JS: Show problem with new RegExp().exec()

Author: asgerf

javascript/ql/test/query-tests/Security/CWE-601/ClientSideUrlRedirect/tst.js

@@ -6,15 +6,15 @@ window.location = /.*redirect=([^&]*).*/.exec(document.location.href)[1];
 	window.location = indirect.exec(document.location.href)[1];
 });
 
-// NOT OK
+// NOT OK [INCONSISTENCY]
 window.location = new RegExp('.*redirect=([^&]*).*').exec(document.location.href)[1];
 
 (function(){
 	var indirect = new RegExp('.*redirect=([^&]*).*')
 	window.location = indirect.exec(document.location.href)[1];
 });
 
-// NOT OK
+// NOT OK [INCONSISTENCY]
 window.location = new RegExp(/.*redirect=([^&]*).*/).exec(document.location.href)[1];
 
 (function(){
@@ -23,7 +23,7 @@ window.location = new RegExp(/.*redirect=([^&]*).*/).exec(document.location.href
 });
 
 function foo(win) {
-	win.location.assign(new RegExp(/.*redirect=([^&]*).*/).exec(win.location.href)[1]); // NOT OK
+	win.location.assign(new RegExp(/.*redirect=([^&]*).*/).exec(win.location.href)[1]); // NOT OK [INCONSISTENCY]
 }
 
-foo(window);
+foo(window);