JS: remove encodeURI from sanitizer list of request forgery

[Napalys]

No description provided.

[Copilot]

Pull Request Overview

This PR removes encodeURI from the list of recognized sanitizers in request-forgery analysis, so calls to encodeURI no longer suppress alerts.

• Added a test case in serverSide.js to show encodeURI(input) is now flagged.
• Updated the expected alerts in RequestForgery.expected to include the new alert for encodedUrl.
• Modified RequestForgeryCustomizations.qll to filter out encodeURI from being treated as a sanitizer.
• Added a change note documenting the removal of encodeURI.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
javascript/ql/test/query-tests/Security/CWE-918/serverSide.js	Added encodeURI(input) and its flagged axios.get call.
javascript/ql/test/query-tests/Security/CWE-918/RequestForgery.expected	Updated expected alerts to include the new encodedUrl case.
javascript/ql/lib/semmle/javascript/security/dataflow/RequestForgeryCustomizations.qll	Excluded encodeURI calls from UriEncodingSanitizer.
javascript/ql/lib/change-notes/2025-06-13-remove-encodeuri.md	Documented the removal of encodeURI from the sanitizer list.

Comments suppressed due to low confidence (2)

javascript/ql/lib/change-notes/2025-06-13-remove-encodeuri.md:4

• [nitpick] Since the analysis comment mentions both encodeURI and encodeURIComponent, update this change note to also mention removal of encodeURIComponent if that exclusion is intended.

* Removed `encodeURI` function from the sanitizer list for request forgery.

javascript/ql/lib/semmle/javascript/security/dataflow/RequestForgeryCustomizations.qll:114

• The comment above mentions both encodeURI and encodeURIComponent as not valid URL sanitizers, but only encodeURI is excluded. Consider adding a similar exclusion for encodeURIComponent to match the documentation.

class UriEncodingSanitizer extends Sanitizer instanceof Xss::Shared::UriEncodingSanitizer {