[sam-robson]

Fixes #23123

SanitizedChar treats s[i] as sanitized when equality guards exclude each character in getAShellChar() and i is a number. It does not check the type of s, so an array element bypasses the single-character checks:

s = ["x; touch /tmp/marker"]
  s[0] === ";"   // false, whole element reaches sink, no alert

Require s to have inferred type string:

     SanitizedChar() {
       exists(AccessPath ap | this.asExpr() = ap.getAnInstance() |
         forall(string char | char = getAShellChar() | blocksCharInAccess(ap, char, astNode))
       ) and
-      astNode.getPropertyNameExpr().analyze().getTheType() = TTNumber()
+      astNode.getPropertyNameExpr().analyze().getTheType() = TTNumber() and
+      astNode.getBase().analyze().getTheType() = TTString()
     }

[Copilot]

🟡 Changes recommended

A duplicate sanitizeShellString declaration overrides the original fixture helper, and the production sanitizer-classification change lacks DCA results to assess unexpected alert changes.

2 open issues

• Rename duplicate sanitizer helper to keep fixtures independent · New
• Assess DCA results for production sanitizer changes · New

What changed in this PR

Tightens JavaScript shell-command sanitizer recognition so array elements are not mistaken for sanitized single characters.

Changes:

• Requires SanitizedChar to have an inferred string base.
• Adds string-type regression cases and updates expected alerts and data-flow paths.
• Documents the detection change and possible false positives around string conversions.

File	Description
javascript/​ql/​test/​query-tests/​Security/​CWE-078/​UnsafeShellCommandConstruction/​UnsafeShellCommandConstruction.expected	Updates expected alerts and data-flow paths.
javascript/​ql/​test/​query-tests/​Security/​CWE-078/​UnsafeShellCommandConstruction/​lib/​lib.js	Adds string-type regression cases and adjusts alert annotations.
javascript/​ql/​lib/​semmle/​javascript/​security/​dataflow/​UnsafeShellCommandConstructionCustomizations.qll	Requires a string base for SanitizedChar.
javascript/​ql/​lib/​change-notes/​2026-11-13-sanitized-char-string-base.md	Documents detection changes and string-conversion limitations.

_{Review effort: Max (dynamic)}

[Copilot]

🟡 Changes recommended

The test does not isolate the intended type-inference limitation, and the production query change lacks DCA evidence assessing downstream alert changes or regressions.

2 open issues

• Use a single-use sanitizer to isolate the inference limitation · New
• Assess DCA results for production sanitizer changes

1 resolved since last review

• Rename duplicate sanitizer helper to keep fixtures independent

_{Review effort: Max (dynamic)}