JS: Track response data through promises

javascript/ql/lib/change-notes/2026-08-01-client-response-promise-data.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* JavaScript security queries using the `response` threat model now track promise-wrapped client response data into promise fulfillment values. This may improve results for queries such as `js/xss` when response data is consumed through `.then(...)` chains.

javascript/ql/lib/semmle/javascript/frameworks/ClientRequests.qll

@@ -1016,6 +1016,18 @@ module ClientRequest {
     override string getSourceType() { result = "HTTP response data" }
   }
 
+  /**
+   * A taint step from promise-wrapped response data to the value that the promise resolves to.
+   */
+  private class ClientRequestResponsePromiseStep extends TaintTracking::SharedTaintStep {
+    override predicate promiseStep(DataFlow::Node node1, DataFlow::Node node2) {
+      exists(ClientRequest r |
+        r.getAResponseDataNode(_, true).getALocalSource().flowsTo(node1) and
+        PromiseFlow::loadStep(node1, node2, Promises::valueProp())
+      )
+    }
+  }
+
   /**
    * An additional taint step that captures taint propagation from the receiver of fetch response methods
    * (such as "json", "text", "blob", and "arrayBuffer") to the call result.