JS SQL injection detection miss

[dbrin (Dmitry Brin)]

Sorry to bring back an old thread, but there is a Jira ticket listed in a resolution and I cant see the status of the ticket:

Jira

Old thread: Basic SQL injection not detected in JS files - Rules and Languages / Report False-positive / False-negative… - Sonar Community

I ran into this issue recently, on Data Center Edition, v2025.1.1

[Colin]

Hey @dbrin

I can confirm that ticket, which is in a private backlog, is still open.

@Loris how’s it going?

[Loris (Loris Sierra)]

Hello @dbrin, thanks a lot for bringing this ticket back to my attention!

Between 2022 and today, we wrote an entirely new JS engine for complex JS data flow tracking, which (among other things) definitely unprioritized and slowed down this ticket’s implementation.

I cleaned-up the ticket and updated it, and this should now be closed in the next iterations

Thanks,

Loris