See `xss-event-handlers` [test](https://github.com/advanced-security/codeql-sap-js/blob/main/test/queries/xss/xss-event-handlers/webapp/controller/app.controller.js)