Merge pull request #22853 from ku-plrg/js/string-trim-normalize

JS: Add taint steps for trimStart, trimEnd and normalize

Author: asgerf

javascript/ql/lib/change-notes/2026-10-20-string-trim-normalize.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added taint steps for `String.prototype.trimStart`, `trimEnd`, and `normalize`.

javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll

@@ -455,10 +455,10 @@ module TaintTracking {
             name =
               [
                 "anchor", "big", "blink", "bold", "concat", "fixed", "fontcolor", "fontsize",
-                "italics", "link", "padEnd", "padStart", "repeat", "replace", "replaceAll", "slice",
-                "small", "strike", "sub", "substr", "substring", "sup", "toLocaleLowerCase",
-                "toLocaleUpperCase", "toLowerCase", "toUpperCase", "trim", "trimLeft", "trimRight",
-                "toWellFormed"
+                "italics", "link", "normalize", "padEnd", "padStart", "repeat", "replace",
+                "replaceAll", "slice", "small", "strike", "sub", "substr", "substring", "sup",
+                "toLocaleLowerCase", "toLocaleUpperCase", "toLowerCase", "toUpperCase", "trim",
+                "trimEnd", "trimLeft", "trimRight", "trimStart", "toWellFormed"
               ]
             or
             // sorted, interesting, properties of Object.prototype

javascript/ql/test/library-tests/TripleDot/string-trim.js

@@ -0,0 +1,6 @@
+function trimming() {
+    sink(source('trimStart').trimStart()); // $ hasTaintFlow=trimStart
+    sink(source('trimEnd').trimEnd()); // $ hasTaintFlow=trimEnd
+    sink(source('normalize').normalize('NFC')); // $ hasTaintFlow=normalize
+    sink(source('trimLeft').trimLeft()); // $ hasTaintFlow=trimLeft
+}