JavaScript: Exclude debug npm package from js/log-injection sinks

[kiro-agent]

This pull request was created by @kiro-agent on behalf of @mrigankpawagi 👻

Comment with /kiro fix to address specific feedback or /kiro all to address everything.
_{Learn about Kiro Web}

---

Summary

This PR improves the js/log-injection query by excluding calls to the debug npm package from being considered as log injection sinks.

Problem

MRVA (Multi-Repository Variant Analysis) on the top-100 JavaScript repositories revealed many false positives from calls to the debug npm package. For example, 10 out of 12 alerts in microsoft/playwright were from debug.* calls in test/proxy code. The debug package is a development debugging utility that:

• Only outputs to stderr when the DEBUG environment variable is explicitly set
• Is not a production logging mechanism
• Is typically disabled entirely in production

Flagging these as log injection sinks generates noise without security value.

Changes

1. Modified LoggingSink class in javascript/ql/lib/semmle/javascript/security/dataflow/LogInjectionQuery.qll:

   • Changed from this = any(LoggerCall console).getAMessageComponent()
   • To an exists() pattern that excludes calls matching API::moduleImport("debug").getReturn().getACall()

2. Test case - Added a test in javascript/ql/test/query-tests/Security/CWE-117/logInjectionGood.js demonstrating that debug() calls are not flagged.

3. Change note - Added javascript/ql/src/change-notes/2025-06-07-log-injection-exclude-debug.md.

MRVA Validation

• Eliminates false positives from debug package usage across many repositories
• Notable: microsoft/playwright alerts reduced from 12 to ~2 (the remaining are legitimate console.log/console.error sinks)
• Other logging mechanisms (console.log, winston, pino, bunyan, etc.) remain correctly flagged

Why this is correct

The debug npm package (https://www.npmjs.com/package/debug) is fundamentally different from production loggers:

const debug = require('debug')('myapp:server');
debug('listening on port %s', port); // Only outputs if DEBUG=myapp:server is set

1. Not production output - It's disabled by default and only activates with explicit DEBUG env var
2. Developer-only - Used for development/debugging, not for production log aggregation
3. No log file persistence - Outputs to stderr only when enabled, not to persistent log files that could be targeted by log injection