Hi @Anemone95

I've asked the CodeQL JavaScript team to have a look at your question.

Hi @Anemone95,

Just to clarify a few things:

• Most queries do not consider library inputs as taint sources, but there are some that do.
• Library inputs are parameters to functions that could be called from a dependent package. That is, being exported from a module is not enough, the function has to be exposed somehow from the main file of a package.json file.

I don't think any of our queries would actually flag the function you showed here. The js/unsafe-code-construction query comes close, but it only flags cases where the data has passed through a string concatenation first. That might be what you're seeing. In this case you may consider disabling that specific query.