JS: Add support for escape

[Napalys]

Included escape and unescape functions as additional flow steps.

[Copilot]

Pull Request Overview

This PR adds support for handling the escape and unescape functions in test cases for tainted paths.

• Added test cases in TaintedPath.js to validate flows involving escape() and unescape()
• Updated change notes to document the new flow steps

Reviewed Changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.

File	Description
javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.js	Added test cases using escape() and unescape() to trigger security alerts
javascript/ql/lib/change-notes/2025-03-14-escape.md	Documented the support added for escape() and unescape() flows

Files not reviewed (2)

• javascript/ql/lib/semmle/javascript/security/dataflow/TaintedPathCustomizations.qll: Language not supported
• javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected: Language not supported

Tip: Copilot only keeps its highest confidence comments to reduce noise and keep you focused. Learn more

[asgerf]

Could you also add escape as a StringManipulationTaintStep like unescape, and then add it as a sanitizer for XSS?

You can look at UriEncodingSanitizer in Xss.qll as an example of how to add sanitisers to all the XSS queries.