JS: Add spurious alert marker

asgerf · asgerf · commit c051b4c98d6b · 2025-02-28T13:28:00.000+01:00
diff --git a/javascript/ql/test/query-tests/Security/CWE-089/untyped/pg-promise.js b/javascript/ql/test/query-tests/Security/CWE-089/untyped/pg-promise.js
@@ -39,7 +39,7 @@ require('express')().get('/foo', (req, res) => {
       req.params.id, // $ Alert
       req.params.name, // $ Alert
       req.params.foo, // OK - not using raw interpolation
-    ]
+    ] // $ SPURIOUS: Alert - implicit reads causes flow here in addition to the individual array elements
   });
   db.one({
     text: 'SELECT * FROM news where id = ${id}:raw AND name = ${name}',
