JS: Add support for props callbacks in Vue router configs

[asgerf]

Adds a missing endpoint to the vue-router model

[Copilot]

Pull request overview

This PR adds support for detecting taint sources in Vue Router's props configuration when it uses callback functions. The props option in Vue Router can be either a function that receives a route object, or an object where each property is a function receiving a route object. Previously, these callbacks were not modeled as sources of tainted data.

Changes:

• Extended the Vue Router model to detect route objects passed to props callbacks
• Added test cases covering both function-based and object-based props configurations
• Updated test expectations to reflect the new taint sources being detected

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
javascript/ql/lib/semmle/javascript/frameworks/Vue.qll	Added two new predicates to detect route objects in props callbacks (both function and object forms)
javascript/ql/test/library-tests/frameworks/Vue/router.js	Added test cases for props as a function and props as an object with function values
javascript/ql/test/library-tests/frameworks/Vue/tests.expected	Updated expected test results with new taint sources detected from props callbacks
javascript/ql/src/change-notes/2026-01-13-vue-props-callbacks.md	Added release notes documenting the enhancement

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Napalys]

👍

[joshimar]

Thanks for the fix, @asgerf 🥇

[CallMeGreg]

Thank you @joshimar for catching this gap and raising the feedback! ✨ 🙇