codeql/change-notes/1.25/analysis-javascript.md

Improvements to JavaScript analysis

General improvements

• Support for the following frameworks and libraries has been improved:
  • express
  • fstream
  • jGrowl
  • jQuery
  • marsdb
  • minimongo
  • mssql
  • mysql
  • pg
  • sequelize
  • spanner
  • sqlite
  • ssh2
  • ssh2-streams

New queries

Query	Tags	Purpose
Cross-site scripting through DOM (js/xss-through-dom)	security, external/cwe/cwe-079, external/cwe/cwe-116	Highlights potential XSS vulnerabilities where existing text from the DOM is used as HTML. Results are not shown on LGTM by default.
Incomplete HTML attribute sanitization (js/incomplete-html-attribute-sanitization)	security, external/cwe/cwe-20, external/cwe/cwe-079, external/cwe/cwe-116	Highlights potential XSS vulnerabilities due to incomplete sanitization of HTML meta-characters. Results are shown on LGTM by default.
Unsafe expansion of self-closing HTML tag (js/unsafe-html-expansion)	security, external/cwe/cwe-079, external/cwe/cwe-116	Highlights potential XSS vulnerabilities caused by unsafe expansion of self-closing HTML tags.

Changes to existing queries

Query	Expected impact	Change
Misspelled variable name (js/misspelled-variable-name)	Message changed	The message for this query now correctly identifies the misspelled variable in additional cases.
Uncontrolled data used in path expression (js/path-injection)	More results	This query now recognizes additional file system calls.
Uncontrolled command line (js/command-line-injection)	More results	This query now recognizes additional command execution calls.
Client-side URL redirect (js/client-side-unvalidated-url-redirection)	Less results	This query now recognizes additional safe patterns of doing URL redirects.
Client-side cross-site scripting (js/xss)	Less results	This query now recognizes additional safe strings based on URLs.
Incomplete URL scheme check (js/incomplete-url-scheme-check)	More results	This query now recognizes additional url scheme checks.
Prototype pollution in utility function (js/prototype-pollution-utility)	More results	This query now recognizes additional utility functions as vulnerable to prototype polution.
Expression has no effect (js/useless-expression)	Less results	This query no longer flags an expression when that expression is the only content of the containing file.
Unknown directive (js/unknown-directive)	Less results	This query no longer flags directives generated by the Babel compiler.
Code injection (js/code-injection)	More results	More potential vulnerabilities involving NoSQL code operators are now recognized.
Zip Slip (js/zipslip)	More results	This query now recognizes additional vulnerabilities.

Changes to libraries

• A library semmle.javascript.explore.CallGraph has been added to help write queries for exploring the call graph.
• Added data flow for Map and Set, and added matching type-tracking steps that can accessed using the CollectionsTypeTracking module.