill-trusted.html renamed to javascript/ql/src/Security/CWE-830/polyfill-trusted.html
diff --git a/‎javascript/ql/src/change-notes/2024-07-08-functionality-from-untrusted-domain.md‎
Lines changed: 5 additions & 3 deletions b/‎javascript/ql/src/change-notes/2024-07-08-functionality-from-untrusted-domain.md‎
Lines changed: 5 additions & 3 deletions
diff --git a/‎javascript/ql/test/experimental/Security/CWE-830/FunctionalityFromUntrustedDomain.qlref‎
Lines changed: 0 additions & 1 deletion b/‎javascript/ql/test/experimental/Security/CWE-830/FunctionalityFromUntrustedDomain.qlref‎
Lines changed: 0 additions & 1 deletion
diff --git a/‎…unctionalityFromUntrustedDomain.expected‎ ‎…unctionalityFromUntrustedDomain.expected‎javascript/ql/test/experimental/Security/CWE-830/FunctionalityFromUntrustedDomain.expected renamed to javascript/ql/test/query-tests/Security/CWE-830/FunctionalityFromUntrustedDomain.expected b/‎…unctionalityFromUntrustedDomain.expected‎ ‎…unctionalityFromUntrustedDomain.expected‎javascript/ql/test/experimental/Security/CWE-830/FunctionalityFromUntrustedDomain.expected renamed to javascript/ql/test/query-tests/Security/CWE-830/FunctionalityFromUntrustedDomain.expected
diff --git a/‎javascript/ql/test/query-tests/Security/CWE-830/FunctionalityFromUntrustedDomain.qlref‎
Lines changed: 1 addition & 0 deletions b/‎javascript/ql/test/query-tests/Security/CWE-830/FunctionalityFromUntrustedDomain.qlref‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎…tal/Security/CWE-830/polyfill-check.html‎ ‎…sts/Security/CWE-830/polyfill-check.html‎javascript/ql/test/experimental/Security/CWE-830/polyfill-check.html renamed to javascript/ql/test/query-tests/Security/CWE-830/polyfill-check.html b/‎…tal/Security/CWE-830/polyfill-check.html‎ ‎…sts/Security/CWE-830/polyfill-check.html‎javascript/ql/test/experimental/Security/CWE-830/polyfill-check.html renamed to javascript/ql/test/query-tests/Security/CWE-830/polyfill-check.html
@@ -1,6 +1,8 @@
 ---
 category: minorAnalysis
 ---
-* Added a new query, `js/functionality-from-untrusted-domain`, which detects uses in HTML and JavaScript scripts from untrusted domains, including the compromised `polyfill.io` content delivery network, and can be extended to detect other compromised scripts using data extensions.
-* Modified existing query, `js/functionality-from-untrusted-source`, to allow adding this new query, but reusing the same logic.
-* Created a shared library, `semmle.javascript.security.FunctionalityFromUntrustedSource`, to separate the logic from that existing query and allow having a separate "untrusted domain" query.
+* Added a new query, `js/functionality-from-untrusted-domain`, which detects uses in HTML and JavaScript scripts from untrusted domains, including the `polyfill.io` content delivery network
+  * it can be extended to detect other compromised scripts using user-provided data extensions of the `untrustedDomain` predicate, which takes one string argument with the domain to warn on (and will warn on any subdomains too).
+* Modified existing query, `js/functionality-from-untrusted-source`, to allow adding this new query, but reusing the same logic
+  * Added the ability to use data extensions to require SRI on CDN hostnames using the `isCdnDomainWithCheckingRequired` predicate, which takes one string argument of the full hostname to require SRI for.
+* Created a new library, `semmle.javascript.security.FunctionalityFromUntrustedSource`, to support both queries.
@@ -0,0 +1 @@
+Security/CWE-830/FunctionalityFromUntrustedDomain.ql
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+Security/CWE-830/FunctionalityFromUntrustedDomain.ql`