JS: Handle Next.js files named 'page' or 'route'

[asgerf]

The Next.js model was missing cases for files named route.ts or page.ts outside the pages or api folders.

[Copilot]

Pull request overview

This PR fixes a bug in the Next.js model to properly detect server-side taint sources in files named route.ts or page.tsx/.jsx that appear outside the traditional api and pages folders, specifically within the app directory structure used by Next.js 13+ App Router.

Key Changes

• Refactored folder resolution predicates to support recursive traversal of app and pages directories
• Extended getAPagesModule() to recognize files named page anywhere within the app folder hierarchy
• Enhanced NextAppRouteHandler to recognize files named route anywhere within the app folder hierarchy

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
javascript/ql/lib/semmle/javascript/frameworks/Next.qll	Refactored folder predicates and extended route/page file detection to support Next.js App Router structure
javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/app/blah/route.ts	Added test case for route handler in non-api folder
javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/app/blah/page.jsx	Added test case for page component with server-side functions in non-pages folder
javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXssWithCustomSanitizer.expected	Updated expected test results to include new test cases
javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/ReflectedXss.expected	Updated expected test results to include new test cases
javascript/ql/src/change-notes/2025-11-26-nextjs-page-route-files.md	Added change note documenting the bug fix

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Napalys]

LGTM. 👍