JavaScript: Reduce false positives in js/regex/missing-regexp-anchor for non-URL patterns

[mrigankpawagi]

Summary

Reduces false positives in the js/regex/missing-regexp-anchor query by filtering out hasMisleadingAnchorPrecedence results where the regex clearly does not match URLs or hostnames.

Problem

MRVA on top-100 JavaScript repositories showed 42 misleading anchor precedence alerts. Many of these are false positives for patterns that are clearly not hostname/URL-related:

• File extension matching: /\.tsx?$|\.mjs$/
• CLI argument matching: /^ast|spidermonkey$|code$/
• Module name matching: /^BrowserAnimationsModule|NoopAnimationsModule$/
• Event name matching: /^click|mouse|touch/
• CSS property matching: /^@media|@page/

The query is classified under CWE-020 (Improper Input Validation) and targets URL/hostname validation bypasses, but was over-reporting on any regex with anchored alternatives.

Fix

Added a filter requiring that hasMisleadingAnchorPrecedence alerts have at least one dot character (either escaped \. or unescaped .) in the regex pattern. Hostnames inherently contain dots (e.g., example.com), while patterns matching simple strings, module names, event names, or CLI arguments typically do not use dots. This eliminates the majority of false positives while preserving all true positives.

MRVA Validation

• Before: 42 misleading precedence alerts (many FPs)
• After: Only patterns containing dots are flagged, which are plausibly URL/hostname-related
• No true positives lost (all hostname patterns naturally contain dots)

Test Changes

Updated the test expectations in tst-SemiAnchoredRegExp.js to reflect the intentional reduction in alerts for non-hostname patterns.