JS: Handle default 'content-type' header in Response() objects

[asgerf]

When using new Response() to construct HTTP responses, the content-type header defaults to text/plain;charset=utf-8 unless explicitly set to something else.

This means its argument is not an html-injection sink when the header is omitted.

[Copilot]

Pull request overview

This PR improves the JavaScript XSS detection by recognizing that the Response() constructor defaults to text/plain;charset=utf-8 content-type when no explicit content-type header is set. This means that new Response(data) without an explicit HTML content-type header is not an XSS sink, reducing false positives.

Key Changes:

• Updated the ResponseArgumentHeaders class to model the default content-type header behavior
• Removed XSS alerts from test cases where no content-type or non-HTML content-type is used
• Added new test cases to verify the behavior with unrelated headers

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
javascript/ql/lib/semmle/javascript/frameworks/WebResponse.qll	Implements logic to add a default text/plain;charset=utf-8 content-type when no explicit content-type header is defined
javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/response-object.js	Updates test cases by removing XSS alert annotations from Response calls with default or plain-text content-type, and adds new test cases
javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected	Removes expected XSS alerts that are now correctly not detected due to default content-type
javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected	Removes expected XSS alerts consistent with the main test expectations
javascript/ql/src/change-notes/2025-11-26-response-default-content-type.md	Documents the analysis improvement in the release notes

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Napalys]

Looks good to me