codeql/change-notes/1.23/analysis-javascript.md

Improvements to JavaScript analysis

General improvements

• Support for the following frameworks and libraries has been improved:

  • firebase
  • mongodb
  • mongoose
  • rate-limiter-flexible

• The call graph has been improved to resolve method calls in more cases. This may produce more security alerts.

New queries

Query	Tags	Purpose
Unused index variable (js/unused-index-variable)	correctness	Highlights loops that iterate over an array, but do not use the index variable to access array elements, indicating a possible typo or logic error. Results are shown on LGTM by default.
Loop bound injection (js/loop-bound-injection)	security, external/cwe/cwe-834	Highlights loops where a user-controlled object with an arbitrary .length value can trick the server to loop indefinitely. Results are not shown on LGTM by default.
Suspicious method name (js/suspicious-method-name)	correctness, typescript, methods	Highlights suspiciously named methods where the developer likely meant to write a constructor or function. Results are shown on LGTM by default.

Changes to existing queries

Query	Expected impact	Change
Incomplete string escaping or encoding (js/incomplete-sanitization)	Fewer false-positive results	This rule now recognizes additional ways delimiters can be stripped away.
Client-side cross-site scripting (js/xss)	More results, fewer false-positive results	More potential vulnerabilities involving functions that manipulate DOM attributes are now recognized, and more sanitizers are detected.
Code injection (js/code-injection)	More results	More potential vulnerabilities involving functions that manipulate DOM event handler attributes are now recognized.
Hard-coded credentials (js/hardcoded-credentials)	Fewer false-positive results	This rule now flags fewer password examples.
Illegal invocation (js/illegal-invocation)	Fewer false-positive results	This rule now correctly handles methods named call and apply.
Incorrect suffix check (js/incorrect-suffix-check)	Fewer false-positive results	The query recognizes valid checks in more cases.
Network data written to file (js/http-to-file-access)	Fewer false-positive results	This query has been renamed to better match its intended purpose, and now only considers network data untrusted.
Password in configuration file (js/password-in-configuration-file)	Fewer false-positive results	This rule now flags fewer password examples.
Prototype pollution (js/prototype-pollution)	More results	The query now highlights vulnerable uses of jQuery and Angular, and the results are shown on LGTM by default.
Reflected cross-site scripting (js/reflected-xss)	Fewer false-positive results	The query now recognizes more sanitizers.
Stored cross-site scripting (js/stored-xss)	Fewer false-positive results	The query now recognizes more sanitizers.
Uncontrolled command line (js/command-line-injection)	More results	This query now treats responses from servers as untrusted.

Changes to QL libraries

• Expr.getDocumentation() now handles chain assignments.