codeql/change-notes/1.21/analysis-javascript.md

Improvements to JavaScript analysis

General improvements

• Support for the following frameworks and libraries has been improved:

  • socket.io

• The security queries now track data flow through Base64 decoders such as the Node.js Buffer class, the DOM function atob, and a number of npm packages intcluding abab, atob, btoa, base-64, js-base64, Base64.js and base64-js.

New queries

Query	Tags	Purpose

Changes to existing queries

Query	Expected impact	Change
Expression has no effect	Fewer false-positive results	This rule now treats uses of Object.defineProperty more conservatively.
Useless assignment to property	Fewer false-positive results	This rule now ignores reads of additional getters.
Arbitrary file write during zip extraction ("Zip Slip")	More results	This rule now considers more libraries, including tar as well as zip.
Client-side URL redirect	Fewer false-positive results	This rule now treats URLs as safe in more cases where the hostname cannot be tampered with.
Server-side URL redirect	Fewer false-positive results	This rule now treats URLs as safe in more cases where the hostname cannot be tampered with.

Changes to QL libraries