From 407029a677e1eed982231a5707b47d8f6081df15 Mon Sep 17 00:00:00 2001
From: Minseok Choe <choems@outlook.com>
Date: Tue, 20 Oct 2026 20:33:00 +0900
Subject: [PATCH] JS: Add taint steps for trimStart, trimEnd and normalize

---
 .../lib/change-notes/2026-10-20-string-trim-normalize.md  | 4 ++++
 .../ql/lib/semmle/javascript/dataflow/TaintTracking.qll   | 8 ++++----
 javascript/ql/test/library-tests/TripleDot/string-trim.js | 6 ++++++
 3 files changed, 14 insertions(+), 4 deletions(-)
 create mode 100644 javascript/ql/lib/change-notes/2026-10-20-string-trim-normalize.md
 create mode 100644 javascript/ql/test/library-tests/TripleDot/string-trim.js

diff --git a/javascript/ql/lib/change-notes/2026-10-20-string-trim-normalize.md b/javascript/ql/lib/change-notes/2026-10-20-string-trim-normalize.md
new file mode 100644
index 000000000000..ccafb5b33836
--- /dev/null
+++ b/javascript/ql/lib/change-notes/2026-10-20-string-trim-normalize.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added taint steps for `String.prototype.trimStart`, `trimEnd`, and `normalize`.
diff --git a/javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll b/javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll
index 862cf1b84274..5d7895b53dbc 100644
--- a/javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll
+++ b/javascript/ql/lib/semmle/javascript/dataflow/TaintTracking.qll
@@ -455,10 +455,10 @@ module TaintTracking {
             name =
               [
                 "anchor", "big", "blink", "bold", "concat", "fixed", "fontcolor", "fontsize",
-                "italics", "link", "padEnd", "padStart", "repeat", "replace", "replaceAll", "slice",
-                "small", "strike", "sub", "substr", "substring", "sup", "toLocaleLowerCase",
-                "toLocaleUpperCase", "toLowerCase", "toUpperCase", "trim", "trimLeft", "trimRight",
-                "toWellFormed"
+                "italics", "link", "normalize", "padEnd", "padStart", "repeat", "replace",
+                "replaceAll", "slice", "small", "strike", "sub", "substr", "substring", "sup",
+                "toLocaleLowerCase", "toLocaleUpperCase", "toLowerCase", "toUpperCase", "trim",
+                "trimEnd", "trimLeft", "trimRight", "trimStart", "toWellFormed"
               ]
             or
             // sorted, interesting, properties of Object.prototype
diff --git a/javascript/ql/test/library-tests/TripleDot/string-trim.js b/javascript/ql/test/library-tests/TripleDot/string-trim.js
new file mode 100644
index 000000000000..4fe19d24f895
--- /dev/null
+++ b/javascript/ql/test/library-tests/TripleDot/string-trim.js
@@ -0,0 +1,6 @@
+function trimming() {
+    sink(source('trimStart').trimStart()); // $ hasTaintFlow=trimStart
+    sink(source('trimEnd').trimEnd()); // $ hasTaintFlow=trimEnd
+    sink(source('normalize').normalize('NFC')); // $ hasTaintFlow=normalize
+    sink(source('trimLeft').trimLeft()); // $ hasTaintFlow=trimLeft
+}